Which of the following can be done to secure a BIND server? (Select THREE correct answers)

Running BIND as a non-root user (e.g., `named` user) significantly reduces the impact of a potential compromise, as the daemon would only have limited system privileges.

Access Control Lists (ACLs) in BIND allow administrators to define which hosts or networks are permitted to query, transfer zones, or update DNS records, thus restricting unauthorized access.

Standard DNS queries do not involve client authentication with passwords before querying the server; while DNSSEC provides authenticity, simple queries are unauthenticated.

Implementing a chroot jail isolates the BIND daemon's file system environment, confining it to a specific directory tree. This prevents a compromised BIND process from accessing or modifying other parts of the operating system.

While DNS over TLS (DoT) or DNS over HTTPS (DoH) can encrypt DNS traffic, this is a client-server protocol enhancement for privacy and integrity, not a direct security hardening for the BIND *server* itself to prevent attacks like cache poisoning.