Correct Answer: Configure Route 53 Resolver DNS Firewall rules associated with the VPC
Route 53 Resolver DNS Firewall is a managed security service that lets you filter DNS queries made by resources inside your VPCs through the Route 53 Resolver (AmazonProvidedDNS). ...
Correct Answer
Configure Route 53 Resolver DNS Firewall rules associated with the VPC
Why This Answer Is Correct
Route 53 Resolver DNS Firewall is a managed security service that lets you filter DNS queries made by resources inside your VPCs through the Route 53 Resolver (AmazonProvidedDNS). You can configure rule groups to block queries to domain names that you know are malicious, preventing DNS tunneling and exfiltration.
This question evaluates your knowledge of Amazon Route 53 — a core concept tested in AWS Certified Solutions Architect – Professional (SAP-C02). Understanding Amazon Route 53 is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
Your organization is hosting a globally available application. You want to route users to the closest healthy endpoint while automatically failing over to a secondary region if the primary region's health check fails. Which Route 53 routing policy and configuration should you use?
A financial services company has migrated its core application to two AWS regions: us-west-2 (Oregon) and eu-west-1 (Ireland). They want to route global users to the closest region using Amazon Route 53. However, due to compliance reasons, they need to route 80% of traffic originating from South America to the Oregon region, even though Ireland is physically closer to some Eastern parts of South America. What is the most effective Route 53 configuration to achieve this?
An enterprise uses Amazon Route 53 Private Hosted Zones (PHZs) inside a VPC for name resolution of database endpoints. The main database is hosted in us-east-1, and a replica is in us-west-2. On-premises datacenters resolve endpoints using Route 53 Inbound Resolvers. They want to set up an active-passive failover for the database endpoint (db.corp.internal) using Route 53. What configuration must they implement to ensure proper failover resolution for both VPC resources and on-premises users?
An online booking platform runs on a multi-region active-active architecture across us-east-1 and us-west-2. To prepare for disaster recovery, they want to implement a mechanism that can shift 100% of traffic away from a compromised region within 1 minute. They want to avoid automatic failover due to risk of split-brain, preferring a manual but rapid, centralized trigger that updates DNS. Which AWS capability is designed for this exact use case?