ANS-C01 Network Security, Compliance and Governance Practice Question
A company has a security requirement to log and monitor all DNS queries made by EC2 instances in a VPC. Which TWO AWS solutions can meet this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Amazon Route 53 Resolver Query Logging.
Amazon Route 53 Resolver Query Logging (Option A) logs all DNS queries that are forwarded by the Route 53 Resolver within a VPC. Amazon Route 53 Resolver DNS Firewall (Option C) provides DNS filtering and can log DNS queries that match the firewall rules. Both are valid AWS solutions for logging DNS queries from EC2 instances. Option B (AWS CloudTrail) logs API calls, not DNS queries. Option D (Amazon CloudWatch Logs with a custom agent) is not a native AWS service for DNS logging; it requires custom configuration and is not a managed solution. Option E (VPC Flow Logs) captures IP traffic metadata, not DNS queries.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Amazon Route 53 Resolver Query Logging.
Why this is correct
This service logs all DNS queries made by resources in the VPC.
- ✗
Use AWS CloudTrail to log DNS queries.
Why it's wrong here
CloudTrail logs API calls, not DNS queries.
- ✓
Enable Amazon Route 53 Resolver DNS Firewall with logging.
Why this is correct
DNS Firewall can log queries that are allowed or blocked.
- ✗
Use Amazon CloudWatch Logs with a custom agent to capture DNS logs.
Why it's wrong here
Custom agent could work but is not an AWS-native solution; the question asks for AWS solutions.
- ✗
Enable VPC Flow Logs.
Why it's wrong here
Flow Logs capture IP traffic metadata, not DNS query details.
Visual reference
Go deeper
Related to this question
About these practice questions
This ANS-C01 question is part of Courseiva's 1,621-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.