On-premises DNS servers must resolve private names that exist only in a VPC. The names must not be published on the public internet. What should the VPC side provide?
Select an answer to reveal the explanation.
Short Explanation
The on-premises resolvers need a private place to send questions for names that live in the VPC. That place is a Resolver inbound endpoint. A public hosted zone would publish those names, which is what you were told not to do.
Full Explanation
An inbound Resolver endpoint gives on-premises DNS servers IP addresses inside the VPC. They forward the private zone to those addresses, and Resolver answers from the VPC's private hosted zones. The names stay off the public internet. A public hosted zone publishes them. A NAT gateway does not answer DNS for a private zone. A PTR record on an Elastic IP does not resolve the VPC's private names. Caveat: the on-premises forwarders must reach the endpoint addresses over the VPN or Direct Connect, and the endpoint security group must allow their DNS. Operational check: from on-premises, a lookup of a private name should return the VPC address, and that name should not resolve on the public internet. Create the inbound endpoint in at least two subnets, allow the on-premises DNS servers to reach it on DNS, and configure those servers to forward the private domain to the endpoint addresses. Keep the records in a private hosted zone associated with the VPC. A public zone would answer the internet. From a laptop on the corporate network, the private name should resolve, and from an unrelated network it should not.