A global manufacturer keeps corp.example.com on on-premises BIND servers and runs factory analytics in a VPC using the same name in a private hosted zone. On-premises BIND is authoritative for the plant.corp.example.com subdomain, while the private hosted zone holds the AWS record names under corp.example.com. EC2 must resolve on-premises names and plant resolvers must resolve AWS private names without leaking private IPs publicly. Which DNS solution delivers bidirectional hybrid resolution for the overlapping zone?

The correct design uses split-horizon with two Resolver directions: the private hosted zone associated to the VPC authoritatively answers AWS private names for EC2 via the VPC resolver, an outbound endpoint with a conditional forwarding rule for the more specific plant.corp.example.com sends on-premises names to BIND (a rule for the identical corp.example.com would override the private hosted zone and break AWS names), and an inbound endpoint gives on-premises BIND a VPC target with its own conditional forwarder for AWS-only records, keeping private IPs off the internet. Associating the private zone while pointing DHCP to on-premises servers fails by concept because EC2 would bypass the VPC resolver entirely and lose private zone resolution, breaking AWS names despite connectivity. Creating a public hosted zone with private IPs fails by concept because it publishes RFC 1918 addresses globally, leaks internal topology, and plant clients still face split-horizon conflicts without deterministic routing. Using only an outbound endpoint fails by concept because it fixes EC2 to on-premises resolution but provides no inbound path, so plant resolvers cannot reach the private hosted zone and bidirectional lookup remains incomplete. For the exam, overlapping zones signal Resolver inbound plus outbound with forwarding rules, and in practice check rule priorities, endpoint security groups on port 53, and that on-premises forwarders target the inbound addresses.