A company uses a shared AWS account for connectivity to on-premises data centers. Private internal web services run in multiple AWS accounts and are accessed by office employees using DNS names in an on-premises zone named example.internal. Registering a new AWS-hosted service currently requires a manual multi-team change to the internal DNS. The company wants service owners to be able to register their DNS records directly, with minimal configuration changes and low cost. Which combination of steps should the network engineer implement? (Choose three.)

The solution aims to enable self-service DNS registration for AWS-hosted services from on-premises. Creating a Route 53 private hosted zone named aws.example.internal in the shared account establishes a central domain for AWS services. An inbound Resolver endpoint in the shared account allows on-premises DNS servers to conditionally forward queries for aws.example.internal to AWS. For each service account, a private hosted zone (e.g., account1.aws.example.internal) is created in the shared account and associated with both the service VPC and the shared account VPC. This allows service owners to manage their specific records within their designated sub-zone, which is then resolved via the central aws.example.internal zone. Incorrect options: Creating a DNS record for each service in its local private hosted zone and giving that DNS record to employees doesn't centralize resolution or enable self-service for on-premises users. Creating a Resolver rule to forward queries for onprem.example.internal is for AWS to on-premises resolution, not the other way around. Launching EC2 instances with BIND is a complex, high-cost, and high-maintenance solution compared to native Route 53 Resolver features.