An election office must ensure only approved site subnets are protected in the DMVPN IPsec SAs rather than encrypting unintended flows. What control should they apply carefully?
Select an answer to reveal the explanation.
Short Explanation
Interesting-traffic ACLs are the guest list for encryption—only the subnets you name get the IPsec tuxedo. Widen that list carelessly and you encrypt (or break) flows you never meant to touch.
Full Explanation
IPsec proxy identities / interesting-traffic ACLs define which traffic selectors are protected in the SAs for DMVPN and related IPsec designs. An election office should carefully apply those ACLs so only approved site subnets enter the IPsec SAs rather than encrypting unintended flows. Tight, mirrored selectors prevent missing protection and negotiation mismatches.
Storm-control broadcast thresholds on the hub WAN Ethernet address L2 storms, not IPsec selectors. Private VLAN isolated ports on hub core switches for GRE endpoints do not select interesting traffic. UDLD aggressive mode on spoke LAN access ports is an L1/L2 unidirectional-link control, not an IPsec ACL.
Exam caveat: crypto ACLs / proxy identities select what is encrypted—keep them specific and symmetric.
Operational check: define interesting-traffic ACLs for approved election subnets only, mirror them on peers, verify SA traffic selectors, and test that unintended subnets remain outside the SAs. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services. Re-validate after the next platform or policy change.