AWS Certified Advanced Networking – Specialty (ANS-C01) — Question 166

A company uses Amazon Route 53 for its DNS needs. The company's security team wants to update the DNS infrastructure to provide the most recent security posture.

The security team has configured DNS Security Extensions (DNSSEC) for the domain. The security team wants a network engineer to explain who is responsible for the rotation of DNSSEC keys.

Which explanation should the network administrator provide to the security team?

Answer options

• A. AWS rotates the zone-signing key (ZSK). The company rotates the key-signing key (KSK).
• B. The company rotates the zone-signing key (ZSK) and the key-signing key (KSK).
• C. AWS rotates the AWS Key Management Service (AWS KMS) key and the key-signing key (KSK).
• D. The company rotates the AWS Key Management Service (AWS KMS) key. AWS rotates the key-signing key (KSK).

Correct answer: A

Explanation

The correct answer is A because AWS manages the rotation of the zone-signing key (ZSK), while the company is responsible for rotating the key-signing key (KSK). Option B is incorrect as it implies that the company rotates both keys, which is not the case. Option C is wrong because AWS KMS keys are not directly related to DNSSEC key rotation responsibilities. Option D incorrectly states that AWS rotates the KSK, which is the company's responsibility.