A company uses Amazon WorkSpaces across seven VPCs in different Regions. Their cloud SIEM must analyze DNS queries from the WorkSpaces to identify domains contacted. The SIEM supports both polling and pushing logs. What is the most cost-effective design to meet this requirement?
Choose an answer
Tap an option to check your answer.
Correct answer: Enable Amazon Route 53 query logging and send the logs to an Amazon Kinesis Data Firehose delivery stream configured to push the data to the SIEM..
Why this is the answer
The most cost-effective solution is to enable Amazon Route 53 query logging. WorkSpaces instances use the Amazon-provided DNS resolver, and Route 53 query logging directly captures these DNS requests. Sending these logs to Kinesis Data Firehose allows for efficient, scalable, and cost-effective delivery to the SIEM, whether the SIEM polls or Firehose pushes. VPC Flow Logs capture all network flow information, which is much more data than just DNS queries, making it less cost-effective for this specific requirement. Installing a CloudWatch agent on each WorkSpace is not feasible or supported for Amazon WorkSpaces and would incur significant management overhead. VPC Traffic Mirroring duplicates all network traffic, leading to very high costs and complexity when only DNS queries are needed.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed