Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Practice Test 20

Question 190

A dualstack Application Load Balancer serves an internal application and Route 53 hosts its private zone. Its AWS-managed IPv6 addresses can change. Which record type avoids hardcoding an address?

  1. Create an A alias to the ALB and rely on it for IPv6 AAAA responses as well
  2. Publish a literal AAAA record with the ALB’s current IPv6 addresses
  3. Create an SRV record containing the ALB hostname and its HTTPS port
  4. Create an AAAA alias record that targets the dualstack Application Load Balancer

Explanation

Correct Answer

D:

An AAAA alias to the dualstack ALB resolves IPv6 clients using the load balancer’s AWS-managed target rather than pinning an IP address. The alias remains correct when backend addresses change.

Incorrect Answers

A:

An A alias returns an IPv4-oriented answer, not an AAAA response for IPv6-only lookups. The DNS name needs the IPv6 alias record explicitly.

B:

A literal AAAA record pins addresses that the load balancer can change. An alias delegates resolution to the AWS-managed ALB target.

C:

SRV records advertise service location and port metadata for SRV-aware clients, not the AAAA response used for ordinary IPv6 hostname resolution.

Question 191

An application needs to discover an internal service's TCP port and hostname rather than only an address. Which DNS record can represent both?

  1. Review the matching DNS Firewall domain list rules and their evaluation priorities
  2. Add a suitable AAAA record holding the IPv6 address
  3. Create an alias A or AAAA record to the ALB DNS target as appropriate
  4. Permit required DNS traffic on both UDP and TCP port 53 to endpoint addresses
  5. Publish an SRV record for the relevant service and protocol

Explanation

Correct Answer

E:

SRV records indicate service endpoints, ports, and priorities, whereas A records convey only IPv4 addresses. A client using SRV records can discover both the service host and TCP or UDP port instead of guessing the service’s endpoint.

Incorrect Answers

A:

Resolver DNS Firewall evaluates rule-group associations and ordered rules to permit, block, or alert on domain queries; that addresses domain-specific resolver filtering behavior, rather than service-and-port discovery through DNS.

B:

IPv6 clients request AAAA data, so an A record alone cannot return the new v6 destination; this belongs to authoritative resolution of IPv6 application targets, while the problem is service-and-port discovery through DNS.

C:

The alias resolves through the AWS endpoint's managed addresses without storing individual ephemeral balancer node IPs; this changes dynamic AWS endpoint resolution through Route 53 aliases, not the necessary service-and-port discovery through DNS.

D:

In the supported DNS transport to inbound Resolver endpoints workflow, recursive DNS primarily uses UDP but may require TCP for larger messages or protocol fallback; both must be routable and permitted; the current case needs service-and-port discovery through DNS.

Question 192

After enabling Route 53 Resolver DNS Firewall, an approved internal hostname becomes blocked. Which policy component should be reviewed?

  1. Publish an SRV record for the relevant service and protocol
  2. Associate the outbound forwarding rule with the workload VPC
  3. Review the matching DNS Firewall domain list rules and their evaluation priorities
  4. Permit required DNS traffic on both UDP and TCP port 53 to endpoint addresses

Explanation

Correct Answer

C:

Resolver DNS Firewall evaluates rule-group associations and ordered rules to permit, block, or alert on domain queries.

Incorrect Answers

A:

SRV records indicate service endpoints, ports, and priorities, whereas A records convey only IPv4 addresses; that addresses service-and-port discovery through DNS, rather than domain-specific resolver filtering behavior.

B:

A rule controls resolution only for VPCs associated with it; merely creating a rule in an account has no global DNS effect; this belongs to activating conditional forwarding in a specific VPC, while the problem is domain-specific resolver filtering behavior.

D:

In the supported DNS transport to inbound Resolver endpoints workflow, recursive DNS primarily uses UDP but may require TCP for larger messages or protocol fallback; both must be routable and permitted; the current case needs domain-specific resolver filtering behavior.

Question 193

A zone manager enables Route 53 DNSSEC signing but the parent registrar lacks delegation-signer data. What is missing for public chain-of-trust validation?

  1. Provide unique set identifiers and weights on the weighted record sets
  2. Use an eligible Route 53 alias record at the zone apex
  3. Recognize private hosted zone precedence for the matching suffix
  4. Publish the correct DS record through the domain's parent delegation

Explanation

Correct Answer

D:

Validating resolvers rely on the parent DS linkage to establish trust in the child's signed DNSKEY material. Publishing DS through the parent creates the delegation-of-trust link from the signed parent to the child zone.

Incorrect Answers

A:

Weighted record sets of the same name need distinct identifiers and configured weights so Route 53 can select among them; that addresses independently managed weighted DNS alternatives, rather than DNSSEC authentication chain to the authoritative zone.

B:

DNS apex nodes require SOA and NS records, so a CNAME cannot coexist there; alias records target supported AWS endpoints without that conflict; this belongs to apex-compatible DNS alias to an AWS service, while the problem is DNSSEC authentication chain to the authoritative zone.

C:

The associated private zone is authoritative for that VPC namespace; unanswered names do not normally spill to the public zone; this changes private DNS namespace precedence over public records, not the necessary DNSSEC authentication chain to the authoritative zone.

Question 194

An AWS-hosted public name has an existing CNAME at the zone apex; the configuration is rejected. How should a supported AWS resource be addressed at the apex?

  1. Add a conditional forwarding rule on the branch resolvers for the AWS namespace
  2. Create an alias A or AAAA record to the ALB DNS target as appropriate
  3. Do not expect AWS Organizations membership alone to grant private-zone resolution
  4. Use an eligible Route 53 alias record at the zone apex

Explanation

Correct Answer

D:

DNS apex nodes require SOA and NS records, so a CNAME cannot coexist there; alias records target supported AWS endpoints without that conflict.

Incorrect Answers

A:

Split-horizon forwarding sends only specified suffixes toward AWS inbound endpoints while other names follow normal resolution; that addresses domain-targeted corporate DNS forwarding, rather than apex-compatible DNS alias to an AWS service.

B:

The alias resolves through the AWS endpoint's managed addresses without storing individual ephemeral balancer node IPs; this belongs to dynamic AWS endpoint resolution through Route 53 aliases, while the problem is apex-compatible DNS alias to an AWS service.

C:

Organizational membership can help authorize resource-sharing workflows, but VPC association controls resolver visibility for private hosted zones; this changes explicit network-scoped private DNS authorization, not the necessary apex-compatible DNS alias to an AWS service.

Question 195

A branch DHCP service directs AWS-connected clients to local resolvers, but their queries for `cloud.internal` go to the public internet. Which local policy should be added?

  1. Use an eligible Route 53 alias record at the zone apex
  2. Add a Route 53 Resolver outbound endpoint and forwarding rule with target resolver IPs
  3. Share the Resolver rule with participating accounts by using AWS RAM
  4. Add a conditional forwarding rule on the branch resolvers for the AWS namespace

Explanation

Correct Answer

D:

Split-horizon forwarding sends only specified suffixes toward AWS inbound endpoints while other names follow normal resolution.

Incorrect Answers

A:

DNS apex nodes require SOA and NS records, so a CNAME cannot coexist there; alias records target supported AWS endpoints without that conflict; that addresses apex-compatible DNS alias to an AWS service, rather than domain-targeted corporate DNS forwarding.

B:

Resolver outbound rules direct matching VPC queries across network connectivity to selected external name servers; this belongs to outbound conditional forwarding to enterprise DNS, while the problem is domain-targeted corporate DNS forwarding.

C:

AWS RAM distributes rule access while consumers associate the rule with their VPCs; this changes reusable hybrid DNS rules across AWS accounts, not the necessary domain-targeted corporate DNS forwarding.

Question 196

An engineering team wants DNS responses weighted 80/20 during deployment, but both endpoints use the same record name and type. What Route 53 metadata distinguishes them?

  1. Associate suitable Route 53 health checks or eligible target health evaluation with the routing records
  2. Use an eligible Route 53 alias record at the zone apex
  3. Provide unique set identifiers and weights on the weighted record sets
  4. Associate Route 53 Resolver query-logging configuration with the relevant VPCs

Explanation

Correct Answer

C:

Weighted record sets of the same name need distinct identifiers and configured weights so Route 53 can select among them.

Incorrect Answers

A:

Latency preference alone is not an availability probe; health evaluation removes failed candidates from eligible routing results; that addresses availability gating for latency-oriented DNS policies, rather than independently managed weighted DNS alternatives.

B:

DNS apex nodes require SOA and NS records, so a CNAME cannot coexist there; alias records target supported AWS endpoints without that conflict; this belongs to apex-compatible DNS alias to an AWS service, while the problem is independently managed weighted DNS alternatives.

D:

In the traceability of internal DNS lookups workflow, resolver query logs provide client-oriented query metadata for traffic handled through the VPC resolver; the current case needs independently managed weighted DNS alternatives.

Question 197

A Route 53 latency record sends clients to an endpoint in an unhealthy region. How can Route 53 avoid selecting that record?

  1. Use an eligible Route 53 alias record at the zone apex
  2. Associate suitable Route 53 health checks or eligible target health evaluation with the routing records
  3. Create an alias A or AAAA record to the ALB DNS target as appropriate
  4. Associate Route 53 Resolver query-logging configuration with the relevant VPCs
  5. Provide unique set identifiers and weights on the weighted record sets

Explanation

Correct Answer

B:

Latency preference alone is not an availability probe; health evaluation removes failed candidates from eligible routing results.

Incorrect Answers

A:

DNS apex nodes require SOA and NS records, so a CNAME cannot coexist there; alias records target supported AWS endpoints without that conflict; that addresses apex-compatible DNS alias to an AWS service, rather than availability gating for latency-oriented DNS policies.

C:

The alias resolves through the AWS endpoint's managed addresses without storing individual ephemeral balancer node IPs; this changes dynamic AWS endpoint resolution through Route 53 aliases, not the necessary availability gating for latency-oriented DNS policies.

D:

In the traceability of internal DNS lookups workflow, resolver query logs provide client-oriented query metadata for traffic handled through the VPC resolver; the current case needs availability gating for latency-oriented DNS policies.

E:

This produces independently managed weighted DNS alternatives: Weighted record sets of the same name need distinct identifiers and configured weights so Route 53 can select among them; the stem instead tests availability gating for latency-oriented DNS policies.

Question 198

A DNS cutover must minimize stale answers after moving a service IP. When should the low TTL be configured?

  1. Lower TTL ahead of the migration and allow preexisting higher-TTL answers to expire
  2. Provide unique set identifiers and weights on the weighted record sets
  3. Add a conditional forwarding rule on the branch resolvers for the AWS namespace
  4. Associate suitable Route 53 health checks or eligible target health evaluation with the routing records

Explanation

Correct Answer

A:

Existing caches can retain earlier responses until their prior TTL ends, so last-minute TTL reduction cannot immediately clear them.

Incorrect Answers

B:

Weighted record sets of the same name need distinct identifiers and configured weights so Route 53 can select among them; this belongs to independently managed weighted DNS alternatives, while the problem is planned DNS cache expiration for migration.

C:

Split-horizon forwarding sends only specified suffixes toward AWS inbound endpoints while other names follow normal resolution; this changes domain-targeted corporate DNS forwarding, not the necessary planned DNS cache expiration for migration.

D:

In the availability gating for latency-oriented DNS policies workflow, latency preference alone is not an availability probe; health evaluation removes failed candidates from eligible routing results; the current case needs planned DNS cache expiration for migration.

Question 199

A VPC has a Route 53 Resolver DNS Firewall rule group associated with it. During a temporary DNS Firewall service disruption, security policy requires unevaluated queries to be denied rather than bypassing the filter. Which VPC-level setting meets that requirement?

  1. Enable FirewallFailOpen so that unanswered firewall inspections still resolve
  2. Lower the TTL of the public hosted-zone A records
  3. Add a Route 53 Resolver inbound endpoint for external recursive resolvers
  4. Keep FirewallFailOpen disabled, so the VPC Resolver returns SERVFAIL when DNS Firewall cannot evaluate the query

Explanation

Correct Answer

D:

Fail-closed is the default for a VPC with DNS Firewall rules: when the firewall gives no reply, Route 53 Resolver blocks that query with SERVFAIL instead of allowing an uninspected lookup.

Incorrect Answers

A:

Fail-open favors availability by allowing DNS queries to continue when DNS Firewall does not return a decision; that would violate the requirement to deny unevaluated queries.

B:

Authoritative DNS record TTLs govern caching of answers; they do not decide how the VPC Resolver behaves when the DNS Firewall service cannot evaluate a query.

C:

An inbound endpoint enables DNS queries from on-premises resolvers to reach private AWS namespaces; it does not enforce the fail-closed failure mode of an associated DNS Firewall.

Question 200

A DNS record points to an ALB, but the ALB changes its node IP addresses after scaling. Which Route 53 record form removes hardcoded IP maintenance?

  1. Provide unique set identifiers and weights on the weighted record sets
  2. Create an alias A or AAAA record to the ALB DNS target as appropriate
  3. Create Route 53 Resolver inbound endpoint IP addresses and point conditional forwarding to them
  4. Ensure bidirectional network routing and endpoint security-group permission for DNS traffic

Explanation

Correct Answer

B:

The alias resolves through the AWS endpoint's managed addresses without storing individual ephemeral balancer node IPs.

Incorrect Answers

A:

Weighted record sets of the same name need distinct identifiers and configured weights so Route 53 can select among them; that addresses independently managed weighted DNS alternatives, rather than dynamic AWS endpoint resolution through Route 53 aliases.

C:

Inbound endpoints provide supported external DNS ingress into a VPC's resolver context; a random instance IP is not equivalent; this changes DNS ingress from corporate resolvers into Route 53 Resolver, not the necessary dynamic AWS endpoint resolution through Route 53 aliases.

D:

In the return-path reachability for hybrid DNS endpoints workflow, resolver forwarding requires network reachability between endpoint addresses and target resolvers in both directions; the current case needs dynamic AWS endpoint resolution through Route 53 aliases.

AWS Certified Advanced Networking - Specialty ANS-C01 Practice Tests