Company XYZ wants to improve the security design of their network to include protection from reconnaissance and DoS attacks on their sub interfaces destined toward next hop routers. Which technology…

MPP (Management Plane Protection) restricts which interfaces and protocols can reach the router's management plane (SSH, SNMP, HTTP) and does not protect sub-interfaces carrying transit or routing protocol traffic toward next-hop routers.

CPPr extends control plane security to the physical and sub-interface level, allowing traffic classifiers and policers to be applied directly on interfaces facing next-hop routers, which enables targeted protection against reconnaissance probes and DoS floods before they reach the route processor - a capability that CoPP's global aggregate policing cannot provide.

CoPP applies aggregate rate-limiting to all control plane traffic globally but cannot be scoped to specific sub-interfaces, making it less precise than CPPr for per-interface DoS and reconnaissance mitigation.

DPP is not a recognized Cisco security technology for control plane protection and has no defined function in this context.