A logistics firm runs headquarters plus 30 distribution centers over MPLS. Cisco phones on voice VLAN advertise via CDP, scanners and BYOD share data VLANs with random markings, and the provider honors only four DSCP classes on ingress. Which classification and marking design establishes correct trust boundaries for end-to-end QoS?
Select an answer to reveal the explanation.
Short Explanation
You're the bouncer who only honors VIP stamps from known staff. Keeping conditional trust for phones at the access edge stops scanners and laptops from sneaking into the voice queue, while remapping at egress speaks the provider's language.
Full Explanation
End-to-end QoS depends on moving the trust boundary to the closest point where markings can be verified, then preserving that decision upstream. Conditional trust at the access port verifies Cisco phones via CDP on the voice VLAN and trusts their CoS to DSCP mapping while explicitly resetting data VLAN traffic to default and classifying it by ACLs, which prevents untrusted scanners and BYOD devices from injecting high-priority DSCP that would steal priority queuing. At the enterprise WAN egress a second boundary remaps the detailed internal DSCP values into the four classes the provider honors, so EF voice and critical data survive without drops or provider-initiated re-marking. Trusting DSCP on every access port fails because it extends trust to untrusted devices and passes incompatible values to the provider. Performing all classification centrally at the WAN edge fails because spoofed markings already consumed campus queuing resources and congested uplinks before correction. Trusting uplinks while resetting all markings to default at egress fails because it destroys legitimate voice markings and places queuing on meaningless values, breaking priority handling.