ANS-C01 · Question #272
A company is planning to host a secure web application across multiple Amazon EC2 instances. The application will have an associated DNS domain in an Amazon Route 53 hosted zone. The company wants…
The correct answer is C. Configure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install X.509. DNSSEC protects against DNS poisoning attacks by enabling authentication of DNS data integrity and origin. When DNSSEC is enabled in the Route 53 hosted zone, it signs the DNS records, ensuring their authenticity. To enable web browsers to authenticate the application securely…
Question
A company is planning to host a secure web application across multiple Amazon EC2 instances. The application will have an associated DNS domain in an Amazon Route 53 hosted zone. The company wants to protect the domain from DNS poisoning attacks. The company also wants to allow web browsers to authenticate into the application by using a trusted third party. Which combination of actions will meet these requirements?
Options
- AConfigure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install self-
- BConfigure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install X 509
- CConfigure the Route 53 hosted zone to use DNS Security Extensions (DNSSEC). Install X.509
- DConfigure a Name Authority Pointer (NAPTR) record in the Route 53 hosted zone. Install self-
How the community answered
(31 responses)- A10% (3)
- B3% (1)
- C81% (25)
- D6% (2)
Explanation
DNSSEC protects against DNS poisoning attacks by enabling authentication of DNS data integrity and origin. When DNSSEC is enabled in the Route 53 hosted zone, it signs the DNS records, ensuring their authenticity. To enable web browsers to authenticate the application securely using a trusted third party, X.509 certificates signed by a public Certificate Authority (CA) are required. These certificates allow HTTPS communication, ensuring that the web browsers trust the application.
Community Discussion
No community discussion yet for this question.