An attacker floods an internet circuit with more traffic than its capacity. Which defense can address saturation before it reaches that circuit?

1. A larger DNS cache on employee laptops
2. A host firewall dropping packets after they cross the circuit
3. Upstream filtering or a provider DDoS scrubbing service
4. Changing the switch's console cable