Two VPCs, A and B, are connected by an active VPC peering connection, and both VPCs already have DNS hostnames and DNS resolution enabled. An instance in VPC A resolves the public DNS hostname of an instance in VPC B (for example, ec2-x-x-x-x....amazonaws.com) and gets back that instance's public IPv4 address, even though both instances could reach each other privately over the peering connection. What must be configured so that resolving that same public DNS hostname instead returns the private IPv4 address, keeping the traffic off the public internet path?
- Nothing further is possible; a public DNS hostname always resolves to a public IP address, regardless of any VPC peering configuration
- Create a Route 53 private hosted zone associated with both VPCs and manually add records duplicating every instance's public hostname
- Enable the 'DNS resolution' option for the VPC peering connection — with the owner of the requester VPC enabling it for the requester side and the owner of the accepter VPC enabling it for the accepter side — which makes the public DNS hostname resolve to the instance's private IPv4 address for requests that traverse that peering connection
- Disable the enableDnsHostnames attribute on both VPCs; turning off DNS hostname support is what causes public hostnames to resolve to private addresses over a peering connection
Why C? And why not the others?
Correct answer: C. Enable the 'DNS resolution' option for the VPC peering connection — with the owner of the requester VPC enabling it for the requester side and the owner of the accepter VPC enabling it for the accepter side — which makes the public DNS hostname resolve to the instance's private IPv4 address for requests that traverse that peering connection
A VPC peering connection has its own DNS settings, separate from the VPCs' own enableDnsSupport/enableDnsHostnames attributes: by default, DNS resolution for the peering connection is disabled, so a public IPv4 DNS hostname resolves to the public IPv4 address even for a request crossing the peering connection; once DNS resolution is enabled, the same public hostname instead resolves to the private IPv4 address, keeping traffic off the internet. Enabling it requires both sides to act — the requester VPC owner enables it for the requester side and the accepter VPC owner enables it for the accepter side (or both at once if the same account owns both). The 'nothing further is possible' option is wrong because AWS documents exactly this peering-connection DNS resolution setting as the mechanism to change the behavior. The Route 53 private-hosted-zone option is wrong because it's a heavier, redundant workaround that duplicates records manually instead of using the built-in per-peering-connection setting AWS already provides for this exact scenario. The 'disable enableDnsHostnames' option is wrong because that VPC-level attribute controls whether instances receive DNS hostnames at all, not how those hostnames resolve across a peering connection, and disabling it would break hostname assignment rather than fix cross-peering resolution.
Source: AWS VPC Peering Guide: 'Enable DNS resolution for a VPC peering connection' — DNS resolution disabled (default) resolves the public hostname to the public IP; enabled resolves it to the private IP, requiring the requester and accepter VPC owners to each modify their side's peering options.