After an external scan of the civic ASN, a port authority wants layered protection for router control planes without turning the project into a full firewall-centric Security redesign. Which combination best reflects EI defense-in-depth on the network devices?
Select an answer to reveal the explanation.
Short Explanation
Think of the civic ASN like a harbor: one boom at the entrance is not enough. CoPP is the pier gate for the control plane, infrastructure ACLs thin the junk before it arrives, and authenticated sessions keep strangers off the tugs. Layers beat a single firewall hope.
Full Explanation
After an external scan of the civic ASN, a port authority wanting layered router control-plane protection—without turning the project into a full firewall-only Security redesign—should deploy Control Plane Policing, infrastructure ACLs that filter noisy or management traffic toward the routers, and authenticated routing/control sessions. That combination reflects Enterprise Infrastructure defense-in-depth on the network devices themselves.
Relying only on a single perimeter firewall while leaving CoPP and iACLs disabled ignores on-box control-plane hardening. Disabling all dynamic routing for static-only forever is an extreme availability tradeoff unrelated to layered CP protection. Opening SNMPv2c with a public community from the entire Internet worsens exposure rather than defending the control plane.
Exam caveat: CoPP policy rates and iACL permit holes for legitimate routing, management, and monitoring must be lab-validated or you can black-hole your own protocols. Operational check: apply staged CoPP and iACLs in a maintenance window, verify BGP/OSPF/SSH/SNMP still work from approved sources, and confirm unscanned noisy traffic is limited in show policy-map control-plane counters. Keep the civic ASN scan findings linked to each control for audit traceability.