A public-health clinic must isolate SCADA from corporate users on the same PE-CE style routers without running MPLS in the campus. Which construct provides separate routing tables on those shared boxes?
Select an answer to reveal the explanation.
Short Explanation
VRF-lite is separate filing cabinets in the same clerk’s office—one for SCADA, one for corporate—without needing an MPLS warehouse out back. Shared routers, isolated RIBs. Address overlapping alone won’t stop routes from mixing in one table.
Full Explanation
VRF-lite instantiates multiple VRFs on a router so interfaces and routes stay in separate tables without mandating MPLS label switching in the campus. For a public-health clinic isolating SCADA from corporate users on shared PE-CE style routers, VRF-lite provides separate RIB/FIB instances on those boxes—exactly multi-tenant separation without an MPLS core.
A single global table with only private RFC1918 addresses for SCADA does not isolate routing; private addressing in one table still shares the control and forwarding plane. PortFast edge mode on routed interfaces does not separate control planes or create routing tables—PortFast is an STP edge feature. VTP pruning between SCADA and corporate VLANs only limits flooded VLAN traffic on trunks; it does not create VRF separation.
Exam caveat: VRF-lite still needs careful interface assignment, per-VRF routing, and controlled leaking only where shared services require it; overlapping addresses are allowed across VRFs but break if accidentally merged. Operational check: place SCADA and corporate interfaces in distinct VRFs, confirm separate routing tables, verify no unintended leak, and test that SCADA cannot reach corporate prefixes except through approved shared-service paths.