A city public-works user VLAN shows lateral SMB scanning between endpoints that share the same L2 segment. Which control filters that east-west traffic inside the VLAN?
Select an answer to reveal the explanation.
Short Explanation
An SVI ACL only sees traffic that leaves the VLAN for the router. Intra-VLAN SMB chatter never goes upstairs—so you need a VACL (or similar L2 filter) that works on the floor where the scans live.
Full Explanation
VACLs filter traffic within a VLAN, addressing east-west flows that never hit an SVI router ACL. When a city public-works user VLAN shows lateral SMB scanning between endpoints on the same L2 segment, a VLAN ACL can filter those frames VLAN-wide beyond a port ACL scoped to a single interface.
A routed ACL on the SVI only sees traffic that leaves the VLAN for routing; intra-VLAN SMB chatter never goes upstairs. CoPP policing of OSPF hellos on the core protects the control plane, not east-west SMB on an access VLAN. uRPF strict mode on access host ports without proper IP bindings is not the tool for intra-VLAN SMB filtering.
Exam caveat: intra-VLAN filtering → VACL (or similar L2 policy); SVI ACLs miss switched-local traffic.
Operational check: apply a VACL denying lateral SMB as policy requires, test scanner and legitimate gateway flows, and ensure public-works endpoints still reach required servers via permitted paths. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services. Re-validate after the next platform or policy change. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.