SCS-C03 Infrastructure Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  VPC Flow Logs for all subnets.

  Why it's wrong here

  VPC Flow Logs capture metadata about IP traffic, such as source/destination IP and port. While they can show that an instance is talking to a DNS server on port 53, they do not capture the actual DNS query string (e.g., the domain name being requested), which is necessary for detecting tunneling.

• ✓

  Route 53 Resolver Query Logging.

  Why this is correct

  Query logging captures detailed information about every DNS request, including the domain name, query type, and response code. These logs can be sent to CloudWatch Logs, S3, or Kinesis Data Firehose, where they can be analyzed for patterns indicative of data exfiltration or communication with malicious domains.

• ✗

  CloudTrail management events.

  Why it's wrong here

  CloudTrail logs API calls made to AWS services, such as creating a Route 53 record or modifying a VPC. It does not log the data-plane traffic of individual DNS queries made by applications running on EC2 instances, making it useless for monitoring real-time DNS request patterns or content.

• ✗

  Amazon GuardDuty DNS Security.

  Why it's wrong here

  While GuardDuty analyzes DNS logs to detect threats, it does not provide the raw logs for the customer to perform their own custom analysis or long-term storage of every query. GuardDuty only alerts on specific 'findings' rather than serving as a comprehensive logging solution for all DNS activity.