Q12 — AWS SAA-C03 Ch.17

Question 12 of 89 | ← Chapter 17

Q1312. A company runs an internet-facing web application on AWS. The company uses Amazon Route 53 for DNS management and has a public hosted zone to route traffic from the internet to the application. The company wants to log DNS response codes to help system administrators perform any root cause analysis in the future.Which solution will meet these requirements?

Correct Answer: A. Use Route 53 to configure query logging.

Explanation

The correct solution to log DNS response codes for Route 53 is:A. Use Route 53 to configure query logging.Why Option A is Correct:Route 53 Query LoggingLogs all DNS queries (including response codes like NOERROR, NXDOMAIN, SERVFAIL, etc.) to Amazon CloudWatch Logs or Amazon S3.Helps system administrators troubleshoot DNS resolution issues by analyzing query patterns and error responses.Supports filtering (e.g., by query type, domain name, or response code).Integration with CloudWatch Logs Insights.Query logs can be analyzed using CloudWatch Logs Insights for advanced filtering and aggregation.Example query to find failed DNS resolutions:sqlFILTER @message LIKE /NXDOMAIN/| STATS COUNT() BY bin(1h)Why Other Options Are Incorrect:B. Use AWS CloudTrail to record all Route 53 queriesCloudTrail logs API calls (e.g., CreateHostedZone, UpdateRecordSets), not DNS queries or response codes.Useful for auditing changes to Route 53 configurations, not for debugging DNS resolution. C. Use Amazon CloudWatch to collect and process Route 53 metrics CloudWatch provides metrics (e.g., HealthCheckStatus, QueryCount), but no detailed response codes. Metrics are aggregated (e.g., total queries per minute) and lack granular error details. D. Use AWS Trusted Advisor to perform on-demand root cause analysis Trusted Advisor checks for cost optimization, security, and performance best practices, but does not log DNS queries or response codes.Not suitable for real-time or historical DNS troubleshooting.Implementation Steps for Route 53 Query Logging:Enable Query Logging in Route 53Navigate to Route 53 Hosted Zones Select your public hosted zone Query Logging. Choose a CloudWatch Logs log group or S3 bucket to store logs.Configure Log Group Retention (CloudWatch Logs)Set retention policies (e.g., 30 days) to avoid excessive storage costs.Analyze LogsUse CloudWatch Logs Insights or Athena (for S3 logs) to query and visualize DNS response codes.Example S3 query (Athena):sqlSELECT * FROM route53_logsWHERE response_code = 'NXDOMAIN'LIMIT 100;Key Considerations:Cost: Query logging to CloudWatch Logs incurs storage and ingestion costs (~$0.50 per GB). Data Sensitivity: DNS queries may contain sensitive information (e.g., internal hostnames); ensure logs are protected with IAM policies and encryption.Real-Time Monitoring: For live debugging, combine query logging with CloudWatch Alarms on error rates.Conclusion:Option A (Route 53 Query Logging) is the only solution that captures detailed DNS response codes, making it essential for root cause analysis of DNS resolution failures.