A hospital campus redesign uses OSPF over Ethernet with redundant broadcast segments, point-to-point fiber links, and strict HIPAA adjacency spoofing concerns. Convergence must be fast and neighbor formation predictable. Which OSPF authentication and network type choice best fits the design?

The correct design uses MD5 or HMAC-SHA cryptographic authentication on every OSPF interface to prevent adjacency spoofing and credential replay required for HIPAA compliance, while matching network type to media so fiber point-to-point links form neighbors directly without DR election and broadcast LAN segments retain DR/BDR behavior for predictable redundant Ethernet operation, which together delivers fast and stable convergence. The uniform broadcast approach is widely deployed and supports authentication, but it forces unnecessary DR/BDR election and hello overhead on point-to-point fiber where no designated router is needed, slowing convergence and making neighbor formation less predictable. The point-to-multipoint LAN approach is also legitimate for certain scalable designs and preserves authentication everywhere, yet it removes DR/BDR optimization on redundant broadcast segments and creates extra next-hop and flooding behavior that complicates predictability on campus Ethernet. The tuned-timers approach follows common fast-convergence practice and keeps strong authentication, but it relies on default network types that may mismatch redundant broadcast versus point-to-point fiber topology, leaving DR behavior and neighbor formation unpredictable despite faster hellos. For the exam, remember authentication must cover all interfaces in high-security domains and network type must follow physical topology rather than timer tuning alone. In practice, verify with show ip ospf interface and show ip ospf neighbor to confirm authentication, network type, DR roles, and stable adjacency states across both media.