A manufacturer runs corp.example.com on on-premises Active Directory DNS and runs the same domain in a VPC via a Route 53 private hosted zone for EC2 workloads. Both sides must resolve each other's new records without changing the domain name. Which DNS integration design achieves bidirectional hybrid resolution for this split-horizon namespace?
Select an answer to reveal the explanation.
Short Explanation
You've got the same name living in two places, so you need smart traffic cops. Conditional forwarding sends each query to the right DNS authority without renaming anything.
Full Explanation
Route 53 Resolver endpoints enable true bidirectional hybrid DNS: outbound endpoints let VPC queries matching a forwarding rule go to on-premises servers while inbound endpoints give on-premises servers a VPC entry point to resolve private hosted zone records, and associating the private hosted zone to the VPC provides authoritative answers for AWS names. A Route 53 public hosted zone fails by concept because public zones are internet-visible and do not answer VPC private names, plus pointing DHCP at on-premises DNS breaks private zone resolution. Self-managed BIND with zone transfers fails by concept because it adds operational burden and fragile replication instead of using native conditional forwarding that forwards only matching domains. Using only a private hosted zone with firewall rules fails by concept because reachability alone does not create name resolution without inbound endpoints and forwarder rules to route the split-horizon queries. Exam caveat: remember inbound is on-premises to AWS and outbound is AWS to on-premises. Practical check: verify Resolver rule domain match and test dig from both sides after association.