A team wants to enable DNSSEC signing for a Cloud DNS zone that contains highly sensitive, internal-only records. What is the accurate limitation or approach?
Choose an answer
Tap an option to check your answer.
Correct answer: DNSSEC signing in Cloud DNS is supported only for public managed zones; for private zones, use an on-prem DNS server that provides DNSSEC..
Why this is the answer
The correct answer is that DNSSEC signing in Cloud DNS is supported only for public managed zones. For private zones, you cannot directly enable DNSSEC signing within Cloud DNS. If DNSSEC is required for internal-only records, you would typically need to implement an on-premises DNS server solution that supports DNSSEC, or a third-party DNS service integrated with your private network. Cloud DNS does not support enabling DNSSEC on private managed zones, so the first option is incorrect. Enabling DNSSEC at the VPC network resource is not a valid concept; DNSSEC operates at the DNS server level, not the network infrastructure level. DNSSEC must be enabled at the authoritative DNS server for the zone, not on an upstream ISP resolver, making the last option incorrect.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed