Company XYZ must design a strategy to protect their routers from DoS attacks such as traffic destined to the router's own route processor, using separate control plane categories. Which two…

The transit subinterface handles traffic passing through the router to another destination, not traffic destined to the router itself, so queue thresholding there does not protect the route processor.

The host subinterface in CPPr specifically handles traffic addressed to the router's own IP addresses (including the route processor), so applying queue thresholding here directly caps the packet rate reaching the RP, mitigating DoS flooding attacks.

Port filtering on the host subinterface drops packets targeting specific TCP/UDP ports before they consume RP CPU resources, providing granular per-protocol protection against DoS attacks aimed directly at the route processor.

Port filtering on the transit subinterface filters forwarded through-traffic, not traffic aimed at the router's own route processor, making it ineffective for the stated requirement.

The CPPr main interface is a parent aggregate interface; applying filtering only at the main interface does not provide the per-category granularity that dedicated host and transit subinterfaces deliver.