Which two statements regarding Cisco SD-WAN vEdge routers can mitigate DoS attacks against the infrastructure? (Choose two.)

vEdge routers establish secure, authenticated connections with vSmart controllers, ensuring that only trusted and authorized controllers can establish control plane communication back to the router. This prevents rogue controllers from orchestrating DoS attacks.

While Cisco SD-WAN solutions can integrate with security services, vEdge routers do not have integrated IDS/IPS by default on all interfaces; security features are often deployed via security policies or integrated with cloud security services.

Running on a hardened Linux OS contributes to general security, but it is a foundational security practice rather than a specific feature directly mitigating DoS attacks in the same manner as authorized controller communication or stateful firewalling.

When a vEdge router has direct internet access, its integrated stateful firewall ensures that only return traffic that matches an established outbound connection in its state table is permitted to enter the network. This prevents unsolicited inbound connections that could be part of a DoS attack.

An Open Certificate Authority (CA) and automated enrollment provide secure device identity and trust for authentication, which is crucial for overall security, but it is not a direct DoS mitigation mechanism itself.