An ecommerce company must enforce DNSSEC (data authentication and integrity) for all domain names hosted in Route 53 across four public hosted zones and include alerting. Which combination of steps will implement DNSSEC signing and validation and provide alerts? (Choose three.)

To implement DNSSEC, you must first enable DNSSEC signing for your Route 53 hosted zones. Route 53 uses a Key-Signing Key (KSK) to sign the Zone-Signing Key (ZSK), and the KSK should be protected by a customer-managed AWS KMS key for enhanced security. Establishing a chain of trust is crucial for DNSSEC validation; this is done by adding a Delegation Signer (DS) record in the parent zone, which points to the KSK in the child zone. Finally, to monitor the health of DNSSEC, an Amazon CloudWatch alarm should be configured to notify on specific DNSSEC-related errors like DNSSECInternalFailure or DNSSECKeySigningKeysNeedingAction, which indicate issues requiring attention. Incorrect options: Enabling DNSSEC signing with a ZSK protected by a KMS key is incorrect because the KSK is the key that should be protected by a customer-managed KMS key, as it signs the ZSK. Adding a DS record for each subdomain is incorrect; the DS record is added in the parent zone to establish trust for the child zone. Creating an AWS CloudTrail alarm is incorrect because CloudTrail logs API calls and events, while CloudWatch monitors metrics and logs, making it suitable for real-time alerting on specific error conditions.