Google Professional Cloud Network Engineer Question 542
Select 3Google Cloud PlatformYour organization is using Google Cloud DNS to manage its domain. To improve the security and authenticity of DNS responses, you need to enable DNS Security Extensions (DNSSEC) for a public DNS zone. Which of the following steps must be performed to correctly enable DNSSEC?
- A
Sign the DNS zone with a DNSSEC key in Google Cloud DNS.
- B
Enable DNSSEC on the DNS zone in Google Cloud DNS.
- C
Disable DNSSEC on the domain registrar before enabling it in Google Cloud DNS.
- D
Update the DS (Delegation Signer) record at the domain registrar with the details from Google Cloud DNS.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enable DNSSEC for a public DNS zone in Google Cloud DNS, you must sign the zone with a DNSSEC key, enable DNSSEC in the Google Cloud DNS settings, and update the DS record at the domain registrar to establish a chain of trust. Disabling DNSSEC at the registrar is not required; instead, the registrar must be updated with the correct DNSSEC information.
- A. Correct.
Correct: Signing the DNS zone with a DNSSEC key is required for enabling DNSSEC, as this ensures DNS responses are cryptographically validated.
- B. Correct.
Correct: Enabling DNSSEC in Google Cloud DNS is mandatory to activate the functionality for the zone.
- C. Incorrect.
Incorrect: DNSSEC does not need to be disabled at the domain registrar. Instead, it must be properly configured with the DS records.
- D. Correct.
Correct: Updating the DS record at the domain registrar is necessary to inform parent zones about the DNSSEC configuration, enabling the chain of trust.