Question

A company runs a fleet of EC2 instances across several private subnets in a VPC. The security team discovers that a compromised host attempted to exfiltrate data by resolving and connecting to a series of dynamically generated command-and-control (C2) domains. The team wants a managed AWS control that inspects outbound DNS queries at the VPC level and blocks queries to known-malicious and custom-defined domains, without deploying agents on each instance. Which solution best meets this requirement?

Accepted Answer

Associate a Route 53 Resolver DNS Firewall rule group with the VPC, using AWS Managed Domain Lists and a custom domain list to block malicious domain resolution.

Answer

Configure a network ACL on each private subnet to deny outbound UDP and TCP port 53 traffic to unknown destinations.

Answer

Enable AWS Network Firewall with a stateless rule group that drops packets destined for the C2 IP addresses.

Answer

Deploy AWS WAF with a rate-based rule to block the DNS queries originating from the compromised instances.