Amazon AWS Certified Advanced Networking - Specialty ANS-C01 Practice Test 4

Question 30

A security team wants a public zone to provide cryptographic proof of DNS record authenticity to validating resolvers. Which control must be enabled?

  1. Add an NS delegation record set for the child zone's authoritative name servers
  2. Set the registrar's authoritative name-server delegation to the hosted zone's assigned NS values
  3. Review the Route 53 health check's HealthCheckStatus metric in CloudWatch
  4. Define Route 53 failover records with primary and secondary roles and appropriate health evaluation
  5. Enable DNSSEC signing for the Route 53 public hosted zone and establish its chain of trust

Explanation

Correct Answer

E:

DNSSEC signs DNS data and relies on delegation signer information so validating resolvers can verify authentic responses.

Incorrect Answers

A:

NS delegation informs resolvers which authoritative servers control the delegated subdomain's records; that addresses delegation of child DNS authority, rather than signed public authoritative DNS data.

B:

The parent-zone delegation determines which public authoritative servers answer for the domain, independent of where records are edited; this belongs to alignment of registry delegation with authoritative DNS hosting, while the problem is signed public authoritative DNS data.

C:

DNS record query volume is distinct from endpoint reachability; health-check status reports whether configured probes consider the target healthy; this changes monitoring DNS-routing endpoint health, not the necessary signed public authoritative DNS data.

D:

In the active-passive authoritative DNS failover workflow, failover policies prefer the primary while healthy and can provide the secondary record when the primary fails its health condition; the current case needs signed public authoritative DNS data.

Question 31

A private service returns IPv6 addresses only. Which DNS record should applications query to locate it?

  1. Add a PTR record under the proper reverse-lookup domain
  2. Create a Route 53 alias A record targeting the Application Load Balancer
  3. Publish an MX record identifying the mail exchanger and its preference
  4. Publish an AAAA record for the service hostname

Explanation

Correct Answer

D:

AAAA record data contains IPv6 addresses; A records contain IPv4 addresses and cannot substitute an IPv6 response.

Incorrect Answers

A:

PTR records map reversed IP address names to hostnames, enabling conventional reverse DNS queries; that addresses reverse address-to-name resolution, rather than DNS mapping of a host name to an IPv6 address.

B:

Alias records can target supported AWS resources and resolve their current addresses without hardcoding balancer IPs; this belongs to stable DNS mapping to an AWS-managed load balancer, while the problem is DNS mapping of a host name to an IPv6 address.

C:

MX records direct SMTP delivery toward named mail servers with priorities, unlike address records used to locate hosts; this changes specification of inbound mail exchangers, not the necessary DNS mapping of a host name to an IPv6 address.

Question 32

A reverse-DNS integration needs a hostname returned from an IP-address-based lookup. Which record type belongs in the reverse zone?

  1. Publish an MX record identifying the mail exchanger and its preference
  2. Query the AmazonProvidedDNS resolver at the VPC base address plus two
  3. Add a PTR record under the proper reverse-lookup domain
  4. Deploy a Resolver inbound endpoint and configure on-premises conditional forwarding to its IPs

Explanation

Correct Answer

C:

PTR records map reversed IP address names to hostnames, enabling conventional reverse DNS queries. IPv4 reverse records live under in-addr.arpa, whereas IPv6 reverse records use ip6.arpa.

Incorrect Answers

A:

MX records direct SMTP delivery toward named mail servers with priorities, unlike address records used to locate hosts; that addresses specification of inbound mail exchangers, rather than reverse address-to-name resolution.

B:

The VPC resolver is available through a reserved address within the VPC, as well as its documented link-local interface; this belongs to reaching the built-in VPC DNS resolver, while the problem is reverse address-to-name resolution.

D:

In the resolving AWS private-zone names from external DNS infrastructure workflow, the inbound endpoint accepts recursive DNS requests from connected external resolvers and resolves using the VPC's DNS context; the current case needs reverse address-to-name resolution.

Question 33

An enterprise has multiple VPCs in one account, but only one can resolve a new private hosted zone. How can both use the zone without copying records?

  1. Investigate the private-zone namespace shadowing of unmatched names
  2. Associate the additional VPC with the existing private hosted zone
  3. Deploy a Resolver inbound endpoint and configure on-premises conditional forwarding to its IPs
  4. Create a Route 53 private hosted zone and associate the intended VPCs

Explanation

Correct Answer

B:

Private zone resolution is determined by authorized VPC associations, not by the AWS account boundary alone. Adding the intended VPC association makes the same authoritative records available without duplicate hosted zones.

Incorrect Answers

A:

A matching private hosted zone takes precedence for that namespace; absent private records do not automatically fall back to the public zone; that addresses avoiding mistaken public fallback when private DNS overrides a suffix, rather than sharing an authoritative private zone among VPCs.

C:

The inbound endpoint accepts recursive DNS requests from connected external resolvers and resolves using the VPC's DNS context; this changes resolving AWS private-zone names from external DNS infrastructure, not the necessary sharing an authoritative private zone among VPCs.

D:

In the VPC-scoped authoritative private DNS records workflow, A private hosted zone is resolved through VPC DNS facilities for associated VPCs rather than published to the public DNS hierarchy; the current case needs sharing an authoritative private zone among VPCs.

Question 34

An application inside a VPC needs to resolve private AWS names using the VPC-provided resolver. Which address is normally available inside the VPC?

  1. Query the AmazonProvidedDNS resolver at the VPC base address plus two
  2. Associate the additional VPC with the existing private hosted zone
  3. Create a Resolver outbound endpoint and a forwarding rule for the corporate domain
  4. Deploy a Resolver inbound endpoint and configure on-premises conditional forwarding to its IPs

Explanation

Correct Answer

A:

The VPC resolver is available through a reserved address within the VPC, as well as its documented link-local interface.

Incorrect Answers

B:

Private zone resolution is determined by authorized VPC associations, not by the AWS account boundary alone; this belongs to sharing an authoritative private zone among VPCs, while the problem is reaching the built-in VPC DNS resolver.

C:

The outbound endpoint sends selected DNS queries from the VPC toward specified on-premises name servers over connected networks; this changes forwarding AWS-originated internal DNS queries to on-premises, not the necessary reaching the built-in VPC DNS resolver.

D:

In the resolving AWS private-zone names from external DNS infrastructure workflow, the inbound endpoint accepts recursive DNS requests from connected external resolvers and resolves using the VPC's DNS context; the current case needs reaching the built-in VPC DNS resolver.

Question 35

A VPC workload needs name lookups for `corp.internal` answered by Active Directory DNS servers on-premises. What Route 53 Resolver resources are required?

  1. Create a Resolver outbound endpoint and a forwarding rule for the corporate domain
  2. Query the AmazonProvidedDNS resolver at the VPC base address plus two
  3. Share the Route 53 Resolver forwarding rule across accounts by using AWS RAM
  4. Deploy a Resolver inbound endpoint and configure on-premises conditional forwarding to its IPs

Explanation

Correct Answer

A:

The outbound endpoint sends selected DNS queries from the VPC toward specified on-premises name servers over connected networks.

Incorrect Answers

B:

The VPC resolver is available through a reserved address within the VPC, as well as its documented link-local interface; this belongs to reaching the built-in VPC DNS resolver, while the problem is forwarding AWS-originated internal DNS queries to on-premises.

C:

Shared Resolver rules can be associated with participating VPCs, consolidating DNS forwarding configuration rather than duplicating endpoints; this changes multi-account distribution of reusable DNS forwarding rules, not the necessary forwarding AWS-originated internal DNS queries to on-premises.

D:

In the resolving AWS private-zone names from external DNS infrastructure workflow, the inbound endpoint accepts recursive DNS requests from connected external resolvers and resolves using the VPC's DNS context; the current case needs forwarding AWS-originated internal DNS queries to on-premises.

Question 36

An on-premises DNS server needs to resolve names in an AWS private hosted zone associated with a central VPC. What must the AWS side expose?

  1. Query the AmazonProvidedDNS resolver at the VPC base address plus two
  2. Create a Resolver outbound endpoint and a forwarding rule for the corporate domain
  3. Associate the additional VPC with the existing private hosted zone
  4. Deploy a Resolver inbound endpoint and configure on-premises conditional forwarding to its IPs
  5. Investigate the private-zone namespace shadowing of unmatched names

Explanation

Correct Answer

D:

The inbound endpoint accepts recursive DNS requests from connected external resolvers and resolves using the VPC's DNS context.

Incorrect Answers

A:

The VPC resolver is available through a reserved address within the VPC, as well as its documented link-local interface; that addresses reaching the built-in VPC DNS resolver, rather than resolving AWS private-zone names from external DNS infrastructure.

B:

The outbound endpoint sends selected DNS queries from the VPC toward specified on-premises name servers over connected networks; this belongs to forwarding AWS-originated internal DNS queries to on-premises, while the problem is resolving AWS private-zone names from external DNS infrastructure.

C:

Private zone resolution is determined by authorized VPC associations, not by the AWS account boundary alone; this changes sharing an authoritative private zone among VPCs, not the necessary resolving AWS private-zone names from external DNS infrastructure.

E:

This produces avoiding mistaken public fallback when private DNS overrides a suffix: A matching private hosted zone takes precedence for that namespace; absent private records do not automatically fall back to the public zone; the stem instead tests resolving AWS private-zone names from external DNS infrastructure.

Question 37

A central DNS team already has an outbound Resolver endpoint and needs 40 workload VPCs to reuse domain-forwarding logic. What should be shared?

  1. Create a Resolver outbound endpoint and a forwarding rule for the corporate domain
  2. Share the Route 53 Resolver forwarding rule across accounts by using AWS RAM
  3. Deploy a Resolver inbound endpoint and configure on-premises conditional forwarding to its IPs
  4. Configure Route 53 Resolver query logging for the required VPCs

Explanation

Correct Answer

B:

Shared Resolver rules can be associated with participating VPCs, consolidating DNS forwarding configuration rather than duplicating endpoints.

Incorrect Answers

A:

The outbound endpoint sends selected DNS queries from the VPC toward specified on-premises name servers over connected networks; that addresses forwarding AWS-originated internal DNS queries to on-premises, rather than multi-account distribution of reusable DNS forwarding rules.

C:

The inbound endpoint accepts recursive DNS requests from connected external resolvers and resolves using the VPC's DNS context; this changes resolving AWS private-zone names from external DNS infrastructure, not the necessary multi-account distribution of reusable DNS forwarding rules.

D:

In the observability of VPC DNS lookups workflow, resolver query logs capture queries handled by Resolver and deliver them to a supported logging destination; the current case needs multi-account distribution of reusable DNS forwarding rules.

Question 38

A VPC should send DNS query logs to a central logging destination for investigation of malicious domain lookups. Which service feature supplies the records?

  1. Create a Resolver outbound endpoint and a forwarding rule for the corporate domain
  2. Query the AmazonProvidedDNS resolver at the VPC base address plus two
  3. Share the Route 53 Resolver forwarding rule across accounts by using AWS RAM
  4. Configure Route 53 Resolver query logging for the required VPCs

Explanation

Correct Answer

D:

Resolver query logs capture queries handled by Resolver and deliver them to a supported logging destination. The events can include queried names, query types, response codes, and source context, not complete network packet payloads.

Incorrect Answers

A:

The outbound endpoint sends selected DNS queries from the VPC toward specified on-premises name servers over connected networks; that addresses forwarding AWS-originated internal DNS queries to on-premises, rather than observability of VPC DNS lookups.

B:

The VPC resolver is available through a reserved address within the VPC, as well as its documented link-local interface; this belongs to reaching the built-in VPC DNS resolver, while the problem is observability of VPC DNS lookups.

C:

Shared Resolver rules can be associated with participating VPCs, consolidating DNS forwarding configuration rather than duplicating endpoints; this changes multi-account distribution of reusable DNS forwarding rules, not the necessary observability of VPC DNS lookups.

Question 39

A hybrid estate needs both directions of private DNS integration: VPC instances should resolve datacenter names and corporate resolvers should answer names hosted only inside AWS. Which TWO Resolver endpoint functions are needed? Choose TWO.

  1. Deploy a Resolver inbound endpoint and configure on-premises conditional forwarding to its IPs
  2. Create a Resolver outbound endpoint and a forwarding rule for the corporate domain
  3. Configure geolocation routing records with country-specific rules and a default record
  4. Create a Route 53 private hosted zone and associate the intended VPCs
  5. Enable DNSSEC signing for the Route 53 public hosted zone and establish its chain of trust

Explanation

Correct Answers

A:

The inbound endpoint accepts recursive DNS requests from connected external resolvers and resolves using the VPC's DNS context; this covers the resolving AWS private-zone names from external DNS infrastructure component of the combined scenario.

B:

The outbound endpoint sends selected DNS queries from the VPC toward specified on-premises name servers over connected networks; this covers the forwarding AWS-originated internal DNS queries to on-premises component of the combined scenario.

Incorrect Answers

C:

Geolocation routing selects responses from location mappings, with a default for clients not matching a specified geography; this changes country-based DNS steering, not the necessary bidirectional private DNS integration across VPN or Direct Connect.

D:

In the VPC-scoped authoritative private DNS records workflow, A private hosted zone is resolved through VPC DNS facilities for associated VPCs rather than published to the public DNS hierarchy; the current case needs bidirectional private DNS integration across VPN or Direct Connect.

E:

This produces signed public authoritative DNS data: DNSSEC signs DNS data and relies on delegation signer information so validating resolvers can verify authentic responses; the stem instead tests bidirectional private DNS integration across VPN or Direct Connect.

Question 40

A DNS administrator wants to verify that the domain registrar delegates an Internet zone to Route 53. Which setting must match the Route 53 hosted zone?

  1. Set the registrar's authoritative name-server delegation to the hosted zone's assigned NS values
  2. Enable DNSSEC signing for the Route 53 public hosted zone and establish its chain of trust
  3. Investigate the private-zone namespace shadowing of unmatched names
  4. Add an NS delegation record set for the child zone's authoritative name servers

Explanation

Correct Answer

A:

The parent-zone delegation determines which public authoritative servers answer for the domain, independent of where records are edited.

Incorrect Answers

B:

DNSSEC signs DNS data and relies on delegation signer information so validating resolvers can verify authentic responses; this belongs to signed public authoritative DNS data, while the problem is alignment of registry delegation with authoritative DNS hosting.

C:

A matching private hosted zone takes precedence for that namespace; absent private records do not automatically fall back to the public zone; this changes avoiding mistaken public fallback when private DNS overrides a suffix, not the necessary alignment of registry delegation with authoritative DNS hosting.

D:

In the delegation of child DNS authority workflow, NS delegation informs resolvers which authoritative servers control the delegated subdomain's records; the current case needs alignment of registry delegation with authoritative DNS hosting.

AWS Certified Advanced Networking - Specialty ANS-C01 Practice Tests