Preventing DNS Hijacking with DNSSEC

PCSE By islever Editorial Last updated

Designing and configuring perimeter security. Managing authentication.

Short answer

C The customer should use DNS Security Extensions (DNSSEC) to cryptographically sign DNS records and prevent attackers from hijacking domain lookups and redirecting users via man-in-the-middle attacks.

Question

A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack.
Which solution should this customer use?
  1. VPC Flow Logs
  2. Cloud Armor
  3. DNS Security Extensions Correct Answer
  4. Cloud Identity-Aware Proxy

Key Takeaways

The main trap is selecting Cloud Armor; however, Cloud Armor protects traffic after it arrives, while DNSSEC secures the initial domain resolution process where hijacking occurs.

Learn why DNS Security Extensions (DNSSEC) are the correct solution for preventing DNS hijacking and man-in-the-middle redirection attacks in Google Cloud environments.

Common mistake: Many candidates choose Cloud Armor because it is a popular security tool, but it fails here because it cannot inspect traffic that has already been redirected to a malicious IP by a compromised DNS response.

Expert Analysis

DNS Hijacking and the Role of DNSSEC

The scenario describes a classic DNS hijacking or man-in-the-middle (MitM) attack where an attacker intercepts or spoofs domain resolution, redirecting users to a malicious site. This occurs at the name-resolution layer, before any application traffic reaches infrastructure firewalls. DNS Security Extensions (DNSSEC) is the specific solution designed to address this by digitally signing DNS records. This cryptographic signature allows resolvers to verify that the DNS response has not been tampered with, effectively preventing spoofed responses from redirecting users.

Why Cloud Armor is Incorrect in This Context

While Cloud Armor provides robust DDoS protection and web application firewall capabilities, it operates at the edge of the network, inspecting HTTP/HTTPS traffic after the DNS lookup has occurred. If the DNS record itself is poisoned (hijacked), the user’s browser connects directly to the attacker’s IP address. In this case, the legitimate Cloud Armor policy never sees the traffic, rendering it ineffective against the initial redirection phase. As noted in community discussions, "traffic first needs to reach cloud armour... DNS can be hijacked if you dont use DNSSEC," highlighting that boundary protection cannot secure a compromised path to the boundary.

Operational Consequence and Exam Strategy

Choosing Cloud Armor over DNSSEC represents a common trap: confusing general perimeter security with protocol-specific integrity. On the exam, always map the threat vector to the OSI layer. For attacks involving domain/IP redirection or spoofed DNS responses, look for DNSSEC. For attacks involving volumetric floods or malicious HTTP payloads reaching your load balancer, look for Cloud Armor. Understanding this sequencing—DNS resolution precedes traffic ingestion—is critical for selecting the correct control.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When analyzing security questions, identify the exact layer where the vulnerability exists. If the threat involves 'redirecting,' 'spoofing,' or 'domain hijacking,' the issue is likely at the DNS layer, requiring DNSSEC. If the threat involves 'DDoS,' 'SQL injection,' or 'malicious payloads' hitting your endpoint, consider Cloud Armor. Always prioritize controls that mitigate the attack at its source rather than downstream defenses.

Frequently Asked Questions

Why isn't Cloud Armor sufficient to stop DNS hijacking?

Cloud Armor inspects traffic arriving at the load balancer. If DNS is hijacked, the user is directed to a different IP address entirely, bypassing the Cloud Armor protected zone.

What does DNSSEC actually do?

DNSSEC adds cryptographic signatures to DNS records, allowing clients to verify that the DNS response originated from the authoritative server and was not modified in transit.

More PCSE FAQ →

Discussion 16 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 16

  1. ESP_SAP 👍 16
    Correct Answer is (C): DNSSEC — use a DNS registrar that supports DNSSEC, and enable it. DNSSEC digitally signs DNS communication, making it more difficult (but not impossible) for hackers to intercept and spoof. Domain Name System Security Extensions (DNSSEC) adds security to the Domain Name System (DNS) protocol by enabling DNS responses to be validated. Having a trustworthy Domain Name System (DNS) that translates a domain name like www.example.com into its associated IP address is an increasingly important building block of today’s web-based applications. Attackers can hijack this process of domain/IP lookup and redirect users to a malicious site through DNS hijacking and man-in-the-middle attacks. DNSSEC helps mitigate the risk of such attacks by cryptographically signing DNS records. As a result, it prevents attackers from issuing fake DNS responses that may misdirect browsers to nefarious websites. https://cloud.google.com/blog/products/gcp/dnssec-now-available-in-cloud-dns
  2. Kameswara 👍 5
    C. Attackers can hijack this process of domain/IP lookup and redirect users to a malicious site through DNS hijacking and man-in-the-middle attacks. DNSSEC helps mitigate the risk of such attacks by cryptographically signing DNS records. As a result, it prevents attackers from issuing fake DNS responses that may misdirect browsers to nefarious websites.
  3. ASG 👍 3
    Its man in the middle attack protection. The traffic first needs to reach cloud armour before you can make use of cloud armour related protection. DNS can be hijacked if you dont use DNSSEC. Its your DNS that needs to resolve the initial request before traffic is directed to cloud armour. Option C is most appropriate measure. (think of sequencing of how traffic will flow)
  4. shreenine 👍 3
    C is the correct answer indeed.
  5. GCP72 👍 3 Answered C
    The correct answer is C
Show 11 more comments
  1. bolu 👍 2
    The answers from rest of the folks are complete unreliable. The right answer is Cloud Armor based on my Hands-On labs in Qwiklabs. Reason: Creating a policy in Cloud Armor sends 403 forbidden message for man-in-the middle-attack. Reference: https://cloud.google.com/blog/products/identity-security/identifying-and-protecting-against-the-largest-ddos-attacks Some more: https://cloud.google.com/armor Refer this lab: https://www.qwiklabs.com/focuses/1232?catalog_rank=%7B%22rank%22%3A1%2C%22num_filters%22%3A0%2C%22has_search%22%3Atrue%7D&parent=catalog&search_id=8696512
  2. minostrozaml2 👍 2
    Took the tesk today, only 5 question from this dump, the rest are new questions.
  3. ArizonaClassics 👍 2
    Option C is Perfect. DNSSECURITY!
  4. saurabh1805 👍 2
    DNSEC is the thing, Option C
  5. MohitA 👍 2
    C, Yes for sure DNSSEC
  6. sc_cloud_learn 👍 2
    C. DNSSEC is the ans
  7. AzureDP900 👍 2
    C is right
  8. bigdo 👍 2
    C DNSSEC
  9. b6f53d8 👍 1 Answered C
    on exam only 5 questions was the same as on examtopic
  10. KyubiBlaze 👍 1
    No, C is the correct answer.
  11. KILLMAD 👍 1
    I agree it's C

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Implement TLS Interception for On-Premise Traffic in GCP

S-grade

How to Secure Vertex AI Training Jobs with Regional CMEK?

S-grade

How to Alert on Suspicious Outbound Traffic Using Threat Intelligence?

S-grade

How to Securely Host Databases Without Direct Internet Access?

S-grade

← Back to PCSE Study Guide