SCS-C02 Question 273
Select 2Your organization has noticed an unusual number of failed DNS resolution attempts to external domains, which could indicate an attempted data exfiltration. You have been tasked with investigating these anomalies using AWS logging services. Which logs should you analyze to identify the source of these DNS queries and track their flow through the network?
- A
Amazon Route 53 Resolver Query Logs
- B
AWS WAF Logs
- C
VPC Flow Logs
- D
CloudTrail Event History
- E
Amazon S3 Access Logs
Show answer and explanation
Correct answers: A, C
Explanation
To investigate DNS anomalies, Amazon Route 53 Resolver Query Logs help identify the source of the DNS queries and the exact domains being queried. VPC Flow Logs complement this by tracking the flow of traffic within the network, allowing you to trace the queries back to specific instances or resources. These two log sources together provide the necessary insights for this type of investigation.
- A. Correct.
Amazon Route 53 Resolver Query Logs capture detailed information about DNS queries, including source IPs and the queries themselves, making them highly relevant for analyzing DNS anomalies.
- B. Incorrect.
AWS WAF Logs are used to monitor and analyze web application requests, but they do not provide specific details about DNS queries or network flow.
- C. Correct.
VPC Flow Logs capture information about IP traffic going into and out of network interfaces in your VPC, which can help track the flow of the DNS queries within the network.
- D. Incorrect.
CloudTrail Event History records API activity across AWS services but does not provide specific details about DNS queries or network-level flow.
- E. Incorrect.
Amazon S3 Access Logs provide data about access requests to S3 buckets and are not related to DNS queries or network-level behavior.