A manufacturer runs dual transports with MPLS for voice and internet for bulk data. Voice from VPN 10 must stay on MPLS TLOCs with EF marking, guest traffic must be forced to VPN 20, and malware flows must be blocked. Which data policy action set should the engineer configure to meet all three needs?
Select an answer to reveal the explanation.
Short Explanation
You're acting like a traffic cop with three different whistles. Local TLOC steering plus DSCP and VPN actions covers path, marking and segmentation in one policy.
Full Explanation
The correct action set aligns with the three stated intents: pinning voice to MPLS via local TLOC preference preserves transport determinism for latency-sensitive traffic while remarking to DSCP EF maintains end-to-end expedited forwarding for queuing on underlay and overlay, forcing guest into VPN 20 enforces Layer-3 segmentation and dedicated DIA pathing for untrusted users, and applying drop to confirmed malware enforces silent discard that satisfies the block requirement. The variant using AF41 for voice is operationally sound for multimedia but fails the explicit marking requirement because AF41 belongs to the assured-forwarding video class with different drop precedence and PHB, so EF-dependent priority queues for voice would not trigger. The variant directing guest to VPN 10 is otherwise correct on QoS and security but violates segmentation by merging untrusted guest flows into the voice VPN, breaking route separation and compliance boundaries. The variant using mirror for malware is common for IDS inspection and forensics but fails enforcement because mirroring forwards a copy for analysis while still permitting the original flow, whereas containment requires discard. As an exam caveat, distinguish steering and marking from policing and logging, since only local TLOC plus DSCP controls path and per-hop behavior. As a practical check, verify with policy simulation that voice hits MPLS TLOCs with EF, guest routes via VPN 20 and malware counters increment drop.