A bank with 120 branches needs any-to-any connectivity and strict traffic separation for branches and partners, and security policy mandates customer-controlled end-to-end encryption and direct Internet backup. The carrier offers a managed MPLS L3VPN with its own routing and no encryption. Which enterprise VPN comparison best guides the choice between MPLS L3VPN and overlay VPN?
Select an answer to reveal the explanation.
Short Explanation
Riding the carrier's private train is comfy until you need your own locks. Overlay VPN puts encryption keys in your hands across any road, with control-plane ownership as the payoff. MPLS L3VPN leaves routing and secrecy with the provider.
Full Explanation
The correct selection is overlay IPsec VPN because it keeps encryption keys and policy under customer control to provide true end-to-end confidentiality independent of underlay trust, while the same encrypted overlay can traverse both carrier MPLS and direct Internet to deliver any-to-any reachability, logical separation, and mandated backup without depending on provider routing. The carrier MPLS L3VPN with VRF separation plus Internet backup correctly handles any-to-any connectivity, strict isolation via provider VRFs, and resilience, yet it fails by concept because VRF separation is isolation without cryptography and the stem states the carrier offers no encryption, so the customer-controlled encryption mandate remains unmet. The private GETVPN over MPLS core correctly offers efficient any-to-any encryption with centralized group key management and traffic separation, yet it fails by concept because it is tied to the private core and provider routing and cannot independently use the Internet as a transport, violating the direct backup and transport-independence requirement. The hub-and-spoke overlay via headquarters correctly provides customer-controlled encryption, segmentation, and Internet use, yet it fails by concept because forcing all branch traffic through a central hub replaces direct any-to-any paths with hairpinned tromboning, adding latency and a single choke point contrary to the requirement. Exam caveat is to separate isolation from encryption and underlay routing from overlay routing, since VRFs, GETVPN scalability, and central inspection can appear complete while missing one explicit policy word. Practical check is to verify key ownership and cipher suite, fail over encrypted tunnels between MPLS and Internet with branch-to-branch tests, and capture traffic on both transports to prove ciphertext and VRF isolation end to end.