On-premises servers must resolve private hosted zone names (app.internal.company.com) hosted in Route 53. Which component receives those queries inside AWS?
A.Outbound endpoint
Outbound goes the other direction: VPC→on-prem.
B.Inbound endpoint — ENIs in the VPC that on-prem DNS servers forward to
Correct. On-prem forwards to inbound endpoint IPs.
C.A public hosted zone
Public zones answer internet queries — private names stay unresolvable on-prem.
D.DNS Firewall
Firewall filters queries — doesn't receive them.
Why this answer
Inbound endpoints place resolver ENIs in your VPC — on-premises resolvers forward queries for your private zone names to those IPs. It's the mirror of the outbound endpoint (AWS→on-prem). Remember: INbound = INto AWS.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the DNS & Edge Routing practice session.
Practice DNS & Edge Routing