Select the question you would ask your customer related to DNS attacks. Based on the material, choose the most appropriate question.

Asking how the customer secures their DNS infrastructure is the broadest and most impactful discovery question because it invites the customer to describe their complete DNS security approach, including policies, tools, monitoring, and configurations, revealing gaps across all threat vectors rather than one narrow area.

Asking only about firewall protection is too narrow because network firewalls do not address DNS-specific attack vectors such as cache poisoning, DNS amplification, or zone transfer exploitation.

Over-provisioning is a capacity strategy that may reduce impact from volumetric attacks but is not a security control and does not address non-volumetric DNS threats like spoofing or hijacking.

Keeping DNS software patched is a single tactical hygiene measure and does not reveal the breadth of the customer's overall DNS security posture or strategy.