AWS Certified Advanced Networking - Specialty
Get started today
Ultimate access to all questions.
Ultimate access to all questions.
A company has an AWS Site-to-Site VPN connection linking its VPC to an on-premises network, with the default DHCP options set associated with the VPC. An application running on an Amazon Linux 2 EC2 instance within the VPC needs to retrieve an Amazon RDS database secret stored in AWS Secrets Manager via a private VPC endpoint. Additionally, an on-premises application provides an internal RESTful API service accessible via the URL https://api.example.internal, with internal DNS resolution handled by two on-premises Windows DNS servers.
The EC2 instance's application fails to call the on-premises API service when using the service's hostname but succeeds when using the service's IP address. What steps should the network engineer take to resolve this issue and prevent it from impacting other VPC resources?
Explanation:
The issue described involves DNS resolution for an internal API service hosted on-premises, which is accessible via a VPN connection to the VPC. The application on the EC2 instance can reach the API service using its IP address but fails when using the hostname, indicating a DNS resolution problem. The correct approach to resolve this issue involves configuring DNS resolution in a way that queries for the internal domain (example.internal) are forwarded to the on-premises DNS servers. This can be achieved by creating an Amazon Route 53 Resolver rule that forwards DNS queries for the specific domain to the on-premises DNS servers. This solution is scalable and does not require manual configuration on each EC2 instance, making it the best option for preventing the issue from affecting other resources in the VPC. Option A is not ideal because changing the DHCP options set affects all instances in the VPC and may not be necessary if only specific domains need to be resolved by on-premises DNS servers. Option C and D involve manual configuration on the EC2 instance, which is not scalable and does not prevent the issue from affecting other resources in the VPC.