An ACI deployment must: - Only use a proxy for border leaf switches. - Classify incoming traffic on L3OUT. - Immediately update the endpoint database when the endpoint moves between leaf switches. Whi

In Cisco ACI, configuring the VRF's 'Policy Control Enforcement Preference' to `Enforced` (often referred to as Ingress Policy Control enforcement) ensures that policy enforcement is applied to all ingress traffic within that VRF. This enables traffic classification on L3OUTs, supports the use of proxy ARP/MAC on border leaf switches for external connectivity, and facilitates immediate endpoint database updates when endpoints move within the fabric by actively processing and learning endpoint information.

Disabling 'Enforce Subnet Check' means the fabric will not validate if an endpoint's IP address belongs to a configured subnet, which is a security and validation setting, but it does not address the requirements for proxy usage, L3OUT classification, or immediate endpoint updates.

Enabling 'Enforce Subnet Check' ensures that an endpoint's IP address is validated against its subnet, which is a security feature, but it is not the VRF configuration responsible for policy enforcement on ingress traffic, proxy behavior, or immediate endpoint learning as required.

This option is a duplicate of option A and is therefore the correct choice.