A municipal fiber consortium reviews router security features for an ENARSI study guide aligned to official domain 3.2. Which feature set stays inside that objective rather than substituting zone-based firewall as the primary answer?

For a municipal fiber consortium reviewing router security features for an ENARSI study guide aligned to official domain 3.2, the feature set that stays inside that objective is IPv4 ACLs (standard, extended, time-based), IPv6 traffic filters, and uRPF. Those tools are the infrastructure-security filtering and anti-spoof skillset the domain emphasizes for IOS router troubleshooting and configuration. The correct set works because the exam objective centers on ACL/uRPF behavior, application, and verification—not on substituting an entire firewall product family as the primary answer. Treating CBAC and Zone-Based Policy Firewall as the sole ENARSI 3.2 troubleshooting trio fails because ZBFW/CBAC are not the stand-in primary trio for that domain's ACL/uRPF focus in this study framing. Claiming Firepower threat defense access-control policies replace all IOS ACLs fails conceptually: FTD policy is a different platform/exam skill than IOS interface ACLs and uRPF on civic WAN routers. Elevating Cisco SD-WAN vManage localized policies as the Domain 3 router-security skill fails because SD-WAN policy engines belong to a different architectural track than classic ENARSI IOS ACL/uRPF troubleshooting. Exam caveat: knowing ZBFW exists is useful professionally, but selecting it as the primary Domain 3.2 answer when the stem asks for the ACL/uRPF feature set is a common distractor pattern. Operational check: map study notes to IPv4 ACL types, IPv6 traffic-filters, and strict versus loose uRPF with civic edge examples; practice show access-lists, traffic-filter application, and ip verify unicast source reachable-via verification rather than substituting firewall or SD-WAN policy labs for this objective.