A company deployed Amazon GuardDuty in the us-east-1 Region. The company wants all DNS logs that relate to the company's Amazon EC2 instances to be inspected. What should a security engineer do to ensure that the EC2 instances are logged?
A.
Use IPv6 addresses that are configured for hostnames.
B.
Configure external DNS resolvers as internal resolvers that are visible only to AWS.
C.
Use AWS DNS resolvers for all EC2 instances.
D.
Configure a third-party DNS resolver with logging for all EC2 instances.
"If you use AWS DNS resolvers for your EC2 instances (the default setting), then GuardDuty can access and process your request and response DNS logs through the internal AWS DNS resolvers. If you are using a 3rd party DNS resolver, for example, OpenDNS or GoogleDNS, or if you set up your own DNS resolvers, then GuardDuty cannot access and process data from this data source." << therefore C.
D
Option A is not correct because it suggests using IPv6 addresses that are configured for hostnames, which is not related to logging EC2 instances in GuardDuty. Option B is not correct because it suggests configuring external DNS resolvers as internal resolvers that are visible only to AWS, which does not address the requirement to log EC2 instances in GuardDuty. Option C is not correct because it suggests using AWS DNS resolvers for all EC2 instances, which does not provide the necessary logging for GuardDuty.
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_data-sources.html
If you use AWS DNS resolvers for your Amazon EC2 instances (the default setting), then GuardDuty can access and process your request and response DNS logs through the internal AWS DNS resolvers. If you use another DNS resolver, such as OpenDNS or GoogleDNS, or if you set up your own DNS resolvers, then GuardDuty cannot access and process data from this data source.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
LearnMeSomeAWS
Highly Voted 3 years, 5 months agoroger8978
Highly Voted 3 years, 5 months agoawsec2
Most Recent 2 years, 5 months agoawsec2
2 years, 5 months agosapien45
2 years, 9 months agoritears41
2 years, 10 months agoHananS
3 years, 1 month ago