Refer to the exhibit. The operations team has identified that some of the multi-tiered e-commerce applications have slow performance, due to illegitimate inbound traffic from the Internet. On which ne

Device A is the upstream internet-facing router or ISP handoff point where the operator typically lacks the authority or capability to enforce granular inbound filtering policies.

Device B represents the perimeter firewall or edge security device positioned between the internet-facing router and the internal application tiers. Applying ACLs or firewall policies at this boundary drops illegitimate traffic at the earliest controllable point, preventing it from traversing internal links, consuming core bandwidth, or reaching web and database servers - directly resolving the application performance degradation caused by inbound floods.

Device C is an internal distribution or aggregation layer device; filtering here allows illegitimate traffic to already traverse and consume edge and uplink bandwidth before being discarded.

Device D is deep within the internal network at the server access tier; placing filtering here means malicious traffic travels across most of the infrastructure before being dropped, providing no meaningful performance improvement.