An organization needs domain-based control of DNS queries made through VPC Resolver. Which control is designed for this purpose?

1. An ALB listener rule for every DNS query.
2. A security group that matches the text of domain names inside DNS packets.
3. Route 53 Resolver DNS Firewall with domain lists and associated rule groups.
4. An S3 object lock policy for the DNS zone export.