Google Professional Cloud Security Engineer Question 222
Select 3Google Cloud PlatformYou are a security engineer for a company that hosts critical applications on Google Cloud. You have been tasked with ensuring the security of your Cloud DNS configuration to prevent unauthorized access and DNS spoofing attacks. Which of the following actions should you take to secure your Cloud DNS setup?
- A
Enable DNSSEC for your managed zones.
- B
Restrict access to Cloud DNS by using Identity and Access Management (IAM) roles.
- C
Disable logging for DNS queries to prevent sensitive data exposure.
- D
Use private DNS zones for internal services instead of public DNS zones.
- E
Allow public DNS zones to be accessible to all users for improved availability.
Show answer and explanation
Correct answers: A, B, D
Explanation
Securing Cloud DNS involves enabling DNSSEC to protect against DNS spoofing, implementing IAM roles to restrict access, and using private DNS zones for internal services to prevent exposure of internal data. Disabling logging and allowing unrestricted access to public zones are not secure practices.
- A. Correct.
Enabling DNSSEC (Domain Name System Security Extensions) helps protect against DNS spoofing and man-in-the-middle attacks by ensuring DNS responses are authentic and not tampered with.
- B. Correct.
Restricting access to Cloud DNS using IAM roles ensures that only authorized users or services can modify DNS configurations, reducing the risk of unauthorized changes.
- C. Incorrect.
Disabling logging is not a recommended practice for security. Logging DNS queries can help with auditing and detecting suspicious activities.
- D. Correct.
Using private DNS zones for internal services ensures that sensitive internal DNS records are not exposed to the public internet, improving security.
- E. Incorrect.
Allowing public DNS zones to be accessible to all users is a poor security practice as it increases the risk of unauthorized access and data exposure.