Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Advanced Networking - Specialty · AWS
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
There are two kinds of keys in DNSSEC: a key-signing key (KSK) and a zone-signing key (ZSK). In Route 53 DNSSEC signing, each KSK is based on an asymmetric customer managed key in AWS KMS that you own. You are responsible for KSK management, which includes rotating it if needed. ZSK management is performed by Route 53.
In DNSSEC, Amazon Route 53 handles the rotation of the Zone Signaling Key (ZSK). The ZSK is used to sign the DNS records in a zone and is typically rotated by AWS every 90 days. This ensures that any man-in-the-middle attacks are quickly identified and mitigated. On the other hand, the company's Key Signing Key (KSK) should be rotated regularly, but not automatically by AWS. The KSK is used to sign the ZSKs themselves, and its rotation is typically performed by the company itself, either manually or through automation scripts.
A is answer! There are two kinds of keys in DNSSEC: a key-signing key (KSK) and a zone-signing key (ZSK). In Route 53 DNSSEC signing, each KSK is based on an asymmetric customer managed key in AWS KMS that you own. You are responsible for KSK management, which includes rotating it if needed. ZSK management is performed by Route 53.