Which configuration enables blocking access to multiple URLs for security purposes using policy and responder rules?

• A. add policy patset BAD_URL bind policy patset BAD_URL badurl1.mylab.lab index 11 charset ASCll bind policy patset BAD_URL badurl2.mylab.lab index 10 charset ASCll add responder policy BAD_URL_DNS DNS.REQ.QUESTION.DOMAIN.CONTAINS_ANY BAD_URL RESET bind responder global BAD_URL_DNS 100 END type DNS_REQ_OVERRIDE
• B. add policy patset BAD_URL bind policy patset BAD_URL badurl1.mylab.lab index 11 charset ASCll bind policy patset BAD_URL badurl2.mylab.lab index 10 charset ASCll add responder policy BAD_URL_DNS DNS.REQ.QUESTION.DOMAIN.CONTAINS BAD_URL DROP bind responder global BAD_URL_DNS 100 END type DNS_REQ_OVERRIDE
• C. bind policy patset BAD_URL badurl1.mylab index 11 charset ASCll bind policy patset BAD_URL badurl2.mylab,lab index 10 charset ASCll end
• D. bind policy patset BAD_URL badurl1.mylab.lab index 11 charset ASCll bind policy patset BAD_URL badurl2.mylab.lab index 10 charset ASCll add responder policy BAD_URL_DNS DNS.REQ.QUESTION.DOMAIN.CONTAINS BAD_URL END type DNS_REQ_OVERRIDE

Answer: (A)

Blocking access to multiple URLs at the DNS layer is achieved by combining a policy pattern set with a DNS responder rule that overrides DNS responses. You define a patset that lists the bad URLs, then create a responder policy that checks DNS questions against that patset using DNS.REQ.QUESTION.DOMAIN.CONTAINS_ANY and takes an action to terminate the query, such as RESET. Binding this responder policy globally ensures every DNS request is evaluated, so any query containing a bad URL is immediately blocked before it reaches the target site.

The reason this configuration is the best fit is that it explicitly uses DNS_REQ_OVERRIDE to intercept and override DNS responses based on a list of disallowed domains, and it applies globally with a concrete action that reliably terminates the query. The other options either use a different action (which may not terminate the DNS flow consistently), omit the global binding, or lack the necessary responder policy, so they wouldn’t block all undesired URLs as effectively.