> C) provision certificates for this address using the DNS-Challenge approach rather than the HTTP-challenge approach.

The other "bonus" is that due to CT it leaks the internal name to basically everyone on the internet. It may or may not be a problem but definitely something to be aware of.