You have configured DNSSEC for your domain hosted on OCI DNS. You understand the importance of regularly rotating your Key Signing Key (KSK) to…

Objective: Identify the true statement about KSK rotation in OCI DNS.

Option A: OCI DNS automates much of the process but requires user initiation, not fully automated—

incorrect.

Option B: OCI DNS generates keys internally; manual generation and upload aren’t required—

incorrect.

Option C: OCI DNS offers a “KSK Rollover” feature that, once enabled, automates the rotation

process, ensuring minimal disruption—correct.

Option D: KSK rotation is supported via the rollover feature—incorrect.

Conclusion: Option C accurately describes OCI DNS KSK rotation.

Oracle documentation confirms:

"OCI DNS supports KSK rotation through the KSK Rollover feature. Enable it to automatically rotate

keys while maintaining DNS resolution continuity."

This validates Option C. Reference: DNSSEC in OCI DNS - Oracle Help Center (docs.oracle.com/en-

us/iaas/Content/DNS/Tasks/managingdnssec.htm).