Which of the following statements is valid with regard to Domain Name System (DNS) sinkholing?

The primary goal of DNS sinkholing is to identify infected hosts on a network. When a compromised client attempts to resolve a malicious domain, the firewall intercepts the query and responds with a fake IP address (the sinkhole IP). The client then attempts to connect to this sinkhole IP. The firewall logs this connection attempt in the traffic logs (and also creates a threat log entry for the sinkhole event). Administrators can then filter logs for traffic destined to the sinkhole IP to easily identify the source IP addresses of infected hosts.

A. DNS sinkholing is a feature configured within the Anti-Spyware security profile, not the Vulnerability Protection profile.
B. DNS sinkholing signatures are delivered as part of the Anti-Spyware and Antivirus content updates, not Vulnerability Protection updates.
D. DNS sinkholing is included with the Threat Prevention license; there is no separate, specific "Sinkhole license" required for its activation.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide Version 11.0. "Objects > Security Profiles > Anti-Spyware". This section details the configuration of DNS Sinkhole and states, "Use the traffic logs to view the sinkhole traffic and identify the infected clients."

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide Version 11.0. "Use DNS Sinkholing to Identify Infected Hosts". This section explicitly describes the workflow, culminating in identifying hosts by viewing traffic logs for the sinkhole IP address.