Which are three key features of DNS-layer security? (Choose three.)

Data Loss Prevention is not a feature of DNS-layer security - it requires a dedicated DLP product or CASB integration.

Retrospective analysis is a capability associated with Cisco Secure Endpoint (AMP), which re-evaluates files after new threat intelligence emerges, not a DNS-layer security feature.

Real-time sandboxing is a threat intelligence and file analysis capability, not a function of DNS-layer security.

Umbrella logs every DNS request across all devices and ports, providing complete visibility into all internet activity including cloud app usage and destination domains.

By intercepting DNS queries before a network connection is established, Umbrella acts as the earliest possible control point, blocking malicious destinations at the DNS layer before any data is exchanged.

Umbrella operates its own global recursive DNS infrastructure, routing all DNS requests through this service to enforce security policies and threat blocking for any connected device.