An administrator enables DNS filtering on the firewall to block users from visiting malicious websites. Which of the following should the administrator also do? (Choose two.)

Disabling DoH (DNS over HTTPS) in user browsers prevents them from bypassing the firewall's DNS filtering by encrypting DNS queries and sending them directly to public DoH servers, rather than the internal DNS server controlled by the firewall.

Updating NS records would be necessary to point a domain's authoritative DNS to new servers, but it's not directly related to enabling internal client-side DNS filtering or enhancing security for the clients using that filter.

Blocking port 443 (HTTPS) to specific malicious websites is a web filtering action, not a direct enhancement or requirement for DNS filtering itself, though it could be a complementary security measure.

Blocking port 53 (DNS) to servers on the internet is a fundamental part of forcing clients to use internal DNS servers for filtering, but the question asks what *else* the administrator should do, implying DNS filtering is already enabled, and blocking external DNS is usually a prerequisite, not an 'also do'.

Disabling TLS v1.3 in browsers is generally a bad security practice as TLS v1.3 offers enhanced security and performance over older versions, and it's unrelated to DNS filtering.

Implementing DNSSEC (DNS Security Extensions) for corporate records adds a layer of authentication and integrity checking to DNS data, protecting against DNS spoofing and cache poisoning attacks, which complements DNS filtering by ensuring the authenticity of the responses received.