An airport authority isolates department networks across a shared county MPLS core. Which architecture provides that separation?
Select an answer to reveal the explanation.
Short Explanation
One shared core, many locked departmental drawers—that’s L3VPN. Each department gets a VRF on the PEs while P routers stay label-switchers in the middle. ACLs in one big table aren’t the same as real VPN separation.
Full Explanation
MPLS L3VPN isolates airport-authority department networks using per-department VRFs on PE routers while P routers forward labeled traffic without holding VPN routes. That architecture lets departments share a county MPLS core without merging routing tables, providing scalable separation beyond what ACLs in one global table can sustain.
A single global routing table on every PE with ACLs alone for isolation does not provide equivalent VPN-scale separation and operational boundaries. Transparent bridging of all departments into one VLAN across the core collapses L3 isolation entirely. Policy-based routing on P routers that rewrites destination MACs is not how MPLS VPN separation is built and misunderstands P-router roles.
Exam caveat: VRFs plus RD/RT and labeled transport are the scalable model; ACL-only global tables are a common distractor that fails at scale and clarity.
Operational check: confirm each department maps to its VRF on the PEs, verify P routers lack VRF state, test inter-department isolation, and document RD/RT policy for the airport VRFs. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.