A city clerk’s peering edge receives packets with source addresses that do not match a plausible reverse path. Which feature drops many of those spoofed sources?
Select an answer to reveal the explanation.
Short Explanation
uRPF asks whether a reply to that source would leave via the same door the packet arrived on. If the reverse path looks bogus, the spoofed packet is trash-canned at the edge.
Full Explanation
Unicast Reverse Path Forwarding validates that a packet’s source address is consistent with the routing table’s reverse path (strict or loose modes per design). On a city clerk’s peering edge receiving packets with implausible source addresses, uRPF drops many spoofed sources by checking whether the source is reachable via the expected reverse path.
DHCP snooping on a peering VLAN without DHCP clients does not perform reverse-path source validation at that edge. VACL mirroring of all frames to a printer VLAN is visibility/abuse of VACL, not anti-spoofing. NHRP shortcut on the LAN SVI is a DMVPN overlay concept, not peering-edge uRPF.
Exam caveat: anti-spoofing at edges → uRPF (mode chosen carefully to avoid dropping asymmetric legitimate paths).
Operational check: enable appropriate uRPF mode on clerk peering interfaces, test known spoofed sources, watch drop counters, and exempt or use loose mode where asymmetric routing is legitimate. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services. Re-validate after the next platform or policy change.