ANS-C01 Question 38
Single answerYour company uses Amazon Route 53 as the DNS provider for a high-traffic application. To detect and investigate potential DNS-based security threats, you need to log and monitor DNS queries for specific domains. What is the BEST solution to achieve this in AWS?
- A
Use Route 53 Query Logging to log DNS queries and send logs to Amazon CloudWatch Logs.
- B
Enable AWS CloudTrail to capture DNS query logs from Route 53 and analyze them in AWS Athena.
- C
Use Route 53 Resolver Query Logging to log DNS queries and send logs to Amazon S3, CloudWatch Logs, or Kinesis Data Firehose.
- D
Set up VPC Flow Logs to capture DNS query traffic and analyze it in Amazon CloudWatch Logs.
Show answer and explanation
Correct answer: C
Explanation
To monitor and analyze DNS queries in AWS, the best solution is to use Route 53 Resolver Query Logging. This feature logs DNS queries made by resources in your VPC and sends them to destinations like Amazon S3, CloudWatch Logs, or Kinesis Data Firehose for storage and analysis. Other options, such as CloudTrail and VPC Flow Logs, do not provide DNS-specific logging capabilities.
- A. Incorrect.
Route 53 Query Logging is not a feature available in Route 53 for logging DNS queries. Instead, Route 53 Resolver Query Logging is used for such purposes.
- B. Incorrect.
AWS CloudTrail is used to log API activity across AWS services but does not capture DNS query logs from Route 53.
- C. Correct.
Route 53 Resolver Query Logging is the correct solution. It allows you to log DNS queries made by resources in your VPC and send these logs to Amazon S3, CloudWatch Logs, or Kinesis Data Firehose for analysis.
- D. Incorrect.
VPC Flow Logs capture metadata about IP traffic going to and from network interfaces in your VPC. However, they do not capture DNS query logs specifically.