An ecommerce company needs to implement additional security controls on all its domain names that are hosted in Amazon Route 53. The company's new policy requires data authentication and data integrity verification for all queries to the company's domain names. The current Route 53 architecture has four public hosted zones. A network engineer needs to implement DNS Security Extensions (DNSSEC) signing and validation on the hosted zones. The solution must include an alert capability. Which combination of steps will meet these requirements? (Choose three.)

Question

Accepted Answer

A. Enable DNSSEC signing for Route 53 Request that Route 53 create a key-signing key (KSK) D. Create a chain of trust for the hosted zones by adding a Delegation Signer (DS) record to the E. Set up an Amazon CloudWatch alarm that provides an alert whenever a DNSSECInternalFailure

Answer

B. Enable DNSSEC signing for Route 53 Request that Route 53 create a zone-signing key (ZSK)

Answer

C. Create a chain of trust for the hosted zones by adding a Delegation Signer (DS) record for each

Answer

F. Set up an AWS CloudTrail alarm that provides an alert whenever a DNSSECInternalFailure error

An ecommerce company needs to implement additional security controls on all its domain names that are hosted in Amazon Route 53. The company's new policy requires data authentication and data…

Question

Options

How the community answered

Explanation

Topics

Community Discussion