Professional Cloud Security EngineerConfiguring network securityMedium
A financial institution requires a highly secure and compliant environment for its critical applications in Google Cloud. They need to ensure that their VPC network's DNS resolution for internal resources cannot be tampered with or intercepted by external entities. Specifically, they want to prevent any public DNS queries from resolving their internal domain names. Which Cloud DNS feature should they configure?
- APublic Zones
- BDNSSEC
- CPrivate Zones
- DDNS Peering
Show answer & explanationAnswer & explanation
Correct answer: C. Private Zones
Cloud DNS Private Zones allow you to serve custom DNS records for your internal resources within your Google Cloud VPC networks. These zones are not accessible from the public internet, ensuring that internal domain names are resolved privately and securely.
Why the other options are wrong
- A. Public Zones are accessible from the internet and would expose internal domain names.
- B. DNSSEC provides authentication of DNS responses to prevent DNS spoofing but does not restrict zone access to internal networks only.
- D. DNS Peering allows DNS resolution across different VPC networks but doesn't inherently prevent public access to a zone.
Cloud DNS Private Zones
Cloud DNS Private Zones enable you to manage DNS records for your internal Google Cloud resources, ensuring that these records are only resolvable within specified VPC networks.
- Resolves internal domain names within VPCs.
- Not accessible from the public internet.
- Enhances security by preventing exposure of internal network structure.
Memory trick: Private Zones keep your internal DNS secrets safe indoors.