FinVerse hosts its public DNS for finverse.com in Amazon Route 53. The security team must enable DNSSEC to protect against DNS spoofing while continuing to use the same domain registrar. What is the correct approach?
Choose an answer
Tap an option to check your answer.
Correct answer: Create an asymmetric AWS KMS key for signing (ECC_NIST_P256), enable DNSSEC signing on the public hosted zone using that key, then publish the DS record with the domain registrar..
Why this is the answer
To enable DNSSEC for a public domain in Route 53, you must first create an asymmetric KMS key (e.g., ECCNISTP256) for signing. This key is used by Route 53 to sign your DNS records. After enabling DNSSEC signing on the public hosted zone with this key, Route 53 generates a Delegation Signer (DS) record. This DS record must then be published with your domain registrar. This establishes a chain of trust from the top-level domain (TLD) to your hosted zone, protecting against DNS spoofing. Enabling DNSSEC on a private hosted zone is irrelevant for public domain protection. DNSSEC validation in Route 53 Resolver inbound endpoints is for validating incoming queries, not for signing your outgoing public DNS records. CAA and SPF records are for certificate authority authorization and email sender policy, respectively; they do not enable DNSSEC.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed