Cloud Dns Dnssec Ksk Rotation Configuration

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise hosts its primary domain in a Google Cloud DNS public managed zone. A security engineer must configure Domain Name System Security Extensions (DNSSEC) to protect client resolvers from DNS spoofing and cache poisoning attacks. The solution must establish a verified chain of trust with the third-party domain registrar and define a zero-downtime rotation procedure for the Key Signing Key (KSK).

Which procedure should the security engineer implement?

Create a Cloud DNS private peering zone linked to an external resolver, configure DNSSEC validation rules within the producer VPC, and submit the generated DNSSEC certificate to the registrar via TLS.

Enable DNSSEC on the Cloud DNS managed zone, immediately delete the default KSK to generate a new key pair, upload the new public key directly to Cloud DNS response policies, and leave registrar DS configurations blank.

Enable DNSSEC on the Cloud DNS managed zone, export the Zone Signing Key (ZSK) public key string, add the raw ZSK as an NS record at the registrar, and rotate the ZSK every 30 days by modifying registrar settings.

Enable DNSSEC on the Cloud DNS managed zone, retrieve the generated Delegation Signer (DS) record data, submit the DS record to the domain registrar, and when rotating the KSK, add the new KSK, publish the new DS record at the registrar, wait for the DS TTL to expire, and then delete the old KSK.

Professional Cloud Security Engineer

Cloud Dns Dnssec Ksk Rotation Configuration

Related questions