A branch must stop users from reaching known command-and-control domains and also block a large hostile address range at the edge. The team wants name lookups to return an address they control so connections go to that address instead of the malicious destination, and the range blocked no matter which protocol carries the traffic. Which combination of policy controls delivers both results?
Select an answer to reveal the explanation.
Short Explanation
A DNS sinkhole answers the name lookup with an address you control, redirecting the client away from the malicious destination. Security Intelligence matches addresses and drops that traffic before the access control rules run. You'll need both because they act at different points in the flow, like checking guests by name at one door and by plate number at another.
Full Explanation
DNS policy runs on the lookup itself, so a sinkhole rule answers the query with an address you choose; the client may then attempt a connection to that address rather than the malicious destination. Security Intelligence inside the access control policy is evaluated ahead of the rules and matches network addresses, so a hostile range is dropped regardless of the protocol or port. Putting the names and range on Security Intelligence block lists can block matching DNS queries and network traffic, but the DNS block does not return the address you control as a sinkhole would. Matching the names inside the query with a Snort 3 DNS rule can block the query, but it does not return your chosen address. Sinkholing the names while only logging traffic to the range satisfies the first requirement but leaves the range unblocked. Exam caveat: DNS policy only sees lookups it can identify, so an encrypted resolver can evade name-based controls, which is one reason address blocking still matters. Practical check: resolve a sinkholed domain from a test host, confirm the returned address, then check the Security Intelligence event log for a dropped hit from the range.