The mobility admin is nervous about DNS queries allowing enumeration of host systems on his network. What feature does Android have that can help the admin?

DNS over TLS encrypts DNS queries between the device and the DNS server, preventing eavesdropping and tampering. This encryption makes it significantly harder for attackers to enumerate host systems on the network by observing DNS traffic. Direct Boot allows devices to boot directly into a secure state for essential apps, but doesn't address DNS privacy. Certificate Pinning ensures that a device only trusts specific certificates for a given domain, primarily protecting against man-in-the-middle attacks on HTTPS, not DNS. Chrome safe browsing protects users from malicious websites and downloads within the Chrome browser, which is unrelated to network-wide DNS query privacy.