ANS-C01 Question 32
Select 2Your company manages a high-traffic e-commerce website hosted on AWS. You are tasked with improving DNS resolution reliability and security for the website. The website uses Route 53 as the DNS provider. Which of the following actions should you take to achieve this? (Select TWO.)
- A
Enable DNSSEC signing on the Route 53 hosted zone.
- B
Set a low TTL value for the DNS records in Route 53.
- C
Use Route 53 health checks to monitor the availability of endpoints.
- D
Configure DNS delegation by setting up NS records in a parent zone pointing to the Route 53 hosted zone.
- E
Enable multi-region deployment of Route 53 nameservers.
Show answer and explanation
Correct answers: A, D
Explanation
To improve DNS resolution reliability and security, enabling DNSSEC ensures that DNS responses are secure and have not been tampered with, addressing potential DNS spoofing issues. Configuring DNS delegation ensures that the parent zone correctly points to the hosted zone in Route 53, maintaining reliable DNS functionality. Other options either do not directly address the requirements or are unnecessary given Route 53's inherent features.
- A. Correct.
Enabling DNSSEC adds a layer of security by ensuring that DNS responses come from an authentic source and have not been tampered with. This improves DNS security, which is critical for a high-traffic e-commerce site.
- B. Incorrect.
A low TTL value improves flexibility in propagating DNS changes but does not directly improve reliability or security for DNS resolution.
- C. Incorrect.
Route 53 health checks are useful for monitoring endpoint availability and routing traffic accordingly, but they do not directly improve DNS resolution reliability or security.
- D. Correct.
DNS delegation ensures that the parent zone correctly delegates DNS resolution to the Route 53 hosted zone. This is essential for maintaining the reliability of DNS resolution.
- E. Incorrect.
Route 53 is already a highly available and globally distributed service. There is no need to configure multi-region deployment of Route 53 nameservers manually.