A tax assessor edge router must send unknown IPv4 destinations toward the civic Internet firewall. Which static configuration provides that gateway of last resort?

A tax assessor edge router that must forward unknown IPv4 destinations toward the civic Internet firewall needs a gateway of last resort: an IPv4 default static of 0.0.0.0/0 (or 0.0.0.0 0.0.0.0 in classic IOS syntax) pointing at the firewall’s next-hop address or, less ideally on multipoint Ethernet, an exit interface plus next hop. Longest-prefix match still prefers every more-specific connected, static, or dynamic route for campus and agency prefixes; only packets with no longer match fall through to 0.0.0.0/0 and exit toward the firewall for Internet-bound assessor traffic.

A host route only for the firewall’s management address installs reachability to that single device; it does not create a catch-all for arbitrary Internet destinations and therefore fails the “unknown destinations” requirement. An OSPF area filter that drops unknown prefixes is a filtering or stub-area design choice, not a static default—it discards rather than forwards traffic that needs Internet access. Installing a /32 for every Internet server is operationally impossible at Internet scale and is the antithesis of a default route.

Exam caveat: a default static uses AD 1 by default and will override a dynamically learned default unless you raise AD or prefer the IGP default by design. On Ethernet, prefer specifying the next-hop IP so ARP resolves the correct adjacency. Operational check: after configuration, confirm the routing table shows a gateway of last resort / candidate default via the firewall next hop, traceroute or generate traffic to an unmatched public address, and verify packets egress toward the civic Internet firewall rather than being dropped or hairpinned into an internal subnet.