ANS-C01 Question 39
Select 2Your company wants to monitor DNS queries for suspicious activity and troubleshoot DNS-related issues in a workload hosted on AWS. Which of the following approaches can help you achieve this? (Choose TWO)
- A
Enable Amazon Route 53 Resolver Query Logging and send logs to Amazon CloudWatch Logs.
- B
Use Amazon CloudTrail to log all DNS queries made to the Route 53 Resolver.
- C
Enable VPC Flow Logs to monitor DNS queries for instances in your VPC.
- D
Use AWS Config to track changes to DNS query patterns.
- E
Integrate Route 53 Resolver Query Logs with an Amazon S3 bucket for long-term analysis.
Show answer and explanation
Correct answers: A, E
Explanation
Amazon Route 53 Resolver Query Logging is the recommended service for logging and monitoring DNS queries in AWS. It allows you to capture DNS query data and forward it to services like CloudWatch Logs, S3, or Kinesis Data Firehose for storage and analysis. While other services like VPC Flow Logs or AWS Config have their use cases, they do not provide the DNS-specific query logging and monitoring functionality required in this scenario.
- A. Correct.
Correct. Amazon Route 53 Resolver Query Logging allows you to capture DNS query data and send it to CloudWatch Logs, S3, or Kinesis Data Firehose for monitoring and analysis.
- B. Incorrect.
Incorrect. Amazon CloudTrail does not log individual DNS queries made to the Route 53 Resolver. It focuses on API activity and other account-level actions.
- C. Incorrect.
Incorrect. VPC Flow Logs capture network traffic metadata (e.g., source and destination IPs), but they do not provide detailed DNS query logging.
- D. Incorrect.
Incorrect. AWS Config tracks configuration changes to AWS resources but does not monitor or analyze DNS query patterns.
- E. Correct.
Correct. By integrating Route 53 Resolver Query Logs with an Amazon S3 bucket, you can store logs for long-term analysis and retention, enabling deeper insights into DNS activity.