A network security administrator is worried about potential man-in-the-middle attacks when users access a corporate web site from their workstations. Which of the following is the best remediation aga

Server-side certificates alone allow clients to verify the server's identity but do not authenticate the client, leaving the session vulnerable to an attacker who can intercept and impersonate the client side.

Client-side certificates alone authenticate the client to the server but do not allow the client to verify the server's identity, so a MITM attacker could still successfully impersonate the legitimate server.

Mutual TLS (mTLS) requires both the client and the server to present valid, CA-issued PKI certificates during the TLS handshake, meaning each party cryptographically verifies the other's identity. This eliminates man-in-the-middle attacks because an attacker cannot forge a certificate that is trusted by both sides, making impersonation of either party computationally infeasible.

Strong DNS query authentication addresses DNS spoofing but does not protect the HTTPS connection itself against certificate forgery or session interception by a man-in-the-middle.