A customer needs to prevent attackers from hijacking their domain/IP and redirecting users to a malicious site through a man-in-the-middle attack. Which solution should this customer use?

DNS Security Extensions (DNSSEC) is a technology designed to protect against DNS-based attacks. It works by digitally signing DNS records, allowing DNS resolvers to verify that the information they receive from a DNS server is authentic and has not been altered in transit. This cryptographic validation directly prevents man-in-the-middle attacks like DNS spoofing or cache poisoning, where an attacker tries to redirect users to a malicious site by providing a fraudulent IP address for a legitimate domain.

A. VPC Flow Logs are for network traffic monitoring and forensics. They record traffic flows but do not prevent DNS hijacking attacks.
B. Cloud Armor is a Web Application Firewall (WAF) that protects against application-layer attacks like DDoS and SQL injection, not DNS-level attacks.
D. Cloud Identity-Aware Proxy (IAP) is an access control service that enforces identity-based authorization for applications, which is unrelated to DNS integrity.

1. Google Cloud Documentation

"Managing DNSSEC configuration". The documentation states

"Domain Name System Security Extensions (DNSSEC) protects your domains from spoofing and cache poisoning attacks. When you use a DNSSEC-enabled resolver

DNSSEC provides authentication of domain lookups."

2. Internet Engineering Task Force (IETF)

RFC 4033

"DNS Security Introduction and Requirements"

Section 2. This RFC outlines the problem statement that DNSSEC solves

including data integrity and authentication

which are central to preventing MITM attacks on DNS.