Which of the following can be done to secure a BIND server? (Select THREE correct answers)

Running the BIND daemon (named) as a non-root, unprivileged user limits the damage an attacker could inflict if they compromise the DNS server process, preventing them from gaining full system control.

Configuring Access Control Lists (ACLs) within BIND allows administrators to specify which hosts or networks are permitted to query the server, perform zone transfers, or update records, thus restricting unauthorized access.

Standard DNS clients do not authenticate with passwords for querying a server; while DNSSEC provides data origin authentication and integrity, general client queries are not password-authenticated.

Running the BIND daemon in a chroot jail confines the process to a specific directory tree, preventing it from accessing or modifying files outside that designated environment even if it is compromised, significantly limiting the scope of a potential breach.

While DNS over TLS (DoT) or DNS over HTTPS (DoH) can encrypt DNS traffic, this secures the transport rather than the BIND server's internal hardening against compromise or unauthorized access, and is not a typical configuration option for BIND security itself.