Google Cloud Professional Cloud Security Engineer Practice Exam

Which Google Cloud service should be used to authenticate responses to domain name lookups following DDoS attacks?

1. Cloud DNS with DNSSEC

2. Cloud DNS without DNSSEC

3. Cloud Firewall

4. Cloud Armor

The correct answer is: Cloud DNS with DNSSEC

Using Cloud DNS with DNSSEC is the ideal choice for authenticating responses to domain name lookups, especially in scenarios where there is a risk of DDoS attacks. DNSSEC, or Domain Name System Security Extensions, adds a layer of security to the DNS protocol by enabling response validation. This ensures that the responses returned for DNS queries are authentic and have not been tampered with. During a DDoS attack, one common vulnerability is DNS spoofing or cache poisoning, where attackers try to direct users to malicious sites by providing false DNS responses. By implementing DNSSEC, you are able to sign the DNS records cryptographically, allowing the resolvers to verify that the response is indeed from the authoritative source and has not been altered in transit. This additional layer of authentication is crucial for maintaining the integrity and reliability of the DNS responses, particularly under attack conditions where the authenticity of responses is threatened. Therefore, using Cloud DNS with DNSSEC not only enhances security but also fosters trust in the responses provided to the users querying domain names.