A Route53 private hosted zone lives in the shared-services account. VPCs in other accounts must resolve its records. What's required?
A.Associate each spoke VPC with the PHZ using cross-account authorization
Cross-account authorization + association. Correct.
B.Create identical zones per account
Duplicate zones fork the records — unmaintainable.
C.Public zone delegation
Public zones expose names to the internet — not the requirement.
D.Route53 Resolver forwarding only
Resolver forwards to on-prem DNS — not the PHZ-sharing mechanism.
Why this answer
PHZ→VPC association is explicit: for cross-account, the zone owner authorizes each VPC association (CLI/authorization request → accept in the VPC's account). Resolver rules can also share zones, but the direct mechanism is cross-account VPC association.
Correct answer: A · Last reviewed 2026-11-05
Official AWS references
Practice this interactively
Answer without seeing the solution first in the DNS & Edge Routing practice session.
Practice DNS & Edge Routing