A hospital campus deploys IP phones that mark voice with DSCP EF, user PCs daisy-chained through phones, and wireless guest traffic arriving at access switches. Nurses report choppy voice during backup windows and guest bursts. Which classification and marking design at the trust boundary best protects voice quality?
Select an answer to reveal the explanation.
Short Explanation
You have to check IDs at the front door here. Conditional trust of the phone while resetting PC markings keeps voice pristine, like letting staff badges through but re-screening visitors.
Full Explanation
The correct design places the trust boundary at the access edge where untrusted domains first enter, conditionally trusting DSCP EF only from the phone voice VLAN or voice queue while remarking daisy-chained PC traffic to default on ingress and separately policing and remarking guest wireless to default or scavenger, which preserves legitimate voice marking without allowing spoofed priority to enter queuing and ensures priority queuing and policers actually protect voice during backup windows and guest bursts. Extending trust to the phone plus daisy-chained PC fails by trust scope because PCs and backup clients can set EF either intentionally or by default, allowing bulk data to hijack the priority queue and directly cause choppiness despite correct phone marking. Honoring PC DSCP while conditionally trusting phone voice fails by ingress remarking because preserving end-to-end signaling for business applications sacrifices boundary enforcement, so backup bursts contend with voice for priority bandwidth and guest bursts remain uncontrolled at ingress. Establishing trust at distribution uplinks fails by boundary placement because markings have already consumed access buffers and scheduler decisions, so spoofed or bursty traffic impacts voice before central policy can remark or police it. Exam caveat is to not confuse centralized classification for configuration simplicity or wireless mobility with effective trust, as effective trust requires remarking and policing before queuing at first ingress. Practical check is to verify with show mls qos interface and show policy-map interface that only voice VLAN EF is trusted, PC data arrives as DSCP 0, guest traffic is rate-limited and remarked, and priority-queue drops remain near zero during a simulated backup and guest load test.