AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 185

Question

A company needs to implement DNS Security Extensions (DNSSEC) for a specific subdomain. The subdomain is already registered with Amazon Route 53. A security engineer has enabled DNSSEC signing and has created a key-signing key (KSK). When the security engineer tries to test the configuration, the security engineer receives an error for a broken trust chain. What should the security engineer do to resolve this error?

Accepted Answer

Correct answer: C. The correct answer is C. Option C: Create a Delegation Signer (DS) record in the parent hosted zone.

AWS Certified Security - Specialty SCS-C02 — Question 185