A gaming company with 40 VPCs attached to Transit Gateway suspects malware using DNS tunneling for exfiltration plus lateral movement between VPCs. Flow data and DNS visibility are incomplete and central logging is required, and the team wants hub-level visibility of routed inter-VPC traffic rather than enabling logs in all 40 VPCs. Which log source combination detects tunnel exfiltration and cross-VPC movement?
Select an answer to reveal the explanation.
Short Explanation
You can't catch sneaky DNS tricks with packet counts alone. Resolver logs reveal tunneling while transit flows track the hops.
Full Explanation
The correct combination pairs two complementary hub-level telemetry sources: Route 53 Resolver query logs record requested domains, query types, and volumes per resolver, which exposes DNS tunneling signatures such as high query rates, long encoded labels, and abnormal TXT/NULL usage for exfiltration, while Transit Gateway flow logs capture 5-tuple routed traffic traversing the hub, which reveals lateral movement between attached VPCs without per-VPC configuration and meets the central logging mandate when delivered to a central bucket. Centrally aggregated VPC Flow Logs for inter-VPC analysis fail on architecture fit because they require enablement and management in all 40 VPCs and still only describe VPC edge traffic rather than providing single hub visibility of routed flows. Transit Gateway flow logs paired with VPC Flow Logs for exfiltration analysis fail on protocol visibility because flow records contain addresses, ports, and bytes but omit queried names and DNS payload characteristics needed to distinguish tunneling from benign lookups. Route 53 Resolver query logs paired with Network Firewall alert logs fail on coverage because firewall logs record only traffic that matched inspection rules and traversed a firewall endpoint, not the complete allowed routed inter-VPC matrix needed for lateral-movement hunting. On exams, distinguish full flow telemetry from filtered security-event logs and Resolver query content from generic network 5-tuple data, and in practice confirm Resolver logging associations cover all VPCs, Transit Gateway flow logging covers required attachments, and both streams arrive centrally with expected volume before tuning detections.