ANS-C01 DNS, Service Discovery, and Resiliency Guide

DNS questions on ANS-C01 are availability and control-plane questions. AWS is testing whether you can decide where a name should resolve, who is allowed to resolve it, how DNS answers change during failure, and when DNS is the wrong layer for fast traffic movement.

The current AWS task statement is to design DNS solutions that meet public, private, and hybrid requirements. The official scope includes Route 53 integration with AWS networking services, Route 53 Resolver endpoints in hybrid and AWS architectures, and DNS behavior in multi-account and multi-Region designs. Treat DNS as part of the network architecture, not as a record-type memorization exercise.

What the exam is really testing

Most wrong answers confuse a name-resolution problem with a traffic-forwarding problem, or a public DNS problem with a private/hybrid one.

DNS pattern chooser

DNS resolution path model

Use this model before selecting a record type or resolver endpoint.

    flowchart LR
	  Q["Query source"] --> V["Visibility: public, private VPC, or hybrid"]
	  V --> A["Authority: hosted zone, Resolver rule, or on-prem DNS"]
	  A --> P["Policy: simple, weighted, latency, failover, geolocation, or service discovery"]
	  P --> E["Endpoint answer"]
	  E --> R["Separate routing and security path"]

The last box is the ANS-C01 trap. DNS can return a correct answer while the packet path still fails because of routes, security groups, NACLs, endpoint policy, firewall rules, or asymmetric return routing.

Route 53 routing policy chooser

Routing policies decide DNS answers. They do not replace CloudFront, Global Accelerator, ALB, NLB, Transit Gateway, or application-level health logic.

Private hosted zones and split-view DNS

Private hosted zones are strong when the same organization needs private names that should resolve only inside associated VPCs. They also support split-view DNS, where a public name and a private name can share the same domain but return different answers depending on where the query originates.

Use private hosted zones when:

• internal services need stable private names
• multiple VPCs need the same internal namespace
• public users must not resolve private service targets
• AWS workloads need private DNS answers that differ from public answers

Watch for VPC associations. A private hosted zone does not automatically resolve from every VPC or every account. If the question spans accounts, Regions, or VPCs, verify association and sharing behavior instead of assuming the name is globally visible.

Resolver inbound versus outbound

This distinction is one of the highest-yield ANS-C01 DNS traps.

Inbound and outbound are named from the perspective of Route 53 Resolver. Inbound means queries come into AWS Resolver. Outbound means AWS Resolver forwards queries out.

Service discovery and Cloud Map

AWS Cloud Map is stronger when the problem is dynamic service discovery rather than manually managed DNS records. Cloud Map can register resources such as ECS tasks, EC2 instances, and other application resources and make them discoverable through DNS queries or API calls.

Use Cloud Map when:

• service instances change frequently
• applications need to discover healthy service endpoints
• DNS-based discovery or API-based discovery is part of the runtime design
• ECS or another platform is registering and deregistering service instances

Do not use Cloud Map as a generic replacement for hybrid Resolver endpoints. A dynamic service registry still needs the correct DNS visibility and resolution path.

DNS failover limitations

Route 53 health checks and failover policies are useful, but DNS is not instantaneous traffic control.

If the stem says “fast regional failover,” “static global IPs,” or “TCP/UDP acceleration,” Route 53 alone may be weaker than Global Accelerator.

Hybrid DNS patterns

The network path for UDP/TCP 53 still matters. Resolver endpoints need reachability, security group permissions, and route paths just like any other endpoint.

Common scenario patterns

Exam eliminations

Troubleshooting order

When a DNS scenario fails, use this order:

1. Identify query source: public internet, VPC workload, on-premises resolver, or another VPC/account.
2. Identify expected authority: public hosted zone, private hosted zone, Resolver rule, on-premises DNS, or Cloud Map namespace.
3. Check visibility: hosted zone association, Resolver rule association, account sharing, and Region scope.
4. Check the query direction: inbound to AWS Resolver or outbound from AWS Resolver.
5. Verify DNS endpoint security groups, routes, NACLs, firewall rules, and UDP/TCP 53 reachability.
6. Check routing policy, health checks, TTLs, and cached answers.
7. After resolution works, verify packet routing and security to the returned endpoint.

This sequence prevents the common mistake of changing records when the real problem is query direction, private hosted zone association, or packet reachability after resolution.

Sample exam question

An enterprise has a private hosted zone named corp.internal associated with a shared services VPC. On-premises clients connected through Direct Connect must resolve records in that private hosted zone. AWS workloads must also resolve ad.example.com, which is hosted by on-premises DNS servers. Which design is strongest?

• Create only a public hosted zone for corp.internal and publish private IP addresses.
• Create only a Route 53 Resolver inbound endpoint and use it for both query directions.
• Configure an inbound Resolver endpoint for on-premises queries to AWS private DNS, and configure an outbound Resolver endpoint with forwarding rules for AWS queries to on-premises DNS.
• Use Global Accelerator to forward DNS queries between the data center and AWS.

Answer: Use both inbound and outbound Resolver patterns.

Why: The scenario has two directions. On-premises clients resolving AWS private hosted zone names need an inbound endpoint. AWS workloads resolving on-premises names need an outbound endpoint plus forwarding rules. A public hosted zone would expose the wrong visibility. Global Accelerator is not a DNS forwarding service.

Fast decision rule

Choose public hosted zones for internet-visible authoritative DNS. Choose private hosted zones for VPC-visible private names. Choose Resolver inbound endpoints when on-premises DNS must query AWS private names. Choose Resolver outbound endpoints and forwarding rules when AWS workloads must query on-premises DNS. Choose Route 53 routing policies for DNS-level answer selection. Choose Cloud Map for dynamic service discovery. Do not use DNS as a substitute for packet routing, load balancing, or fast anycast traffic steering.

Quiz

Continue with 1.3 Load Balancing and Traffic Management to connect DNS answer selection to regional load-balancer and edge-routing behavior.