DNS failures and unexpected domains queried from a VPC must be investigated.
Record the requester, name, response, and time for later analysis.
Which setting is most appropriate?
Enable Route 53 Resolver query logging and deliver the query logs to CloudWatch Logs or S3.
Detailed explanation
Object versioning does not generate DNS query audit records.
Object versioning does not generate DNS query audit records.
ALB logs record HTTP requests, not VPC Resolver queries.
ALB logs record HTTP requests, not VPC Resolver queries.
Resolver query logs record DNS requests and responses for time-based troubleshooting and investigation.
Resolver query logs record DNS requests and responses for time-based troubleshooting and investigation.
Cache invalidation is unrelated to recording Resolver queries.
Cache invalidation is unrelated to recording Resolver queries.
Check official documentation
Compare the following points with the official documentation.
Route 53 Resolver query logging destinations and fieldsの公式説明を確認する。
What to confirm
Resolver query logとALB・CloudFrontログの観測対象を区別できる。
Key points
- Resolver query logging
- DNS query
- CloudWatch Logs
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current behavior in the official SOA-C03 guide and AWS service documentation.
Foundation review
Observation layer
Resolver logs show name resolution; ALB and CloudFront logs show application delivery behavior.
Retention and analysis
Choose a log destination and retention policy that support the investigation window.