To configure a DNS rate-limiting policy with a threshold of 1000 DNS requests per second, which command sequence correctly implements this configuration?

• A. add stream selector DNSSelector1 client.udp.dns.domain add ns limit Identifier DNSLimit1 -threshold 5 -timeSlice 1000 -selectorName DNSSelector1 add dns policy DNSLimitPolicy1 "sys.check_limit(DNSLimit1)" -preferredLocation "North America.US.TX.Dallas."
• B. add stream selector DNSSelector1 client.udp.dns.domain add ns limit Identifier DNSLimit1 -threshold 10 -timeSlice 2000 -selectorName DNSSelector1 add dns policy DNSLimitPolicy1 "sys.check_limit(DNSLimit1)" -preferredLocation "North America.US.TX.Dallas."
• C. add stream selector DNSSelector1 client.udp.dns.domain add ns limit Identifier DNSLimit1 -threshold 1000 -timeSlice 1000 -selectorName DNSSelector1 add dns policy DNSLimitPolicy1 "sys.check_limit(DNSLimit1)" -preferredLocation "North America.US.TX.Dallas."
• D. add stream selector DNSSelector1 client.udp.dns.domain add ns limit Identifier DNSLimit1 -threshold 500 -timeSlice 1000 -selectorName DNSSelector1 add dns policy DNSLimitPolicy1 "sys.check_limit(DNSLimit1)" -preferredLocation "North America.US.TX.Dallas."

Answer: (C)

To enforce a rate of 1000 DNS requests per second, you need a limit defined as 1000 requests within a 1000 ms window. The time window is the timeSlice, measured in milliseconds, so a 1000 ms window with a 1000-request threshold results in 1000 requests per second. The command sequence shown attaches a DNS stream selector to the UDP DNS traffic, creates a limit with that 1000/1000 configuration, and then applies a policy that uses sys.check_limit to enforce the limit. This exact pairing is what makes the policy trigger when the DNS rate hits 1000 per second, while the preferred location is simply where the policy is applied.

The other options change either the threshold or the time window, which means the rate enforcement would not match the requested 1000 requests per second. For example, a smaller threshold or a larger timeSlice would allow fewer or more requests per second, not meeting the specified requirement.