SCS-C02 · Question #41
A company needs to implement DNS Security Extensions (DNSSEC) for a specific subdomain. The subdomain is already registered with Amazon Route 53. A security engineer has enabled DNSSEC signing and has
The correct answer is C. Create a Delegation Signer (DS) record in the parent hosted zone.. After you enable DNSSEC signing for a hosted zone in Route 53, establish a chain of trust for the hosted zone to complete your DNSSEC signing setup. You do this by creating a Delegation Signer (DS) record in the parent hosted zone. https://docs.aws.amazon.com/Route53/latest/Devel
Question
A company needs to implement DNS Security Extensions (DNSSEC) for a specific subdomain. The subdomain is already registered with Amazon Route 53. A security engineer has enabled DNSSEC signing and has created a key-signing key (KSK). When the security engineer tries to test the configuration, the security engineer receives an error for a broken trust chain. What should the security engineer do to resolve this error?
Options
- AReplace the KSK with a zone-signing key (ZSK).
- BDeactivate and then activate the KSK.
- CCreate a Delegation Signer (DS) record in the parent hosted zone.
- DCreate a Delegation Signer (DS) record in the subdomain.
How the community answered
(34 responses)- A3% (1)
- B6% (2)
- C79% (27)
- D12% (4)
Explanation
After you enable DNSSEC signing for a hosted zone in Route 53, establish a chain of trust for the hosted zone to complete your DNSSEC signing setup. You do this by creating a Delegation Signer (DS) record in the parent hosted zone. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec-enable-
Topics
Community Discussion
No community discussion yet for this question.