Which statement is TRUE of anti-spoofing?

IPS and anti-spoofing are independent security controls - IPS inspects payload threats while anti-spoofing validates source IP reachability, so disabling one does not replace the other.

Manual creation introduces the risk of human error and topology drift, making it less reliable than keeping groups derived from or synchronized with the routing table.

Anti-spoofing enforces that traffic arriving on a given interface can only originate from IP ranges reachable via that interface, exactly as defined in the routing table. If the anti-spoofing topology groups do not reflect the routing table, legitimate traffic can be dropped or spoofed traffic can pass. Keeping them synchronized ensures the enforcement logic matches actual network reachability.

Enabling dynamic routing does not cause anti-spoofing groups to update automatically - an administrator must manually update or reconfigure the topology groups when routing changes occur.