Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 205 discussion

It provides a proactive and automated way to block known botnets and their command and control traffic.

Amazon Route 53 Resolver DNS Firewall with the AWSManagedDomainsBotnetCommandandControl managed rule group: Scalable and Managed: Automatically updates the list of known botnet domains. Preemptive Blocking: Prevents EC2 instances from resolving malicious domains. Low Operational Overhead: Easy to implement and maintain.

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall-managed-domain-lists.html

this is B

The question talks about "botnet command and control traffic". The most common and effective way to intercept such traffic is at the DNS level, where many botnets rely on domain names to communicate with their C2 servers. The Amazon Route 53 Resolver DNS Firewall is specifically designed to block DNS queries to known malicious domains, including those used for botnet C2 traffic. If it was application-level traffic AWS WAF Bot Control would apply.

B. his service allows you to filter and block DNS queries for known malicious domains, including those associated with botnets. By using the AWSManagedDomainsBotnetCommandandControl managed domain list, you can specifically target and block DNS queries that attempt to reach botnet command and control servers.

Correct answer should be B - this avoids instances from responding / connecting to malicious controllers