AWS Route 53 DNS Firewall for Malicious Domain Blocking
A company notices VPC flow log data that shows some company traffic is going to malicious websites. The company identifies the Amazon EC2 instance that is sending traffic to the malicious websites and determines that the application that runs on the instance is compromised. Similar security events have happened multiple times at the company in the past. The company reacted to previous security events by blocking the malicious websites. The company needs a scalable solution to prevent similar security events in the future. Which solution will meet this requirement with the LEAST operational overhead?
Community Insight
The question tests the ability to choose a managed security service over manual configuration; the trap is selecting high-overhead solutions like EC2-based firewalls.
Route 53 DNS Firewall provides a scalable, managed solution to block traffic to malicious domains with minimal operational overhead compared to self-managed firewalls.
Learners often choose Option A (EC2 firewall) because it feels like a traditional approach, ignoring the 'least operational overhead' requirement.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D is the correct answer because Amazon Route 53 DNS Firewall is a fully managed service designed specifically to protect VPCs from connecting to malicious domains. By creating a domain allow-list or block-list and associating it with the VPC, the company can automatically block DNS queries to known malicious sites without managing underlying infrastructure. This directly addresses the requirement for a scalable solution with the least operational overhead.Why the Other Options Are Wrong
Options A, B, and C involve significantly higher operational overhead. Option A requires provisioning and maintaining an EC2 instance as a transparent firewall, including disabling source/destination checks and manually updating threat lists. Options B and C use AWS WAF, which operates at the application layer (HTTP/HTTPS) via an ALB; it does not effectively block DNS-level resolution of malicious domains unless the traffic is HTTP/S, and it still requires more management than a dedicated DNS firewall. Furthermore, WAF is typically used to protect web applications from attacks, not primarily for outbound threat prevention via DNS.Community Comment Notes
As noted by user Gramterre in the comments, the managed nature of Route 53 DNS Firewall makes it the superior choice for this use case compared to the manual maintenance required for an EC2-based firewall.Official Reference
Exam Strategy
When asked for 'least operational overhead' in AWS security contexts, always prioritize managed services (like GuardDuty, Security Hub, or DNS Firewall) over self-managed resources (like EC2 instances running security software).
Frequently Asked Questions
Why not use AWS WAF on an ALB?
WAF filters HTTP/HTTPS traffic, not DNS queries. It cannot prevent the initial connection attempt if the domain resolves before the HTTP request is made.
Is Route 53 DNS Firewall free?
No, it incurs costs per rule group and per query, but it eliminates the cost and effort of managing EC2 instances for filtering.
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →