An emergency-management office places cameras on one subnet but must stop east-west traffic between them while still reaching a shared gateway. Which Private VLAN roles fit that design?
Select an answer to reveal the explanation.
Short Explanation
Isolated PVLAN ports are soundproof booths—cameras can’t chatter to each other, but each can still talk upstairs to the promiscuous gateway. Community would let them gossip; that’s the opposite of what EM wants.
Full Explanation
Private VLANs use primary and secondary VLANs so an emergency-management office can place cameras in isolated secondary PVLANs while the gateway sits on a promiscuous primary port. Isolated hosts reach only the promiscuous device (typically the gateway/firewall), stopping east-west traffic between cameras while preserving shared-subnet reachability to the gateway.
Putting every camera and the gateway in the same community PVLAN lets cameras freely mesh—the opposite of stopping east-west traffic. Using only promiscuous ports for cameras and isolated ports for the gateway reverses roles and breaks the design. Disabling PVLAN and bridging cameras with VACLs that permit all IP between endpoints abandons isolation.
Exam caveat: isolated + promiscuous gateway = no east-west; community allows talk within the community.
Operational check: map cameras to isolated secondaries, gateway to promiscuous, verify camera-to-camera blocks and camera-to-gateway permits, and document PVLAN roles for EM camera closets. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.