A transit authority requires bidirectional hybrid DNS: on-premises resolvers must answer queries for private Route 53 records in AWS, and domain-joined jump hosts in AWS must resolve corporate DNS names. Which approach meets this need?
Select an answer to reveal the explanation.
Short Explanation
Hybrid DNS is a two-way street: the garage needs to find buses in AWS, and AWS jump boxes need to find names back at HQ. Route 53 Resolver inbound and outbound endpoints plus forwarding rules build that street. Public zones or hosts files are band-aids, not an architecture.
Full Explanation
Bidirectional hybrid DNS for a transit authority requires Route 53 Resolver inbound endpoints, outbound endpoints, and forwarding rules working together. Inbound endpoints let on-premises resolvers recursively resolve records in private hosted zones inside AWS, so garage and operations networks can find private application names without publishing them on the public internet. Outbound endpoints with forwarding rules send selected queries from AWS workloads—such as domain-joined jump hosts—to on-premises DNS for corporate namespaces. That combination creates a controlled two-way resolution fabric across the hybrid boundary.
Creating only public Route 53 hosted zones for private application names forces internal naming onto the public DNS system, which increases exposure and is the wrong confidentiality model for garage and fleet internals. Hard-coding hosts-file entries on every jump host and workstation does not scale, drifts immediately as records change, and forbids the automated DNS hygiene enterprise directories expect. Relying exclusively on CloudFront alias records misunderstands both CDN DNS and Resolver: CloudFront does not replace inbound/outbound Resolver endpoints for private hybrid namespace forwarding.
Exam caveat: remember the directionality—inbound Resolver endpoints serve on-premises clients resolving AWS private zones; outbound endpoints plus rules send VPC queries to on-premises DNS; private hosted zones alone are not enough without the Resolver plumbing. Operational check: from an on-premises resolver, query a private hosted-zone name via the inbound endpoint IP; from a domain-joined jump host in AWS, resolve a corporate name that should forward outbound; confirm security groups on the endpoints allow DNS from the intended CIDRs and that forwarding rules match the correct domains.