Examkin

Question

Difficulty: MediumVPC Flow Logs and Network Monitoring

A company's security policy requires that all network communication from a database subnet be captured for audit purposes. A SysOps Administrator configures VPC Flow Logs at the subnet level to capture all traffic. During an audit, the compliance officer notices that queries sent from the database EC2 instances to the default Amazon Route 53 Resolver (at the VPC DNS server IP address) are not appearing in the flow logs. Which action should the SysOps Administrator take to log these DNS queries?

  1. A
    Create a gateway VPC endpoint for Amazon Route 53 in the database subnet and associate it with the subnet's route table.
  2. B
    Modify the retention period of the CloudWatch Logs log group containing the VPC Flow Logs to ensure ephemeral metadata is not expired.
  3. Configure Amazon Route 53 Resolver query logging for the VPC and specify a destination such as a CloudWatch Logs log group.Answer
  4. D
    Enable detailed monitoring on the EC2 instances to capture high-frequency system network calls, including default DNS queries.

Answer

Configure Amazon Route 53 Resolver query logging for the VPC and specify a destination such as a CloudWatch Logs log group.
VPC Flow Logs have built-in exclusions and do not capture traffic sent to the default Amazon DNS server (Route 53 Resolver). To capture and audit these DNS queries, Amazon Route 53 Resolver query logging must be configured for the target VPC.

Step-by-Step Solution

1
Identify the limitation of VPC Flow Logs regarding DNS queries.
Determine that VPC Flow Logs do not capture traffic generated by instances when they contact the default Amazon DNS server (Route 53 Resolver).
Understanding the built-in exclusions of VPC Flow Logs prevents troubleshooting efforts focused on modifying existing flow log settings.
2
Select the appropriate native AWS tool for capturing DNS query logs.
Identify Route 53 Resolver query logging as the feature designed to log DNS queries made by resources within a VPC.
This service logs queries, responses, and metadata for DNS requests generated inside the VPC.
3
Configure the query logging destination.
Set up Route 53 Resolver query logging to deliver logs to a supported target, such as a CloudWatch Logs log group, an S3 bucket, or a Kinesis Data Firehose stream.
Specifying the destination ensures that compliance officers can access and audit the logged queries.

Key Concept

VPC Flow Logs exclude traffic sent to the Amazon Route 53 Resolver (VPC DNS server). To capture these logs, Route 53 Resolver query logging must be enabled.
Estimated Time:1m 30s
Rate this question

Topics

VPC Flow Logs and Network Monitoring

More questions from this topic