You must design a hybrid DNS solution that uses an Amazon Route 53 private hosted zone for cloud.example.com for resources inside VPCs. On-premises systems must resolve and connect to cloud.example.com. All VPCs must be able to resolve cloud.example.com. There is an existing AWS Direct Connect link to an AWS Transit Gateway. Which architecture provides the HIGHEST performance to meet these requirements?

The correct option provides the highest performance because associating the private hosted zone with every VPC allows all VPCs to directly resolve cloud.example.com using the default VPC DNS resolver, which is highly performant. Deploying a Route 53 Resolver inbound endpoint in a shared-services VPC and forwarding on-premises queries to it ensures on-premises systems can resolve cloud resources efficiently. The other options are less performant or incorrect: An EC2-based conditional DNS forwarder introduces an additional hop and management overhead compared to a native Route 53 Resolver. Associating the private hosted zone only with the shared-services VPC would require all other VPCs to forward queries to the shared-services VPC, adding latency and complexity. An outbound endpoint is for forwarding queries from AWS to on-premises, not the other way around. Attaching only the shared-services VPC to the Transit Gateway would prevent other VPCs from directly communicating with on-premises resources via the TGW, which is a core requirement for a hybrid setup.