An insurance company is migrating workloads from on-premises to AWS. They require end-to-end DNS resolution and bidirectional DNS between AWS and on-premises. Workloads will move into multiple VPCs over time and depend on each other. Which solution meets these needs?

The correct solution establishes end-to-end and bidirectional DNS resolution. Using private hosted zones for each application VPC ensures internal AWS DNS resolution without exposing records publicly. An egress VPC centralizes Route 53 Resolver inbound and outbound endpoints, simplifying management and security. Inbound endpoints allow on-premises DNS servers to forward requests for AWS domains into AWS. Outbound endpoints, with Resolver rules, forward requests for on-premises domains from AWS to the on-premises DNS resolvers. Sharing Resolver rules and associating private hosted zones via AWS Resource Access Manager (RAM) enables seamless DNS across multiple VPCs and accounts as workloads migrate. Incorrect options: Using public hosted zones is inappropriate for internal application DNS, as it exposes internal records to the internet. Configuring on-premises DNS servers to forward cloud domains to Route 53 outbound endpoints is incorrect; inbound endpoints are designed to receive DNS queries from outside AWS. Associating Route 53 outbound rules with application VPCs and sharing private hosted zones separately is less efficient and more complex than associating private hosted zones with the egress VPC and sharing rules, which centralizes the Resolver configuration.