A failover record should point to an internal ALB in a private subnet. Route 53 health checkers can't reach private IPs. How do you health-check it?
A.Create a CloudWatch alarm on the ALB's metrics and a Route 53 health check that watches the alarm state
Correct — alarm-based health checks are the documented pattern for private endpoints.
B.Point the health check at the ALB's public DNS name — Route 53 resolves it inside the VPC
Public DNS resolves outside the VPC to public IPs; checkers never enter your VPC.
C.Enable private health checking in the hosted zone settings
No such feature exists.
D.Use a Route 53 Resolver inbound endpoint to proxy the check
Resolver endpoints serve DNS resolution for hybrid networks — unrelated to health checking.
Why this answer
Route 53 health checkers run outside the VPC. For private resources you create a CloudWatch metric/alarm (e.g., HealthyHostCount) and configure a Route 53 'state of CloudWatch alarm' health check.
Correct answer: A · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the DNS & Edge Routing practice session.
Practice DNS & Edge Routing