As a securing consultant, what are some of the things you would recommend to a company to ensure DNS security? Select the best answers.

Co-locating DNS with other applications violates least privilege and increases risk because a compromise of any co-hosted service can simultaneously expose and compromise the DNS server.

Hardening DNS servers by applying patches, disabling unnecessary services, and restricting recursive queries reduces the exploitable attack surface on a critical infrastructure component.

Split-horizon DNS returns different responses to internal and external clients, preventing internal network topology and host names from being exposed to outside parties.

Restricting zone transfers to explicitly authorized secondary servers prevents attackers from performing a full zone enumeration to map the internal network.

Placing DNS servers on separate, diverse subnets improves resilience against network-layer attacks and eliminates single points of failure for name resolution.