Explanation/Reference:
Explanation: Validating user authentication should be implemented as close to the source as
possible, with an emphasis on strong authentication for access from untrusted networks. Access rules
should enforce policy deployed throughout the network with the following guidelines:
An integral part of identity and access control deployments is to allow only the necessary access. Highly
distributed rules allow for greater granularity and scalability but, unfortunately, increase the management
complexity. On the other hand, centralized rule deployment eases management but lacks flexibility and
scalability.
Practicing "defense in depth" by using security mechanisms that back each other up is an important
concept to understand. For example, the perimeter Internet routers should use ACLs to filter packets in
addition to the firewall inspecting packets at a deeper level.
Cisco Press CCDA 640-864 Official Certification Guide Fourth Edition, Chapter 13
Exam E