Which of the following best describes a use case for a DNS sinkhole?

A DNS sinkhole works by providing false DNS resolution for known-malicious domains. When an infected host or malware attempts to contact a command-and-control (C2) server or other malicious infrastructure, the DNS sinkhole intercepts the request and directs it to a controlled, non-routable, or monitored IP address instead of the actual malicious server. This allows security teams to identify infected devices within their network by observing which devices attempt to connect to these sinkholed domains, effectively "capturing" the traffic without allowing the malicious communication to complete. The other options are incorrect because: Attackers do not view sinkholes as valuable for domain structure; sinkholes are a defensive tool. Sinkholes do not redirect employees to malicious sites; they prevent connections to them. While a sinkhole can attract attention, its primary purpose is not to divert attackers from network resources but to detect and contain internal threats.