A VPC has enableDnsSupport set to true and enableDnsHostnames set to false. An EC2 instance in this VPC is launched with a public IPv4 address. What is the practical effect of this specific combination?
- The instance can still resolve DNS names (including public internet hostnames) using the Amazon-provided DNS resolver, but it is not assigned a public DNS hostname of its own, and the resolver cannot resolve Amazon-provided private DNS hostnames
- The instance cannot resolve any DNS names at all, because enableDnsHostnames is false
- The instance is assigned a public DNS hostname, but all resolver queries fail
- AWS rejects this combination and forces both attributes to the same value
Why A? And why not the others?
Correct answer: A. The instance can still resolve DNS names (including public internet hostnames) using the Amazon-provided DNS resolver, but it is not assigned a public DNS hostname of its own, and the resolver cannot resolve Amazon-provided private DNS hostnames
enableDnsSupport controls whether the Amazon-provided DNS resolver answers queries at all — since it's true here, general DNS resolution (including public internet hostnames) keeps working. enableDnsHostnames separately controls whether instances with public IP addresses are assigned a public DNS hostname; per AWS's own rules, 'if at least one of the attributes is set to false,' instances with public IPs do not receive public DNS hostnames and the resolver cannot resolve Amazon-provided private DNS hostnames either, even though it otherwise works fine. Option B is wrong because it conflates the hostname-assignment attribute with resolver availability, which enableDnsSupport alone governs. Option C reverses the actual effect of the two attributes. Option D is wrong because the two attributes are independently toggleable settings with no such enforced-equality validation.
Source: AWS VPC docs: Understanding Amazon DNS — DNS attributes for your VPC