Which are three key features or benefits of DNS-layer security? (Choose three.)

Real-time sandboxing is a file detonation capability associated with products like Cisco Secure Malware Analytics, not a DNS-layer security feature.

By analyzing DNS query patterns and correlating them with global threat intelligence, Umbrella identifies the domains, IPs, and internet infrastructure that attackers use to stage and execute campaigns.

Umbrella continuously correlates DNS activity against threat intelligence feeds to surface both known and newly emerging threats before they cause damage.

Because DNS queries are resolved through Umbrella's recursive service regardless of where the device is located, protection applies to any device on-network or roaming off-network without requiring a VPN.

Data Loss Prevention is not provided by DNS-layer security - it is a separate capability requiring dedicated DLP tooling.

Retrospective analysis is a Cisco Secure Endpoint (AMP) capability that re-evaluates file disposition over time, not a function of DNS-layer security.