ANS-C01 Question 302
Select 2Your company is operating a public-facing application hosted on Amazon Route 53. To enhance security, you are tasked with implementing DNSSEC for your domain. After enabling DNSSEC in Route 53, what additional steps must you take to complete the DNSSEC setup?
- A
Publish the DS (Delegation Signer) record in your domain's parent zone through your domain registrar.
- B
Generate a public/private key pair and upload the public key to Route 53.
- C
Validate the DNSSEC chain of trust by testing the DNS records using a DNSSEC validation tool.
- D
Configure a key-signing key (KSK) in Route 53 and enable automatic key management.
- E
Inform AWS Support to manually propagate DNSSEC settings across the global Route 53 infrastructure.
Show answer and explanation
Correct answers: A, C
Explanation
To successfully configure DNSSEC in Amazon Route 53, you need to establish the chain of trust by publishing the DS record in your domain's parent zone through your registrar. Additionally, validating the implementation ensures that the DNSSEC setup is functioning correctly. Route 53 automates key management, so manual key configuration or AWS Support involvement is not required.
- A. Correct.
Correct: After enabling DNSSEC in Route 53, you must publish the DS record in your domain's parent zone using your domain registrar. This step establishes the chain of trust between the parent zone and your domain.
- B. Incorrect.
Incorrect: Route 53 automatically handles key management, and you do not need to generate or upload your own key pair.
- C. Correct.
Correct: Testing the DNSSEC implementation using a validation tool ensures that the chain of trust is correctly configured and operational.
- D. Incorrect.
Incorrect: Route 53 automatically manages KSKs, so there is no need for manual configuration or enabling automatic key management explicitly by the user.
- E. Incorrect.
Incorrect: AWS Support is not involved in propagating DNSSEC settings; the implementation is automated within Route 53.