Jeff’s Insights #
“Unlike generic exam dumps, Jeff’s Insights is designed to make you think like a Real-World Production Architect. We dissect this scenario by analyzing the strategic trade-offs required to balance operational reliability, security, and long-term cost across multi-service deployments.”
While preparing for the AWS SAP-C02, many candidates get confused by hybrid DNS architectures. In the real world, this is fundamentally a decision about balancing performance and operational cost. Let’s drill into a simulated scenario.
The Architecture Drill (Simulated Question) #
Scenario #
GlobalTech Dynamics, a multinational technology company, is expanding its cloud footprint by adopting AWS extensively. They operate multiple AWS VPCs containing critical applications under the internal domain corp.globaltech.com, managed via Amazon Route 53 private hosted zones. The company also runs on-premises IT infrastructure that must resolve and communicate with these private domain names as if they were local. A dedicated AWS Direct Connect link already exists between their headquarters data center and the AWS Transit Gateway connecting all VPCs.
The Requirement #
Design a highly performant and operationally sound DNS resolution architecture that meets these criteria:
- On-premises DNS servers must resolve corp.globaltech.com domain names hosted in AWS private hosted zones.
- All AWS VPCs must be able to resolve corp.globaltech.com resources internally.
- The solution must leverage the existing Direct Connect and Transit Gateway topology.
- Optimize for lowest latency queries from on-premises to AWS and minimize complexity for cloud DNS management.
The Options #
- A) Associate the private hosted zone with all VPCs; deploy a Route 53 inbound resolver endpoint in a shared services VPC; attach all VPCs to the Transit Gateway; configure on-premises DNS to forward corp.globaltech.com queries to the inbound resolver.
- B) Associate the private hosted zone with all VPCs; deploy an EC2-based conditional forwarder in a shared services VPC; attach all VPCs to the Transit Gateway; configure on-premises DNS to forward corp.globaltech.com queries to the EC2 forwarder.
- C) Associate the private hosted zone only with the shared services VPC; deploy a Route 53 outbound resolver endpoint in the shared services VPC; attach all VPCs to the Transit Gateway; configure on-premises DNS to forward corp.globaltech.com queries to the outbound resolver.
- D) Associate the private hosted zone only with the shared services VPC; deploy a Route 53 inbound resolver endpoint in the shared services VPC; attach the shared services VPC to the Transit Gateway; configure on-premises DNS to forward corp.globaltech.com queries to the inbound resolver.
Correct Answer #
Option D.
The Architect’s Analysis #
Correct Answer #
Option D
The Winning Logic #
Option D offers the cleanest and most cost-effective architecture by:
- Associating the private hosted zone only with the shared services VPC avoids the complexity and added cost of multiple VPC associations, which increases management overhead and resource limits.
- Deploying a Route 53 inbound resolver endpoint allows on-premises DNS servers to forward queries inbound directly to AWS Resolver. This meets the on-prem DNS resolution requirement with native AWS service and without managing EC2 instances.
- Attaching only the shared services VPC to the Transit Gateway keeps the architecture simple and reduces cross-VPC DNS forwarding complexities—VPCs can still resolve their private hosted zones internally.
- Minimizing the number of resolver endpoints and EC2 forwarders reduces monthly charges and operational complexity, aligning well with FinOps principles.
This solution balances performance (lowest DNS query latency for hybrid resolution) with operational simplicity and cost-efficiency.
The Trap (Distractor Analysis): #
- Why not Option A? Associating the private hosted zone to every VPC scales poorly and increases risk of misconfigurations. While it can improve internal resolution, the on-prem DNS must still route queries through the inbound resolver, adding no extra performance gain beyond Option D.
- Why not Option B? Running EC2 conditional forwarders adds continuous operational overhead, patching, and cost vs managed Route 53 resolver endpoints. This goes against FinOps best practice to reduce EC2-based DNS infrastructure.
- Why not Option C? Outbound resolver endpoints are designed for resolving on-premises DNS queries outbound to internet DNS namespaces, not inbound requests from on-premises to private hosted zones, so this fails the fundamental requirement.
The Architect Blueprint #
Diagram Note: On-prem DNS forwards to Route 53 inbound resolver in the shared services VPC, which resolves private hosted zone records. All VPCs connect through Transit Gateway allowing internal DNS resolution from any VPC.
The Decision Matrix #
| Option | Est. Complexity | Est. Monthly Cost (Quantified) | Pros | Cons |
|---|---|---|---|---|
| A | Medium | High ($500+) | Direct private hosted zone association for all VPCs; native service-based inbound resolver | Complex at scale, higher management overhead, more expensive due to scope |
| B | High | Very High ($800+) | Conditional forwarders can be customized easily | EC2 overhead & costs; greater operational risk; not fully managed |
| C | High | Medium ($300) | Uses managed Route 53 outbound resolver | Doesn’t meet inbound DNS requirement; architecturally incorrect |
| D | Low | Low ($150) | Single inbound resolver, centralized management, cost-efficient | Limited to association on shared services VPC only |
Real-World Application (Practitioner Insight) #
Exam Rule #
For the AWS SAP-C02 exam, always pick Route 53 inbound resolver endpoints when you see hybrid DNS resolution from on-prem to AWS private hosted zones.
Real World #
In practice, large enterprises may also implement redundant inbound endpoints across multiple Availability Zones for high availability, or integrate with AWS Firewall DNS logging and monitoring tools — elements often not covered in exam scenarios but critical to production readiness.
Disclaimer
This is a study note based on simulated scenarios for the AWS SAP-C02 exam. It is not an official question from the certification body.