A city Internet edge peers with two ISPs for the municipal data center. Engineers discover inbound routes accept almost any prefix and there is no scrubbing or rate-limiting plan for volumetric floods. Which design change best hardens ingress and egress at this peering edge?
Select an answer to reveal the explanation.
Short Explanation
Picture the city’s front door with no bouncer and no flood plan. Peering that trusts every prefix and has no scrubbing is an open invitation. Filter what you accept, prove routes are legitimate, and put DDoS readiness in front of the things that keep city services online.
Full Explanation
At an Internet peering edge, unfiltered BGP acceptance and missing volumetric defenses leave municipal services exposed to route hijacks, spoofed traffic, and saturation attacks. Secure design combines ingress and egress filtering, route validation such as RPKI or strict prefix lists, and a DDoS response path such as scrubbing or coordinated upstream blackholing. Removing peering or advertising private space does not substitute for controlled edge policy.