Logging All VPC DNS Queries with Route 53 Resolver
A company uses Amazon Route 53 for DNS and wants to log all DNS queries made from its VPC. The logs must be stored in Amazon S3 for compliance purposes. Which solution meets these requirements?
Quick Answer
Route 53 Resolver query logging is correct because it is the specific, purpose-built feature for capturing DNS queries originating from resources inside a VPC, and it can deliver those logs directly to an S3 bucket without any additional agents, sidecars, or custom logging code. Once enabled and pointed at a VPC, it transparently captures every DNS query made by EC2 instances, Lambda functions, and other resources in that VPC, exactly the requirement described: complete DNS visibility for compliance purposes. This is worth internalizing as a pattern: AWS pairs many of its core services with a dedicated, built-in logging feature rather than expecting you to bolt on custom infrastructure, VPC has Flow Logs for network traffic, CloudTrail covers API activity, and Route 53 Resolver has query logging specifically for DNS resolution. Recognizing which native logging feature maps to which data type is usually the fastest way to answer these questions, because scenarios frequently describe a logging requirement in plain language, such as log all DNS queries, and expect you to match it to the exact managed feature designed for that data type rather than a general-purpose or manually engineered solution. Whenever a scenario names a specific type of traffic or activity and asks how to log it into S3 with minimal overhead, look first for the native, service-specific logging feature before considering a custom build.
⚠ Common exam trap
A common mix-up: candidates confuse data-plane DNS query logs (Route 53 Resolver query logging) with control-plane API logs (CloudTrail) or network flow logs (VPC Flow Logs), leading candidates to select options that log the wrong type of information for the stated requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Route 53 Resolver query logging and publish to an S3 bucket.
Route 53 Resolver query logging is the native AWS feature designed to capture DNS queries that originate from resources within a VPC. By enabling this feature and specifying an S3 bucket as the destination, you can log all DNS queries made by EC2 instances, Lambda functions, and other VPC resources without needing any additional agents or configuration. This directly meets the requirement for storing DNS query logs in S3 for compliance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Route 53 Resolver query logging and publish to an S3 bucket.
Why this is correct
Route 53 Resolver query logging captures DNS queries made by resources in your VPC and can deliver logs to S3.
- ✗
Install a CloudWatch Logs agent on each EC2 instance and configure it to send DNS logs to CloudWatch Logs.
Why it's wrong here
This would only capture DNS queries from EC2 instances, not from other resources like Lambda or RDS.
- ✗
Enable AWS CloudTrail for DNS API calls and deliver to an S3 bucket.
Why it's wrong here
CloudTrail logs API calls to Route 53, not the actual DNS queries.
- ✗
Enable VPC Flow Logs and publish to an S3 bucket.
Why it's wrong here
VPC Flow Logs capture network traffic metadata, not DNS query logs.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 376-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon Route 53 and wants to log DNS queries for investigative purposes. The logs must be stored in a centralized S3 bucket in the security account. What is the MOST efficient way to achieve this?
medium- A.Enable VPC Flow Logs and analyze DNS traffic.
- B.Enable CloudWatch Logs for Route 53 and stream to a Lambda function that writes to S3.
- ✓ C.Configure Route 53 Resolver query logging to deliver to the central S3 bucket.
- D.Use a custom Lambda function to poll Route 53 logs and write to S3.
Why C: Route 53 Resolver query logging natively supports delivering DNS query logs directly to an S3 bucket, including cross-account S3 buckets, without requiring any intermediate services. This is the most efficient method because it eliminates the need for additional compute resources or manual polling, and it directly satisfies the requirement for centralized logging in the security account.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.