A company hosts its public domain on Cloud DNS. Its security team wants validating resolvers to be able to detect forged answers injected somewhere along the resolution path. Which feature provides this?
Show answer and explanation
Answer: A
DNSSEC adds cryptographic signatures to the records in a zone. A validating resolver checks those signatures against keys published through the parent zone, so it can reject altered or forged answers, which protects against spoofing and cache poisoning. Enabling it in Cloud DNS also requires publishing a DS record at the domain registrar to build the chain of trust. DNSSEC does not hide queries from observers, so it is not an encryption feature. Private zones only limit which networks can see names, and Cloud Armor does not sign or validate DNS records.
Why the other options are wrong
- B. DNS over HTTPS encrypts the path between a client and a resolver, which protects privacy from eavesdroppers. It does not prove that the answer itself is authentic, so forged records would still be accepted.
- C. Private zones restrict name resolution to selected VPC networks. They control visibility rather than whether a response is authentic, so spoofed answers on public resolution would not be detected.
- D. Cloud Armor shields front-end services from request floods and attack traffic. It has no role in signing or checking DNS answers, so forged records would still reach resolvers.
Exam tip. DNSSEC proves answers are authentic; it does not encrypt queries.