An enterprise dual-homed to two ISPs receives full BGP tables and must accept only its allocated aggregate, block bogons and overly specific prefixes, and drop routes with an unwanted transit AS in the path. Which basic BGP filtering design best enforces this policy requirement?

The correct design is right because inbound policy on each ISP peering must enforce prefix scope and AS-path eligibility before best-path selection, so a route map referencing a prefix list for the allocated aggregate with bogon denials and prefix-length limits plus an AS-path list denying the unwanted transit AS satisfies aggregation, hygiene, and transit avoidance together while preserving dual-homed redundancy. The inbound prefix-only design fails by concept because prefix filtering cannot inspect AS_PATH, so it would still import valid-looking NLRI that traversed the forbidden transit. The inbound AS-path-only design fails by concept because path filtering cannot judge address scope, so it would still import bogons, overly specific prefixes, and non-aggregate routes when the forbidden AS is absent. The outbound combined design fails by concept because BGP direction controls effect, so filtering announcements toward providers does nothing to constrain received full tables and leaves local acceptance unsolved. An exam caveat is that receiving full tables describes input, not required retention, so prioritize accept-only and inbound wording over assuming more paths equal better resilience. A practical check is to compare received-routes versus post-policy BGP table and test show ip bgp regexp for the forbidden AS and a lookup for a known bogon to confirm both filters deny before installation.