A retail company runs isolated app VPCs peered to a central inspection VPC with AWS Direct Connect to stores. The SOC suspects port scanning between tiers and DNS data exfiltration to external domains, but has only CloudTrail management events. Visibility must cover east-west packet rejects and resolver queries. Which logging combination should the detection engineer enable to expose lateral movement and tunneling?
Select an answer to reveal the explanation.
Short Explanation
You catch both stealthy moves when network and DNS evidence meet. Your flow logs reveal rejects from scanning while resolver logs expose tunneling domains for Athena hunting.
Full Explanation
VPC Flow Logs record 5-tuple, action, and packet counts for traffic crossing elastic network interfaces, which exposes port scanning and lateral movement through rejected connections even with peering where transit gateway logs do not apply, while Route 53 Resolver query logging captures DNS queries from VPC resolvers to reveal tunneling and exfiltration to external domains that packet headers alone miss, and centralizing both in S3 enables Athena correlation by source IP and queried name. Transit gateway plus WAF logging fails by concept because there is no transit gateway in a peering design and WAF only sees edge HTTP, not east-west rejects. VPC Flow Logs plus CloudFront logging fails by concept because CDN access logs show viewer requests, not internal DNS queries needed for tunneling detection. Resolver plus ECS Exec logging fails by concept because container shell audit helps host forensics but cannot show network scanning across tiers. For the exam remember to match log source to traffic path and threat, peering needs VPC flow logs and hybrid DNS needs resolver logs, and in practice confirm log delivery, query VPC and resolver log formats, and validate Athena partitions.