SCS-C02 · Question #78
A company hosts business-critical applications on Amazon EC2 instances in a VPC. The VPC uses default DHCP options sets. A security engineer needs to log all DNS queries that internal resources make…
The correct answer is D. Configure Amazon Route 53 Resolver query logging. Add an Amazon CloudWatch Logs log. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html https://aws.amazon.com/blogs/aws/log-your-vpc-dns-queries-with-route-53-resolver-query-logs/
Question
A company hosts business-critical applications on Amazon EC2 instances in a VPC. The VPC uses default DHCP options sets. A security engineer needs to log all DNS queries that internal resources make in the VPC. The security engineer also must create a list of the most common DNS queries over time. Which solution will meet these requirements?
Options
- AInstall the Amazon CloudWatch agent on each EC2 instance in the VPC. Use the CloudWatch
- BInstall a BIND DNS server in the VPC. Create a bash script to list the DNS request number of
- CCreate VPC flow logs for all subnets in the VPStream the flow logs to an Amazon CloudWatch
- DConfigure Amazon Route 53 Resolver query logging. Add an Amazon CloudWatch Logs log
How the community answered
(21 responses)- A5% (1)
- B5% (1)
- C14% (3)
- D76% (16)
Explanation
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logs.html https://aws.amazon.com/blogs/aws/log-your-vpc-dns-queries-with-route-53-resolver-query-logs/
Topics
Community Discussion
No community discussion yet for this question.