Which two types of addresses should be denied inbound on a router interface that attaches to the Internet? (Choose two.)

Which two types of addresses should be denied inbound on a router interface that attaches to the Internet? (Choose two.)

• private IP addresses
• any IP address that starts with the number 127
• any IP address that starts with the number 1
• NAT translated IP addresses
• public IP addresses

Explanation: The following addresses should not be permitted inbound from the Internet in order to mitigate IP spoofing and DoS attacks:
All zero address
Broadcast addresses
Local host addresses that start with 127
Reserved private addresses
IP multicast addresses

Exam with this question: Checkpoint Exam: ACLs and Firewalls Group Exam Answers