What will a Palo Alto Networks next-generation firewall (NGFW) do when it is unable to retrieve a DNS verdict from the DNS cloud service in the configured lookup time?

What will a Palo Alto Networks next-generation firewall (NGFW) do when it is unable to retrieve a DNS verdict from the DNS cloud service in the configured lookup time?
A . allow the request and all subsequent responses
B . temporarily disable the DNS Security function
C . block the query
D . discard the request and all subsequent responses

Answer: A