Who is responsible for rotating DNSSEC keys in Amazon Route 53?
A company uses Amazon Route 53 for its DNS needs. The company's security team wants to update the DNS infrastructure to provide the most recent security posture. The security team has configured DNS Security Extensions (DNSSEC) for the domain. The security team wants a network engineer to explain who is responsible for the rotation of DNSSEC keys. Which explanation should the network administrator provide to the security team?
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests the split of responsibilities in Route 53 DNSSEC key management: AWS handles ZSK rotation automatically, while the customer owns and rotates the KSK via AWS KMS.
In Amazon Route 53 DNSSEC, AWS automatically rotates the Zone-Signing Key (ZSK) while the customer is responsible for managing and rotating the Key-Signing Key (KSK) stored in AWS KMS.
Candidates often choose option B, assuming the customer must rotate both keys, because they forget that Route 53 fully automates ZSK rotation on the customer's behalf.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Amazon Route 53 DNSSEC signing uses two types of keys: a Key-Signing Key (KSK) and a Zone-Signing Key (ZSK). Understanding which party manages each key is essential for both the exam and real-world DNS security operations.
The KSK is used to sign the DNSKEY record set at the zone apex, which is then referenced in the DS record published in the parent zone (e.g., the TLD). In Route 53, the KSK is backed by an AWS KMS asymmetric customer-managed key. Because the customer owns this KMS key, the customer is responsible for its lifecycle, including rotation when required by their security policy.
The ZSK is used to sign the individual DNS records within the zone. Route 53 fully automates ZSK management, including creation and rotation (typically every 90 days). The customer does not need to — and cannot — manually rotate the ZSK.
Therefore, the correct explanation is that AWS rotates the ZSK, and the company rotates the KSK (option A). Options B, C, and D are incorrect because they either assign ZSK rotation to the customer or incorrectly involve the KMS key itself as something AWS rotates, which misrepresents the shared-responsibility model for DNSSEC in Route 53.
Official Reference
Exam Strategy
When a Route 53 DNSSEC question mentions key rotation, immediately recall the mnemonic "Customer KSK, AWS ZSK". Eliminate any option that assigns ZSK rotation to the customer or claims AWS rotates the KMS key.
Related Analysis
Practice All ANS-C01 Questions
Access 137 questions with complete answers and detailed explanations.
View Full ANS-C01 Practice Test →