Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 175 discussion

Exam question from Amazon's AWS Certified Advanced Networking - Specialty ANS-C01

Question #: 175
Topic #: 1

[All AWS Certified Advanced Networking - Specialty ANS-C01 Questions]

A company uses Amazon Route 53 for its DNS needs. The company's security team wants to update the DNS infrastructure to provide the most recent security posture.

The security team has configured DNS Security Extensions (DNSSEC) for the domain. The security team wants a network engineer to explain who is responsible for the rotation of DNSSEC keys.

Which explanation should the network administrator provide to the security team?

A. AWS rotates the zone-signing key (ZSK). The company rotates the key-signing key (KSK).
B. The company rotates the zone-signing key (ZSK) and the key-signing key (KSK).
C. AWS rotates the AWS Key Management Service (AWS KMS) key and the key-signing key (KSK).
D. The company rotates the AWS Key Management Service (AWS KMS) key. AWS rotates the key-signing key (KSK).

Show Suggested Answer

Suggested Answer: A 🗳️

by backspace0900 at March 20, 2024, 4:20 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

backspace0900

Highly Voted 9 months ago

Selected Answer: A

customer KSK AWS ZSK

upvoted 7 times

Kayceetalks

9 months ago

Agreed A, You are responsible for KSK management, which includes rotating it if needed. ZSK management is performed by Route 53. https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec.html

upvoted 4 times

...

woorkim

Most Recent 1 week, 4 days ago

A is answer! There are two kinds of keys in DNSSEC: a key-signing key (KSK) and a zone-signing key (ZSK). In Route 53 DNSSEC signing, each KSK is based on an asymmetric customer managed key in AWS KMS that you own. You are responsible for KSK management, which includes rotating it if needed. ZSK management is performed by Route 53.

upvoted 1 times

...

Nodin

9 months ago

Selected Answer: A

AWS rotates ZSK and customer rotates KSK (self managed)