Question

A financial services company hosts its public domain 'example-bank.com' in a Cloud DNS public managed zone. Security auditors require protection against DNS cache poisoning and spoofing so that resolvers can cryptographically validate the authenticity of DNS responses. What should the network engineer do?

Accepted Answer

Enable DNSSEC on the public managed zone and add the DS record to the domain registrar

Answer

Configure a DNS forwarding zone that routes queries through Google Public DNS at 8.8.8.8

Answer

Enable DNSSEC on a private managed zone and configure split-horizon DNS for the domain

Answer

Create signed URLs for the DNS records and distribute the signing keys to trusted resolvers