A building-permits office must block redistribution of an incorrect summary while still allowing more-specific civic prefixes into the target protocol. Which route-map logic is correct?
Select an answer to reveal the explanation.
Short Explanation
You deny the bad summary early, then permit the good more-specifics or a general permit afterward. Route-maps read top to bottom like a checklist, so the junk summary stays out while permits keep flowing.
Full Explanation
Route-maps evaluate top to bottom; the first matching clause wins. To block redistribution of an incorrect summary while still allowing more-specific civic prefixes into the target protocol, place an early deny clause that matches the summary prefix (access list/prefix-list), then follow with permit clauses for the more-specific civic networks or a general permit for remaining prefixes. The bad summary hits the deny and stops; longer civic prefixes miss the deny and match a later permit, so they redistribute normally for the building-permits office.
The permit-summary-first approach permits the summary first, which allows the unwanted aggregate through and does not “automatically exclude” more-specifics—those are separate prefixes that still need their own matches if not covered by a later permit any. The implicit-deny-only approach relies solely on implicit deny without an explicit deny for the summary and fails when a broad later permit (or permit any) would otherwise allow the summary. You need the explicit early deny when a following permit would match that summary. The clear-BGP-on-summary approach is unrelated operational disruption and does not preserve a clean OSPF more-specific redistribution policy.
Exam caveat: prefix-list ge/le options matter—matching only the exact summary length avoids accidentally denying the more-specifics in the same deny clause. Conversely, a deny that is too broad can suppress the civic more-specifics you intended to keep. Document sequence numbers so future edits do not insert a permit summary above the deny.
Operational check: with the incorrect summary and several more-specific civic routes present, apply the route-map on redistribute and verify the summary is absent in the target protocol while /24 or longer civic prefixes appear. show ip prefix-list and show route-map confirm deny-then-permit order. Increase prefix-list hit counts on the deny sequence when the summary is attempted.