A system administrator needs to meet the maximum amount of security goals for a new DNS infrastructure. The administrator deploys DNSSEC extensions to the domain names and infrastructure. Which of…

DNSSEC does not improve availability - it adds validation overhead and does not address uptime, redundancy, or resilience against denial-of-service attacks.

DNSSEC provides data origin authentication by allowing resolvers to verify that DNS records were signed by the legitimate zone owner using public-key cryptography, confirming the identity of the data source.

DNSSEC ensures data integrity by attaching cryptographic signatures (RRSIG records) to DNS resource records, so any modification to the data in transit will cause signature validation to fail.

DNSSEC does not provide confidentiality because DNS queries and responses remain in plaintext; it only signs records, it does not encrypt them.

DNSSEC uses digital signatures for validation purposes, not encryption - the DNS data itself is not encrypted, so confidentiality of the query or response content is not achieved.