DNS records for example.com are in a private Route 53 hosted zone in Account A. Applications and databases run in Account B. You are deploying a two-tier app in a new VPC in Account B and created a db.example.com CNAME record in the private hosted zone in Account A for the RDS endpoint. The application EC2 instance cannot resolve db.example.com, although the record is correct in Route 53. What steps should you take to fix name resolution? (Choose two.)

To resolve DNS records from a private Route 53 hosted zone in a different account, a cross-account association is required. First, Account A (owner of the private hosted zone) must authorize the association of its hosted zone with the VPC in Account B. This authorization is a necessary prerequisite. Second, Account B (owner of the VPC) must then associate its VPC with the private hosted zone in Account A. Once the association is established, the authorization can be optionally deleted as it's no longer needed for ongoing resolution. The other options are incorrect: Deploying the database on an EC2 instance and creating a new record doesn't address the cross-account private DNS resolution issue. Manually editing /etc/resolv.conf is a temporary, non-scalable workaround that bypasses Route 53. Replicating the zone is not a standard or efficient solution for cross-account private DNS resolution; direct association is the correct method.