Exam AWS Certified Security - Specialty topic 1 question 441 discussion

Exam question from Amazon's AWS Certified Security - Specialty

Question #: 441
Topic #: 1

[All AWS Certified Security - Specialty Questions]

A company needs to implement DNS Security Extensions (DNSSEC) for a specific subdomain. The subdomain is already registered with Amazon Route 53. A security engineer has enabled DNSSEC signing and has created a key-signing key (KSK). When the security engineer tries to test the configuration, the security engineer receives an error for a broken trust chain.

What should the security engineer do to resolve this error?

A. Replace the KSK with a zone-signing key (ZSK).
B. Deactivate and then activate the KSK.
C. Create a Delegation Signer (DS) record in the parent hosted zone.
D. Create a Delegation Signer (DS) record in the subdomain.

Show Suggested Answer

Suggested Answer: C 🗳️

by docjames81 at Nov. 21, 2022, 2:40 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

AdamWest

Highly Voted 2 years, 6 months ago

Selected Answer: C

Agree Answer C: After you enable DNSSEC signing for a hosted zone in Route 53, establish a chain of trust for the hosted zone to complete your DNSSEC signing setup. You do this by creating a Delegation Signer (DS) record in the parent hosted zone,

upvoted 11 times

...

docjames81

Highly Voted 2 years, 6 months ago

Selected Answer: C

Docs appear to point to C being the answer here: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec-enable-signing.html

upvoted 7 times

...

yorkicurke

Most Recent 1 year, 4 months ago

Selected Answer: C

The following will hopefully clear most of the points in this question. So to implement DNS Security Extensions (DNSSEC) for a specific subdomain registered with Route 53, you need to follow these steps: Enable DNSSEC signing for the parent zone or hosted zone in Route 53 where the subdomain is defined. This involves creating a key-signing (KSK) key. Sign all resource records in the parent zone with the KSK using the DNSSEC signing configuration. Create a delegation signer (DS) record for the subdomain zone and register it with the parent zone. The DS record establishes trust between the parent and subdomain zones. If the subdomain zone is hosted in a separate Route 53 hosted zone, enable DNSSEC signing on that zone as well by creating a key-signing key. Sign all resource records in the subdomain zone with its key-signing key. This secures the records in the subdomain zone. Verify DNSSEC configurations by checking that the parent and subdomain zones are returning signed records with valid signatures when queried.

upvoted 1 times

yorkicurke

1 year, 4 months ago

Also; Replacing the KSK with a zone-signing key (ZSK) would not resolve the issue. Both KSK and ZSK are used in DNSSEC, but they serve different purposes. The KSK is used to sign the DNSKEY record, and the ZSK is used to sign the zone data.

upvoted 1 times

...

tainh

2 years, 5 months ago

Selected Answer: C

C is correct https://aws.amazon.com/premiumsupport/knowledge-center/route-53-configure-dnssec-subdomain/

upvoted 1 times

...