Which option will protect the individual servers?

A client is concerned about resource exhaustion because of denial-of-service attacks against their DNS servers.

Which option will protect the individual servers?
A . Enable packet buffer protection on the Zone Protection Profile.
B . Apply an Anti-Spyware Profile with DNS sinkholing.
C . Use the DNS App-ID with application-default.
D . Apply a classified DoS Protection Profile.

Answer: D

Explanation:

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/zone-protection-and-dos-protection/zone-defense/dos-protection-profiles-and-policy-rules/dos-protection-profiles

To protect critical web or DNS servers on your network, protect the individual servers. To do this, set appropriate flooding and resource protection thresholds in a DoS protection profile, and create a DoS protection policy rule that applies the profile to each server’s IP address by adding the IP addresses as the rule’s destination criteria.