Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Advanced Networking - Specialty · AWS
Select 3 answers.
This question asks for 3 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
B. Issue: Route 53 manages the ZSK automatically. The user only needs to manage the KSK (key-signing key). There is no need to explicitly request a ZSK. C. DNSSEC works at the zone level. A DS record is added to the parent zone, not for each subdomain, to create the chain of trust. F: CloudTrail logs API calls but does not natively monitor DNSSEC-related errors. CloudWatch is the correct service for monitoring DNSSEC issues.
Option B: While it is true that DNSSEC uses zone-signing keys (ZSKs) in addition to KSKs, AWS Key Management Service (KMS) is not involved in creating ZSKs for DNSSEC in Route 53. Option C: Delegation Signer (DS) records are used to establish a chain of trust from a parent zone to a child zone, not between subdomains within a zone.
ADE https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-configuring-dnssec-ksk.html