Google Professional Cloud Security Engineer Question 226
Select 3Google Cloud PlatformYou are a security engineer at an organization using Google Cloud DNS to host its public DNS zones. Your company wants to ensure security best practices are followed to prevent DNS spoofing and unauthorized zone updates. Which of the following actions should you take to secure your Cloud DNS configuration?
- A
Enable DNSSEC for the public zones.
- B
Restrict IAM permissions to only allow authorized users to manage Cloud DNS zones.
- C
Disable logging for DNS queries to avoid storing sensitive information.
- D
Configure private zones for internal DNS records instead of exposing them in public zones.
- E
Allow public access to the Cloud DNS API to ensure broad availability of DNS management.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure Cloud DNS, it is important to enable DNSSEC to prevent DNS spoofing, restrict IAM permissions to prevent unauthorized changes, and use private zones for internal records to protect sensitive information. Disabling logging is not advisable, and public access to the DNS API should always be avoided to maintain security.
- A. Correct.
Enabling DNSSEC ensures that DNS responses are verified using cryptographic signatures, which helps prevent DNS spoofing or man-in-the-middle attacks.
- B. Correct.
Restricting IAM permissions ensures that only authorized users or service accounts can make changes to DNS records or zones, reducing the risk of unauthorized modifications.
- C. Incorrect.
Disabling logging for DNS queries is not a security best practice. Logging can help identify suspicious activity or debug issues, so it should be enabled and monitored securely.
- D. Correct.
Configuring private zones for internal DNS records ensures that sensitive internal resources are not exposed to public networks, aligning with the principle of least privilege.
- E. Incorrect.
Allowing public access to the Cloud DNS API is a bad security practice as it increases the risk of unauthorized access to DNS settings. Access should be restricted to trusted users or networks.