Refer to the exhibit.

Inbound Infrastructure ACLs are configured to protect the SP network. Which three types of traffic
should be filtered in the infrastructure ACLs? (Choose three.)

A.
traffic from a source with an IP address that is within 239.255.0.0/16

B.
FTP traffic destined for internal routers

C.
IPsec traffic that at an internal router

D.
traffic from a source with an IP address that is within 162.238.0.0/16

E.
EBGP traffic that peers with edge routers

Explanation:
With the use of the protocols and addresses identified, the infrastructure ACL can be built to
permit the protocols and protect the addresses. In addition to direct protection, the ACL also
provides a first line of defense against certain types of invalid traffic on the Internet:
– RFC 1918 space must be denied. (RFC1918 describes a set of network ranges set aside for socalled “private” use.)
– Packets with a source address that fall under special-use address space, as defined in RFC
3330, must be denied.

– Anti-spoof filters must be applied. (Your address space must never be the source of packets from
outside your AS.)