ANS-C01 Question 510
Single answerYour organization is hosting a public-facing application in AWS and leverages Amazon Route 53 for DNS management. To prevent DNS spoofing and ensure the authenticity of DNS responses, you have been tasked with implementing a security mechanism. What is the MOST appropriate method to secure DNS communications in this scenario?
- A
Enable DNSSEC signing and validation in Amazon Route 53.
- B
Use AWS WAF to filter DNS spoofing attempts.
- C
Set up a private hosted zone in Amazon Route 53.
- D
Encrypt DNS queries using Amazon KMS.
Show answer and explanation
Correct answer: A
Explanation
DNSSEC is the most appropriate method to secure DNS communications in this scenario because it ensures the authenticity and integrity of DNS responses. By enabling DNSSEC in Amazon Route 53, you prevent attackers from spoofing DNS responses, which can lead to traffic redirection to malicious sites. While other options may improve security in different contexts, they do not specifically address DNS spoofing or secure DNS communications.
- A. Correct.
DNSSEC (Domain Name System Security Extensions) provides a way to authenticate DNS responses by signing them with cryptographic keys, ensuring that the response has not been tampered with. Amazon Route 53 supports DNSSEC signing and validation for domain names.
- B. Incorrect.
AWS WAF is a web application firewall that protects against common web exploits, but it does not specifically address DNS spoofing or secure DNS communications.
- C. Incorrect.
Private hosted zones are used to manage DNS for internal resources within a VPC, but they are not intended to secure public DNS queries or protect against DNS spoofing.
- D. Incorrect.
Amazon KMS is a service for managing encryption keys, but it does not natively handle DNS query encryption or address DNS security.