AWS Route 53 DNS Firewall for Malicious Domain Blocking

ANS-C01 By islever Editorial Last updated

Implement and maintain network features to meet security and compliance needs and requirements.

Short answer

D Use Route 53 DNS Firewall to block malicious domains at the DNS level within the VPC.

Question

A company notices VPC flow log data that shows some company traffic is going to malicious websites. The company identifies the Amazon EC2 instance that is sending traffic to the malicious websites and determines that the application that runs on the instance is compromised.
Similar security events have happened multiple times at the company in the past. The company reacted to previous security events by blocking the malicious websites. The company needs a scalable solution to prevent similar security events in the future.
Which solution will meet this requirement with the LEAST operational overhead?
  1. Set up an EC2 instance to run firewall software in the VPC. Route all traffic through the firewall EC2 instance. Maintain a list of known malicious websites on the firewall instance. Disable the source and destination checks for the firewall instance.
  2. Set up an Application Load Balancer (ALB) in front of the problematic EC2 instance. Enable AWS WAF on the EC2 instance.
  3. Set up an Application Load Balancer (ALB) in front of the problematic EC2 instance. Enable AWS WAF on the ALB.
  4. Set up an Amazon Route 53 DNS Firewall rule group. Create a domain list that contains only the domains the application must communicate with to function. Add the domain list to the rule group. Associate the rule group with the VPC. Correct Answer

Key Takeaways

The question tests the ability to choose a managed security service over manual configuration; the trap is selecting high-overhead solutions like EC2-based firewalls.

Route 53 DNS Firewall provides a scalable, managed solution to block traffic to malicious domains with minimal operational overhead compared to self-managed firewalls.

Common mistake: Learners often choose Option A (EC2 firewall) because it feels like a traditional approach, ignoring the 'least operational overhead' requirement.

Expert Analysis

Why the Answer Is Correct

Option D is the correct answer because Amazon Route 53 DNS Firewall is a fully managed service designed specifically to protect VPCs from connecting to malicious domains. By creating a domain allow-list or block-list and associating it with the VPC, the company can automatically block DNS queries to known malicious sites without managing underlying infrastructure. This directly addresses the requirement for a scalable solution with the least operational overhead.

Why the Other Options Are Wrong

Options A, B, and C involve significantly higher operational overhead. Option A requires provisioning and maintaining an EC2 instance as a transparent firewall, including disabling source/destination checks and manually updating threat lists. Options B and C use AWS WAF, which operates at the application layer (HTTP/HTTPS) via an ALB; it does not effectively block DNS-level resolution of malicious domains unless the traffic is HTTP/S, and it still requires more management than a dedicated DNS firewall. Furthermore, WAF is typically used to protect web applications from attacks, not primarily for outbound threat prevention via DNS.

Community Comment Notes

As noted by user Gramterre in the comments, the managed nature of Route 53 DNS Firewall makes it the superior choice for this use case compared to the manual maintenance required for an EC2-based firewall.

Official Reference

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked for 'least operational overhead' in AWS security contexts, always prioritize managed services (like GuardDuty, Security Hub, or DNS Firewall) over self-managed resources (like EC2 instances running security software).

Frequently Asked Questions

Why not use AWS WAF on an ALB?

WAF filters HTTP/HTTPS traffic, not DNS queries. It cannot prevent the initial connection attempt if the domain resolves before the HTTP request is made.

Is Route 53 DNS Firewall free?

No, it incurs costs per rule group and per query, but it eliminates the cost and effort of managing EC2 instances for filtering.

More ANS-C01 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. Gramterre 👍 1
    The new EC2 firewall seems too hard to maintain whereas Route53 DNS FIrewall is the perfect tool for this use case.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Global Accelerator with private ALB: restrict access to accelerator IPs

S-grade

How to make one AWS Direct Connect connection primary and the other failover-only?

S-grade

How to Copy On-Premises Application Logs to Amazon S3 Over AWS Direct Connect?

S-grade

Why Does VPC Traffic Mirroring Randomly Drop Traffic?

S-grade

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide