GCP Professional Cloud Security Engineer Practice Question

Your company hosts the public DNS zone corp.example in Cloud DNS. After investigating recent cache-poisoning attempts, the security team asks you to implement a control that allows validating recursive resolvers on the internet to cryptographically verify that the answers they receive for corp.example are authentic and untampered. The operations team wants a solution that minimizes ongoing key-management overhead for them. What should you do?

Enable DNSSEC for the Cloud DNS managed zone, rely on Cloud DNS to create and automatically rotate the ZSK, manually manage the KSK, and publish the generated DS record with the domain registrar.
Enforce DNS over TLS for all clients and block UDP/53 on the corporate firewall to prevent on-path tampering of DNS responses.
Deploy secondary authoritative DNS servers in another project and front them with Cloud CDN so cached DNS responses remain available during outages.
Enable Cloud DNS query logging and create Cloud Logging alerts to detect suspicious NXDOMAIN or SERVFAIL spikes indicating cache-poisoning attempts.

Report Issue

Answer Description

Turning on DNSSEC for the Cloud DNS public zone instructs Cloud DNS to sign each resource-record set with RRSIG records that validating resolvers can check against the zone's DNSKEY records, protecting against spoofing and cache poisoning. When DNSSEC is enabled, Cloud DNS automatically creates and can automatically rotate the Zone-Signing Keys (ZSKs). You must still create (and periodically rotate) the Key-Signing Key (KSK) manually and publish the associated Delegation Signer (DS) record at your domain registrar to complete the chain of trust. Solutions based solely on encrypted transport (DoT/DoH), logging, or caching do not provide the cryptographic data-integrity guarantees required. Therefore, enabling DNSSEC with Cloud-managed ZSKs and manually publishing the DS record provides strong authenticity with minimal ongoing effort.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.