DNS configurations are consistently reviewed and DNS traffic is monitored for malicious activity
Reviewing DNS records and resolver reports on a recurring basis is monitoring aimed at catching tampering or bypass, an unusual-behavior pattern A.8.16 targets.
Checking public DNS records and resolver reports on a recurring basis catches tampering or bypass, keeping A.8.20's DNS protection effective.