You are a network designer and you must ensure that the network you design is secure. How do you plan to prevent infected devices on your network from sourcing random DDoS attacks using forged…

ACL-based forwarding (Policy-Based Routing) makes forwarding decisions based on traffic classification but does not validate whether the source IP address is topologically reachable via the arriving interface.

Unicast RPF loose mode only verifies that a route for the source address exists anywhere in the routing table, regardless of which interface - it does not check the specific ingress interface, so asymmetrically routed or spoofed packets can still pass.

Unicast RPF strict mode performs a reverse-path lookup: the router checks its FIB for the source IP address of each incoming packet and verifies that the best return path exits through the same interface the packet arrived on. If not, the packet is dropped as a spoofed or forged packet. This directly prevents infected hosts from using random forged source addresses to launch DDoS attacks because the ISP or network edge will discard packets with invalid source addresses at ingress.

ACL filtering by destination restricts traffic based on where packets are going, not where they claim to come from, providing no protection against forged source addresses.