Which feature in the DNS security module provide on and off network DNS protection?

Cisco Umbrella is a cloud-delivered DNS security service that enforces DNS-layer policies by routing all DNS queries through Cisco's resolvers, providing consistent protection whether a device is on-premises or roaming off-network. It blocks malicious domains before a connection is ever established, making it the correct feature for on-and-off-network DNS protection.

Layer-4 monitoring inspects network traffic at the transport layer and is not a DNS security feature that provides roaming or off-network user protection.

Real-time sandboxing is a malware analysis technique used to detonate suspicious files and observe behavior, not a DNS resolution or protection mechanism.

Data Loss Prevention focuses on detecting and blocking sensitive data from leaving the organization, not on DNS-layer threat protection for roaming users.