Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Advanced Networking - Specialty · AWS
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
B is correct! Fail-close vs Fail-Open (DNS Firewall Configuration): • Fail-close: Resolver blocks query if no response from DNS Firewall (security over availability) • Fail-open: Resolver allows query if no response from DNS firewall (availability over security)
B is the correct answer. The definition of fail open, fellow engineers!
To meet the requirement of maintaining DNS query resolution even if Route 53 Resolver DNS Firewall is unresponsive, the network engineer should implement option B: B. Update the DNS Firewall VPC configuration to enable fail open for the VPC. When you enable "fail open" mode for a VPC's DNS Firewall configuration, it means that if the DNS Firewall service becomes unresponsive or unavailable, the DNS queries will be allowed to pass through without being blocked. This ensures that the application's service level agreements are maintained even if the DNS Firewall service experiences issues. By enabling fail open, you ensure that DNS queries can still be resolved even if DNS Firewall is not functioning correctly. This can prevent disruption to your applications and services due to DNS resolution failures.