A traveler on a cafe's open wireless network can see that a person at the next table is reading the laptop's DNS queries. The laptop should send those queries inside HTTPS. Which feature does that?
Select an answer to reveal the explanation.
Short Explanation
Open wireless is a crowded counter, and a clear-text lookup is a postcard anyone can read. You send the DNS queries inside HTTPS so the neighbor sees an encrypted session instead of the names. Signing the answer, encrypting DNS on a different transport, or never asking at all is not the feature the laptop was told to use.
Full Explanation
DNS over HTTPS places each lookup inside an HTTPS session, so the query name is not in clear text on the cafe wireless. The neighbor can see a session to a resolver and can no longer read the names. DNSSEC signs responses so a resolver can detect a forgery. It does not encrypt the query, so the capture still shows the names. DNS over TLS is the tempting twin because it also hides the names. It encrypts DNS on its own transport, and the stem requires the lookups inside HTTPS. A hosts file answers names locally and never sends the query. That is not an encrypted lookup on the wireless. Exam caveat: the resolver that terminates HTTPS still sees the names. Hiding them from the cafe does not hide them from that resolver. Operational check: capture on the cafe wireless while the laptop opens a site and confirm the names no longer appear in clear text while an HTTPS session to the resolver does. Keep DNSSEC if you still want signed answers. It does not replace the HTTPS session that hides the names from the cafe.