ANS-C01 Question 36
Single answerYour company uses Route 53 as its DNS service, and you are tasked with monitoring DNS queries for compliance and troubleshooting. Which solution allows you to log and analyze DNS query data for Route 53 effectively?
- A
Enable Route 53 Resolver query logging and send logs to Amazon CloudWatch Logs, S3, or Kinesis Data Firehose.
- B
Enable Route 53 DNSSEC to automatically log DNS queries for analysis.
- C
Integrate Route 53 with AWS Config to capture and log DNS query data.
- D
Use VPC Flow Logs to monitor DNS query data in Route 53.
Show answer and explanation
Correct answer: A
Explanation
The correct solution for logging DNS queries in Route 53 is to enable Route 53 Resolver query logging. This feature allows you to capture DNS query data and send it to CloudWatch Logs, S3, or Kinesis Data Firehose for further analysis and compliance monitoring. Other options, such as DNSSEC, AWS Config, and VPC Flow Logs, do not provide the functionality to log DNS queries specifically.
- A. Correct.
This is the correct answer. Route 53 Resolver query logging can be enabled to capture DNS query logs and send them to CloudWatch Logs, S3, or Kinesis Data Firehose for storage and analysis.
- B. Incorrect.
DNSSEC (Domain Name System Security Extensions) is used to protect DNS data integrity and authenticity, but it does not log DNS queries.
- C. Incorrect.
AWS Config is used to track and audit resource changes in an AWS account but does not provide DNS query logging capabilities.
- D. Incorrect.
VPC Flow Logs capture network traffic metadata for resources in a VPC, but they do not include detailed DNS query data from Route 53.