You are a network designer and are responsible for ensuring that the network you design is secure. How do you plan to prevent infected devices on your network from sourcing random DDoS attacks using f

ACL-based forwarding uses permit/deny rules based on predefined address ranges and does not dynamically verify source addresses against the routing table, making it unable to generically block all spoofed source addresses.

ACL filtering by destination inspects the destination address of packets to control forwarding, and has no mechanism to detect or block packets with forged source addresses.

Unicast RPF loose mode only checks that the source address exists anywhere in the routing table via any interface, not that it is reachable through the specific ingress interface, which allows spoofed addresses that happen to exist in the routing table to pass unchallenged.

Unicast RPF strict mode performs a FIB lookup on the source address of each incoming packet and drops any packet whose source address is not reachable through the ingress interface; since forged source addresses used in DDoS attacks typically cannot pass this reverse path check, infected devices on the network are unable to successfully send spoofed packets beyond the ingress router. This is the standard mechanism recommended by BCP38 for anti-spoofing at network edges.