ANS-C01 Question 478
Single answerA company wants to analyze DNS query logs for security insights and operational monitoring. They currently use Amazon Route 53 for DNS management and want to set up a solution to deliver these logs to an Amazon S3 bucket for long-term storage. Which mechanism will allow them to achieve this?
- A
Enable Query Logging in Amazon Route 53 and configure an Amazon Kinesis Data Firehose delivery stream to send logs to the S3 bucket.
- B
Enable DNS Query Logging in Amazon Route 53 and configure CloudWatch Logs to automatically deliver logs to the S3 bucket.
- C
Enable Query Logging in Amazon Route 53 and specify the S3 bucket destination directly in the Route 53 console.
- D
Use AWS CloudTrail to monitor API calls to Route 53 and deliver the logs to the S3 bucket.
Show answer and explanation
Correct answer: A
Explanation
To deliver DNS query logs from Amazon Route 53 to an S3 bucket, you need to enable Query Logging in Route 53 and configure Amazon Kinesis Data Firehose as the log delivery mechanism. Kinesis Data Firehose allows you to specify an S3 bucket as the destination for the logs, making it the correct solution for this use case.
- A. Correct.
This is the correct approach. Query Logging in Amazon Route 53 supports integration with Amazon Kinesis Data Firehose, which can then deliver logs to an S3 bucket for long-term storage.
- B. Incorrect.
This is incorrect because CloudWatch Logs is not natively integrated with Route 53 Query Logging for DNS queries. Route 53 does not send logs directly to CloudWatch Logs for this purpose.
- C. Incorrect.
This is incorrect because Route 53 Query Logging does not provide the option to specify an S3 bucket destination directly. Logs must be delivered via an intermediary, such as Kinesis Data Firehose.
- D. Incorrect.
This is incorrect because AWS CloudTrail tracks API activity and is not designed for capturing or delivering DNS query logs from Route 53.