Google Professional Cloud Network Engineer exam dumps

Google Professional Cloud Network Engineer practice question 544 of 790

Professional Cloud Network Engineer. Professional level, Google Cloud. Free question with the correct answer and a full explanation.

Google Professional Cloud Network Engineer Question 544

Select 2Google Cloud Platform

Your organization has configured a public DNS zone in Google Cloud DNS to host the domain example.com. To improve the security of your DNS records by preventing spoofing and verifying the integrity of DNS responses, you decide to enable DNS Security Extensions (DNSSEC). Which of the following steps are required to enable and configure DNSSEC for your public DNS zone correctly?

  1. A

    Enable DNSSEC in the Cloud DNS zone settings and set the zone to 'Sign and Serve' mode.

  2. B

    Update the DNS zone's name server (NS) records to point to Google Cloud's authoritative name servers.

  3. C

    Obtain the DS (Delegation Signer) record from Cloud DNS and update it at your domain registrar.

  4. D

    Manually generate cryptographic keys for signing and upload them to the Cloud DNS zone.

  5. E

    Disable DNS caching on public resolvers to ensure DNSSEC validations are performed.

Show answer and explanation

Correct answers: A, C

Explanation

To enable DNSSEC in Cloud DNS, you must turn on DNSSEC signing for your zone by setting it to 'Sign and Serve' mode. Once enabled, Cloud DNS will generate the necessary cryptographic keys and sign the DNS records automatically. To establish the chain of trust, you must obtain the DS record from Cloud DNS and update it in your domain registrar's settings. Other steps, such as updating NS records or disabling caching, are either unrelated to DNSSEC or unnecessary for its configuration.

  • A. Correct.

    Correct: Enabling DNSSEC in the Cloud DNS zone settings and setting the zone to 'Sign and Serve' mode ensures that DNSSEC is properly configured and signed by Google's managed keys.

  • B. Incorrect.

    Incorrect: Updating the NS records to Google Cloud's name servers is standard for using Cloud DNS but is not specific to enabling DNSSEC.

  • C. Correct.

    Correct: The DS record (Delegation Signer) must be obtained from Cloud DNS and provided to your domain registrar to complete the DNSSEC chain of trust.

  • D. Incorrect.

    Incorrect: Cloud DNS automatically manages the cryptographic keys for DNSSEC. Manual key generation is not required.

  • E. Incorrect.

    Incorrect: Disabling DNS caching is not related to DNSSEC activation or configuration. DNSSEC works with resolvers that support DNSSEC validation.

Timed practice exam

Take a Google Professional Cloud Network Engineer practice test under exam conditions

60 questions in 120 minutes, drawn from this bank, with a score report and a per-question review when you finish.

Start timed exam

More Google Professional Cloud Network Engineer practice questions

  1. 545.Your organization has deployed multiple GKE clusters in a single Google Cloud project. To ensure...
  2. 546.Your organization has a hybrid cloud setup with on-premises data centers and resources deployed in...
  3. 547.You are designing a hybrid cloud architecture where your on-premises environment needs to resolve...
  4. 548.Your organization has deployed a hybrid cloud architecture. On-premises workloads need to resolve...
  5. 549.Your organization is setting up a hybrid cloud environment. You need to ensure that DNS queries for...
Back to the Google Professional Cloud Network Engineer exam dumps