A company will migrate an internal application to AWS. The app will run on EC2 instances in a single VPC and users will access it from on-premises data centers over AWS VPN or AWS Direct Connect. Users must use private domain names reserved for use in AWS, and each EC2 instance must automatically fail over to another EC2 instance in the same AWS account and VPC. The DNS design must not expose the application to the internet. Which solution satisfies these requirements?

The correct solution ensures the application is not exposed to the internet by placing EC2 instances in private subnets and using a Route 53 private hosted zone. An Inbound Resolver endpoint allows on-premises DNS servers to query the private hosted zone for the application's private IP addresses, fulfilling the private domain name requirement. Primary and failover records with a CloudWatch alarm-based health check provide automatic failover. Incorrect options: Assigning public IPs and using public hosted zones exposes the application to the internet, violating a key requirement. Using a Route 53 outbound endpoint is for AWS to query on-premises DNS, not the other way around. Relying solely on Route 53 health checks targeting IP addresses might not accurately reflect application health, as a server could be up but the application itself down. CloudWatch metrics and alarms offer more granular application-level health monitoring.