A school district sees rising malware from student devices resolving malicious domains over branch internet exits and wants to block risky lookups before connections form, without backhauling DNS to headquarters. Which DNS security policy using a cloud resolver to filter DNS requests blocks malicious domains at branches?
Select an answer to reveal the explanation.
Short Explanation
Stopping bad clicks starts before the connection does. Cloud DNS filtering checks each lookup upstream and drops the shady ones, with the resolver acting as your bouncer.
Full Explanation
The correct design works because enforcement on the WAN Edge combined with redirection to a cloud resolver moves protection to the initial lookup, where a malicious domain returns a sinkhole or deny response so no HTTP or TLS session ever establishes, while direct internet exit is preserved and no query is tromboned to headquarters for resolution. The visibility-focused choice fails on enforcement concept because sending branch queries to the cloud for monitoring, reporting, and analytics is a legitimate observability pattern but it does not block, so infected clients still receive real answers and can connect to attacker infrastructure. The headquarters-tunneled choice fails on transport concept because forwarding branch DNS over the overlay to central resolvers, even when those resolvers consume cloud intelligence, reintroduces backhaul latency, bandwidth consumption, and headquarters dependency that violates the explicit requirement for local egress. The ISP-resolver choice fails on intelligence concept because steering to a provider resolver with locally maintained RPZ blocklists is a common branch filtering method, yet it lacks the continuously updated cloud categorization, threat correlation, and centralized policy control specified in the scenario. As an exam caveat, separate DNS-layer prevention from web, firewall, or IPS controls and treat phrases such as monitor only, tunnel to headquarters, or ISP and local list as signals that one required element is missing despite otherwise matching language. As a practical check, confirm branch DHCP points to the Edge, test with a safe evaluation domain expected to block, and capture egress to verify DNS leaves the branch directly toward the cloud service rather than traversing a tunnel to headquarters.