The company hosts production workloads in multiple AWS accounts. EC2 instances run Amazon Linux 2 across several VPCs. Each VPC uses its own Route 53 private hosted zone for internal DNS. A VPC in Account A must be able to resolve private DNS records that belong to a private hosted zone associated with a VPC in Account B. What steps should the SysOps administrator take to enable this cross-account resolution?

To enable cross-account private DNS resolution, the owner of the private hosted zone (Account B) must first authorize the association. This is done by creating a VPC association authorization in Account B, specifying the VPC ID from Account A and the private hosted zone ID from Account B. Once authorized, the owner of the requesting VPC (Account A) can then associate their VPC with the private hosted zone in Account B. This two-step process ensures that both accounts explicitly agree to the association, maintaining security and control. Incorrect options: Modifying /etc/resolv.conf is a manual and fragile approach that doesn't scale and bypasses AWS's managed DNS resolution. CloudFormation templates are for infrastructure as code, but the core issue is the authorization and association process, not just templating. The order of operations in the third option is reversed; the authorization must come from the account owning the hosted zone (Account B), not the requesting VPC (Account A).