A bank expands EIGRP to remote branches over unstable links and sees stuck-in-active events, rogue route injection risk, and branch routers transiting core traffic. Security mandates neighbor authentication using per-interface credentials rather than one shared secret for the whole network. Which EIGRP authentication and stability design hardens and stabilizes the deployment?

The correct design works because named-mode HMAC-SHA-256, configured per address-family interface with its own password, cryptographically authenticates EIGRP packets and stops rogue neighbors from injecting routes; EIGRP stub keeps branch routers from becoming transit paths and from being queried for routes they cannot satisfy; and summary aggregation narrows the query domain so unstable links trigger fewer stuck-in-active events and smaller updates. The single-password-everywhere design fails the stated credential requirement: one network-wide secret means any compromised router exposes every adjacency, even though stub and summarization stabilize topology. The full-transit design fails query-propagation: authentication and summarization alone do not stop branches from receiving and forwarding queries, so flaps still expand SIA scope and core traffic can transit constrained branches. The no-summarization design fails aggregation: authentication and stub limit transit but advertising every specific prefix preserves a large topology and query diameter that sustains instability over lossy links. Exam caveat: HMAC-SHA-256 is available only in named mode and is configured with a password under af-interface (key chains apply to MD5), and stub versus summarization both reduce SIA but only stub blocks transit. Practical check: verify with show ip eigrp interfaces detail and show ip eigrp neighbors detail (stub flag), confirm summaries in the topology table, then flap a branch link and confirm no SIA and no transit path.