Which Security profile must be added to Security policies to enable DNS Signatures to be checked?

Which Security profile must be added to Security policies to enable DNS Signatures to be checked?
A . URL Filtering
B. Vulnerability Protection
C. Anti-Spyware
D. Antivirus

Answer: C

Explanation:

In addition, you can enable the DNS sinkholing action in Anti-Spyware profiles to enable the firewall to forge a response to a DNS query for a known malicious domain, causing the malicious domain name to resolve to an IP address that you define.

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/policy/security-profiles