Google Professional Cloud Security Engineer Question 227
Select 3Google Cloud PlatformYour company uses Google Cloud DNS to manage internal and external domains. To enhance security, you need to configure DNS settings to prevent unauthorized access to sensitive zones and ensure DNS queries are encrypted. Which settings should you configure?
- A
Enable DNSSEC for zones to protect against DNS spoofing.
- B
Use Private DNS zones for internal services and limit access using IAM policies.
- C
Enable DNS over HTTPS (DoH) for encrypted DNS queries.
- D
Use Cloud Armor to restrict access to Cloud DNS zones.
- E
Configure logging for DNS queries to monitor potential security issues.
Show answer and explanation
Correct answers: A, B, C
Explanation
Securing Cloud DNS involves enabling DNSSEC to protect against spoofing, using Private DNS zones with IAM policies to restrict access, and encrypting DNS queries with DNS over HTTPS (DoH). These configurations directly enhance DNS security. Logging and using Cloud Armor are valuable but do not directly address the specific security requirements for DNS.
- A. Correct.
Enabling DNSSEC ensures that DNS records are signed and validated, preventing DNS spoofing and ensuring data integrity.
- B. Correct.
Private DNS zones are useful for internal services, and using IAM policies ensures only authorized users or services can access the zones.
- C. Correct.
DNS over HTTPS (DoH) encrypts DNS queries, protecting them from interception or tampering.
- D. Incorrect.
Cloud Armor is a web application firewall and cannot directly restrict access to Cloud DNS zones.
- E. Incorrect.
While logging DNS queries can help monitor security issues, it does not directly enhance security for DNS settings.