Correct Answer: Associate the PHZ with both the VPCs in us-east-1 and us-west-2, create active-passive failover records in the PHZ pointing to private IPs, and associate Route 53 health checks with the endpoints (ensuring health checkers can reach the database or status endpoints)
For failover routing in a Private Hosted Zone, you must associate the PHZ with all VPCs where name resolution is needed. In addition, Route 53 health checks can monitor endpoints i...
Correct Answer
Associate the PHZ with both the VPCs in us-east-1 and us-west-2, create active-passive failover records in the PHZ pointing to private IPs, and associate Route 53 health checks with the endpoints (ensuring health checkers can reach the database or status endpoints)
Why This Answer Is Correct
For failover routing in a Private Hosted Zone, you must associate the PHZ with all VPCs where name resolution is needed. In addition, Route 53 health checks can monitor endpoints in a private network (e.g., using private IPs if health checkers can reach them via VPN/Direct Connect, or by creating a public status endpoint that reflects the database's health). Without valid health checks, failover won't trigger.
This question evaluates your knowledge of Amazon Route 53 — a core concept tested in AWS Certified Solutions Architect – Professional (SAP-C02). Understanding Amazon Route 53 is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Your organization is hosting a globally available application. You want to route users to the closest healthy endpoint while automatically failing over to a secondary region if the primary region's health check fails. Which Route 53 routing policy and configuration should you use?
A financial services company has migrated its core application to two AWS regions: us-west-2 (Oregon) and eu-west-1 (Ireland). They want to route global users to the closest region using Amazon Route 53. However, due to compliance reasons, they need to route 80% of traffic originating from South America to the Oregon region, even though Ireland is physically closer to some Eastern parts of South America. What is the most effective Route 53 configuration to achieve this?
An online booking platform runs on a multi-region active-active architecture across us-east-1 and us-west-2. To prepare for disaster recovery, they want to implement a mechanism that can shift 100% of traffic away from a compromised region within 1 minute. They want to avoid automatic failover due to risk of split-brain, preferring a manual but rapid, centralized trigger that updates DNS. Which AWS capability is designed for this exact use case?
A security architect wants to prevent data exfiltration via DNS tunneling from EC2 instances running in a VPC. The instances use the default VPC DNS resolver (AmazonProvidedDNS). The architect needs to block outbound DNS queries to known malicious domains and dynamic DNS hosts, while allowing access to internal domains and AWS endpoints. What is the most operationally efficient way to implement this?