A transit authority requires keyed authentication on IGP adjacencies after an audit of closet routers. What primary risk does enabling IGP authentication address?
Select an answer to reveal the explanation.
Short Explanation
IGP auth is like checking badges at the staff door—not encrypting every passenger’s suitcase. Neighbors prove they know the shared key before you trust their hellos and updates. User traffic still needs its own crypto if privacy is the goal.
Full Explanation
Routing-protocol authentication authenticates adjacency and control-plane messages so unauthorized devices cannot inject or spoof IGP updates. After a transit-authority audit of closet routers, keyed IGP authentication primarily verifies that routing updates come from an authentic neighbor rather than an unauthorized speaker on an exposed link. That hardens neighbor authenticity on civic closet or WAN links auditors care about.
It does not encrypt all end-user TCP and UDP payloads that traverse the authenticated link—authentication is for the routing protocol, not a data-plane VPN. It does not replace ACLs that protect management-plane access to the routers. It does not guarantee that routing metrics cannot change when a link becomes congested; metrics and congestion are separate from neighbor authenticity.
Exam caveat: mismatched keys prevent adjacency; rotate keys with overlap windows where supported, and remember authentication is necessary but not sufficient without ACLs, BFD/GTSM, and physical security. Operational check: enable matching keys on both ends, confirm adjacency reforms, attempt an unauthorized speaker without the key and confirm it cannot join, and record key management in the transit authority’s change process.