You were tasked to enhance the security of a network with these characteristics: - A pool of servers is accessed by numerous data centers and remote sites - The servers are accessed via a cluster of…

Adding static routes to Null0 blackholes specific destination prefixes but does not dynamically filter spoofed source IP addresses originating from compromised workstations.

uRPF strict mode checks that a packet arrives on the same interface the router would use to forward traffic back to the source IP; in an asymmetric routing environment this would drop legitimate traffic, making it unsuitable here.

ACLs on the server-facing firewall interface are static constructs that require manual definition of permitted sources and do not scale to dynamically prevent spoofed traffic from arbitrary compromised hosts.

uRPF loose mode drops packets only if the source IP address has no entry in the routing table at all, effectively blocking spoofed or unroutable source addresses used by attackers. Unlike strict mode, it does not require the ingress interface to match the best-path reverse route, so legitimate asymmetric traffic caused by the firewall cluster is not dropped. This provides anti-spoofing security without disrupting the existing asymmetric traffic flows.