ANS-C01 Question 34
Select 2Your company is hosting its primary website on an Amazon Route 53 public hosted zone. The website needs to perform DNSSEC validation to ensure that DNS responses are not tampered with in transit. You are tasked with configuring DNSSEC for the hosted zone. What steps must you perform to enable DNSSEC on the hosted zone in Route 53?
- A
Enable DNSSEC signing on the Route 53 hosted zone and provide a public key to your domain registrar.
- B
Create a key-signing key (KSK) in AWS Key Management Service (KMS) and enable DNSSEC signing in Route 53.
- C
Configure a Delegation Signer (DS) record in your domain registrar with the information provided by Route 53.
- D
Manually sign the DNS records in your hosted zone using a third-party tool and upload them to Route 53.
- E
Enable DNSSEC validation on the DNS resolver being used by clients accessing the website.
Show answer and explanation
Correct answers: B, C
Explanation
To enable DNSSEC on a Route 53 hosted zone, you must create a key-signing key (KSK) in AWS KMS and enable DNSSEC signing in Route 53. This ensures that the DNS records are signed and protected against tampering. After this, you must configure a Delegation Signer (DS) record in your domain registrar to establish a trust relationship between the parent zone and your hosted zone. Once these steps are completed, clients and resolvers can validate the DNSSEC signatures to ensure the authenticity of the DNS responses.
- A. Incorrect.
Incorrect: Route 53 does not require you to provide a public key to your domain registrar directly. Instead, you configure a Delegation Signer (DS) record.
- B. Correct.
Correct: You create a key-signing key (KSK) in AWS KMS, which Route 53 uses to sign the DNS records in the zone. This is part of enabling DNSSEC signing.
- C. Correct.
Correct: After enabling DNSSEC signing in Route 53, you must configure a Delegation Signer (DS) record at your domain registrar using the details provided by Route 53 to establish a trust chain.
- D. Incorrect.
Incorrect: Route 53 automatically handles the signing of DNS records when DNSSEC is enabled. There is no need for manual signing or third-party tools.
- E. Incorrect.
Incorrect: DNSSEC validation is a client-side or DNS resolver-side operation and is not part of the configuration process for enabling DNSSEC on a hosted zone.