Google Professional Cloud Network Engineer Question 540
Select 3Google Cloud PlatformYour organization has recently started using Google Cloud DNS to manage its domains. To enhance security and protect against DNS spoofing attacks, you are tasked with enabling DNS Security Extensions (DNSSEC) for a specific managed zone. What steps should you take to properly enable DNSSEC in Google Cloud DNS?
- A
Enable DNSSEC signing directly in the Google Cloud Console for the managed zone.
- B
Verify that the domain registrar for your domain supports DNSSEC and update the registrar with the DNSSEC DS (Delegation Signer) record.
- C
Manually configure DNSSEC keys in the Google Cloud Console after enabling DNSSEC.
- D
Ensure the DNSSEC policy type is set to 'Transfer' mode in the Google Cloud Console.
- E
Check that the managed zone type is 'public' since DNSSEC is not supported for private zones.
Show answer and explanation
Correct answers: A, B, E
Explanation
Enabling DNSSEC on Google Cloud DNS involves enabling DNSSEC signing for the managed zone and ensuring the DS record is updated with the domain registrar to complete the chain of trust. Additionally, DNSSEC is only supported for public zones, and key management is handled automatically by Google Cloud, so no manual configuration is required.
- A. Correct.
Correct: You must enable DNSSEC signing in the Google Cloud Console for the managed zone to sign DNS records with DNSSEC keys.
- B. Correct.
Correct: DNSSEC requires coordination with the domain registrar to update the DS record for proper validation.
- C. Incorrect.
Incorrect: DNSSEC keys are automatically generated and managed by Google Cloud DNS, so manual configuration is unnecessary.
- D. Incorrect.
Incorrect: There is no 'Transfer' mode for DNSSEC policies in Google Cloud DNS. This is a distractor.
- E. Correct.
Correct: DNSSEC is only supported for public managed zones in Google Cloud DNS, not for private zones.