SCS-C02 Security Logging and Monitoring Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable VPC Flow Logs and analyze DNS traffic.

  Why it's wrong here

  VPC Flow Logs capture only metadata about IP traffic—source/destination IPs, ports, and protocol—at the elastic network interface level. They do not parse or record the DNS query payload, so even though you'd see packets to a resolver on port 53, you would not see the queried domain name, record type, or response code. To comply with the requirement to log DNS queries, you need a service that can read DNS content, not just connection metadata.

• ✗

  Enable CloudWatch Logs for Route 53 and stream to a Lambda function that writes to S3.

  Why it's wrong here

  Enabling CloudWatch Logs for Route 53 and streaming to a Lambda function that writes to S3 introduces unnecessary latency and operational overhead from managing the Lambda invocation and execution. Route 53 can directly publish query logs to a specified S3 bucket without any intermediate compute layer. This option is tempting because CloudWatch Logs is a common centralised logging destination, and Lambda is often used to transform or route logs; however, in this scenario, the requirement is simply to store logs in S3, which Route 53’s native logging feature achieves directly without additional services.

• ✓

  Configure Route 53 Resolver query logging to deliver to the central S3 bucket.

  Why this is correct

  Route 53 Resolver query logging is the native capability that records the full DNS query and response data for queries handled by Route 53 Resolver, including those from VPCs, inbound, and outbound endpoints. It can directly write logs to a central S3 bucket, and using a cross-account bucket policy, you can allow Route 53 in your account to deliver into the consolidated logging bucket. This approach avoids any intermediate compute, scales automatically, and is the most straightforward secure delivery mechanism.

• ✗

  Use a custom Lambda function to poll Route 53 logs and write to S3.

  Why it's wrong here

  This option incorrectly assumes there is a Route 53 logging API that can be polled; Route 53 Resolver does not expose an endpoint for retrieving DNS query logs on demand. The only way to receive query logs is to configure the native query-logging feature and specify a destination; if you wanted Lambda, you'd set up CloudWatch Logs or a Firehose destination that triggers the function, not have it poll unresolvable data. Adding a polling Lambda also creates unnecessary operational overhead and potential data-loss gaps when the polling function is not running.

Go deeper

Related to this question