ANS-C01 Question 511
Select 2Your organization manages a multi-region web application hosted on AWS. The application relies on Amazon Route 53 for DNS resolution. To ensure the integrity of DNS responses and protect against DNS spoofing, your team has been asked to implement a solution that secures DNS communication. Which of the following steps should you take to enable DNSSEC for your Route 53 public hosted zone?
- A
Sign the hosted zone in Route 53 with a DNSSEC key and publish the DS record in the parent zone.
- B
Enable DNSSEC signing in Route 53 and configure a DNS firewall with AWS Firewall Manager.
- C
Generate a key-signing key (KSK) in Route 53 and configure automatic key rotation.
- D
Enable DNSSEC validation on the resolver side for clients querying your domain.
- E
Use CloudTrail to log and monitor DNSSEC-related changes in your Route 53 hosted zone.
Show answer and explanation
Correct answers: A, D
Explanation
DNSSEC (Domain Name System Security Extensions) adds a layer of security to DNS by enabling authentication of DNS responses using digital signatures. To enable DNSSEC for a public hosted zone in Route 53, you must sign the zone and publish a DS record in the parent zone. Additionally, DNSSEC validation must be enabled on DNS resolvers to ensure clients benefit from this feature. Other options, like using a DNS firewall or CloudTrail, are unrelated to implementing DNSSEC.
- A. Correct.
This is correct. To enable DNSSEC for a public hosted zone in Route 53, you must sign the hosted zone with a DNSSEC key and publish the Delegation Signer (DS) record in the parent zone to establish trust.
- B. Incorrect.
This is incorrect. While DNSSEC signing is necessary, configuring a DNS firewall with AWS Firewall Manager is unrelated to implementing DNSSEC.
- C. Incorrect.
This is incorrect. Route 53 does not require you to manually generate a KSK or configure key rotation; these are managed automatically once DNSSEC is enabled.
- D. Correct.
This is correct. DNSSEC validation must be enabled on the resolver side (e.g., on client-side DNS resolvers) to ensure that verified DNSSEC responses are accepted.
- E. Incorrect.
This is incorrect. While CloudTrail can be used for auditing, it does not directly contribute to enabling or validating DNSSEC.