Which phrase describes the method Cisco Umbrella employs to provide DNS security?

Cisco Umbrella primarily works at the DNS layer; capturing and inspecting HTTP GETs is a function typically performed by web proxies or secure web gateways, not its core DNS security mechanism.

Cisco Umbrella operates by intercepting all outgoing DNS queries from network hosts and inspecting them against its global threat intelligence database to block access to malicious domains before a connection can be made.

While Umbrella can receive DNS queries forwarded from local DNS servers, its fundamental mechanism involves inspecting the queries themselves, often directly from hosts configured to use Umbrella DNS, rather than just inspecting "from" the local DNS server.

Cisco Umbrella does not primarily validate DNS queries originating from local proxy servers; its main function is to apply security intelligence to DNS resolutions, typically direct from endpoints or forwarded from local resolvers.