I do not understand why answer E, "Implement a challenge-response test on all end-user queries," is wrong. Also, I believe that establishing a hot site for a DDoS attack is excessive. I've searched this question online and found that answer C is as popular as E, but I don't see a rationale for either answer. Can you give me a rationale for why C is correct or for why E is wrong?