A network security administrator is worried about potential man-in-the-middle attacks when users access a corporate web site from their workstations. Which of the following is the best remediation aga

Server-only certificates authenticate the server to the client but leave the client unauthenticated, allowing an attacker to relay or intercept traffic while posing as a legitimate client.

Client-only certificates verify the client's identity but do not authenticate the server, leaving users vulnerable to connecting to a rogue server that intercepts their traffic.

Requiring both client and server certificates implements mutual TLS (mTLS), where each party must present a valid certificate and prove possession of the corresponding private key. This eliminates impersonation from either direction - an attacker cannot pose as the server to the client or as the client to the server - which is the core mechanism of man-in-the-middle attacks.

Strong DNS query authentication mitigates DNS spoofing and cache poisoning attacks but does not prevent MitM interception of the actual HTTPS session once a connection is established.