Which security solution protects users leveraging DNS-layer security?

Cisco ISE (Identity Services Engine) is an identity and access control policy platform, not primarily a DNS-layer security solution.

Cisco FTD (Firepower Threat Defense) is a next-generation firewall and IPS, primarily operating at network and application layers, not specifically at the DNS layer for external domain resolution.

Cisco Umbrella offers cloud-delivered security that operates at the DNS layer, inspecting DNS requests to block access to malicious domains, command-and-control callbacks, and phishing sites before a user's device even connects to the destination IP address. This proactive approach prevents threats from reaching endpoints.

Cisco ASA (Adaptive Security Appliance) is a traditional firewall and VPN concentrator, also operating at network and application layers, and does not inherently provide DNS-layer security for external threats.