As a securing consultant, what are some of the things you would recommend to a company to ensure DNS security? Select the best answers.

Co-locating DNS with other applications violates least-privilege principles and increases risk, since compromise of any co-hosted service can directly impact DNS integrity.

Hardening DNS servers involves disabling unnecessary services, applying patches, and enforcing strict access controls to reduce the attack surface on the DNS infrastructure itself.

Split-horizon DNS presents different zone data to internal vs. external clients, preventing internal network topology and hostnames from being exposed to outside attackers.

Restricting zone transfers to only authorized secondary servers prevents attackers from performing a full zone enumeration and mapping the entire DNS namespace.

Subnet diversity between DNS servers ensures a single targeted network attack or outage cannot simultaneously disable both primary and secondary DNS services.