ANS-C01 Question 37
Single answerYour company has recently deployed Amazon Route 53 as the DNS service for its web application hosted on AWS. The security team wants to monitor DNS queries to identify suspicious activity, such as potential data exfiltration or unusual domain lookups. Which solution allows you to achieve this?
- A
Enable Route 53 Query Logging and send logs to an S3 bucket for analysis.
- B
Enable VPC Flow Logs to capture DNS traffic in your VPC.
- C
Use AWS CloudTrail to monitor all DNS queries made to Route 53.
- D
Enable AWS Config to track changes to Route 53 DNS records and query activity.
Show answer and explanation
Correct answer: A
Explanation
To monitor DNS queries in Amazon Route 53, you need to enable Route 53 Query Logging. This feature provides detailed logs of DNS queries, which can be analyzed for security or operational purposes. Other services like VPC Flow Logs, AWS CloudTrail, and AWS Config serve different purposes and do not provide DNS query monitoring.
- A. Correct.
Correct: Route 53 Query Logging captures DNS query logs and can send them to an S3 bucket, CloudWatch Logs, or Kinesis Data Firehose for monitoring and analysis. This is the appropriate solution for monitoring DNS queries.
- B. Incorrect.
Incorrect: VPC Flow Logs capture IP traffic metadata for network interfaces in a VPC, but they do not provide detailed information about DNS queries.
- C. Incorrect.
Incorrect: AWS CloudTrail logs API activity related to Route 53, such as changes to DNS records, but it does not log DNS query activity.
- D. Incorrect.
Incorrect: AWS Config tracks configuration changes, including modifications to Route 53 DNS records, but it does not provide logging or monitoring of DNS queries.