A regional bank connects 80 branches over private MPLS with frequent edge flaps and an audit finding of unauthenticated EIGRP updates. The design must verify every neighbor, contain query scope on flaps, and hide branch instability from the core. Which EIGRP stability and authentication design meets all three needs?

Named-mode HMAC-SHA-256 authentication configured under the address-family interface authenticates every EIGRP packet with a keyed hash, which blocks spoofed neighbors and forged updates, while EIGRP stub on branches advertises only connected and summary routes and tells the hub not to query branches, and aggregation at the distribution further narrows the query domain and dampens flaps so SIA events and recalculations stay localized. MD5 with full topology advertisement provides weaker hashing and defeats stability by flooding detailed branch prefixes that expand queries and reconvergence. Graceful restart with core-to-branch summarization helps control-plane restart and update size but provides no neighbor verification, leaving the audit finding open to spoofing. Passive interfaces with distribute-lists can suppress Hellos and filter prefixes but passive blocks adjacency entirely and filtering without authentication still accepts forged updates from an attacker. For the exam, remember named-mode authentication lives under af-interface, not topology base, and stub must be on the spoke. In practice verify with show ip eigrp neighbors and show ip eigrp topology plus intentional flap tests to confirm queries stop at the distribution.