Two campuses merge after an acquisition, with OSPF on one side and EIGRP on the other, plus two mutual redistribution points for resilience that already created a routing loop for shared data center prefixes. Metrics are incompatible and filtering is absent. Which redistribution design prevents loops while preserving backup paths?

The correct design succeeds because tags preserve redistribution origin across the OSPF-EIGRP boundary, distribute filtering denies tagged routes from being re-advertised back into their source domain, and tuned metrics make the primary boundary preferred while the second stays as a loop-free backup, directly fixing incompatible metrics, absent filtering, and the existing loop for shared data center prefixes while keeping resilience. The one-way redistribution design fails on resilience because removing the second mutual point eliminates the required backup path, so a primary failure isolates prefixes even though control is simpler and stability improves. The summarization with compatible metrics design fails on loop prevention because aggregation and seed metrics improve scalability and selection but carry no origin identity and block no feedback, so shared prefixes can still be learned at one boundary and re-advertised at the other. The administrative-distance-only design fails on feedback control because local preference affects local best-path choice but does not propagate or prevent re-advertisement, so both boundaries can still inject each others routes and sustain deflection or loops. As an exam caveat, do not confuse preference with prevention, since metrics and distance influence selection but only tags plus filtering stop mutual-point feedback. As a practical check, verify tags on redistributed routes, confirm denies in the filter logs, then shut the primary boundary to confirm clean backup takeover without flapping or incrementing hops.