Factory instances in a private VPC must resolve a corporate DNS name that exists only on the plant's resolvers. Public DNS has no such name, and no inbound endpoint is involved. What should the VPC use?
Select an answer to reveal the explanation.
Short Explanation
The name lives in the plant, so you have to walk the question over there. An outbound Resolver endpoint plus a forwarding rule sends queries for that domain to the corporate resolvers. An inbound endpoint faces the other direction, and a NAT gateway is not a DNS forwarder.
Full Explanation
Route 53 Resolver answers names it knows from the VPC. A corporate name that exists only on the plant's resolvers is reached by an outbound endpoint, which gives Resolver elastic network interfaces in the VPC, and a forwarding rule that sends that domain to the plant resolver addresses. A public hosted zone would publish the name on the public internet, which the scenario forbids and which would not consult the plant resolvers. An inbound endpoint is what on-premises resolvers use when they need to query names that live in the VPC. It does not forward VPC queries outbound. A NAT gateway forwards IP traffic that is routed to it. VPC DNS queries go to the Resolver at the VPC DNS address, not through the NAT gateway, unless someone has pointed instance resolvers somewhere else. Caveat: the forwarding rule must be associated with this VPC, and the outbound endpoint's security group must allow the queries to the plant resolvers. Operational check: from an instance, resolve the corporate name and confirm the answer matches the plant, then confirm a name in the VPC's own private zone still resolves locally.