Public works places IoT meter prefixes in a VRF that must not reach finance subnets by default. Which VRF property supports that outcome?
Select an answer to reveal the explanation.
Short Explanation
Separate VRF tables start like sealed rooms—IoT meters and finance do not wander into each other's hallways unless you unlock a door on purpose. That default isolation is half the reason you bothered with VRFs.
Full Explanation
Public works placing IoT meter prefixes in a VRF that must not reach finance subnets by default relies on a core VRF property: separate VRF routing tables do not share routes by default. IoT and finance therefore remain isolated on shared civic routers until explicit leaking or import/export is configured. That default non-sharing is what supports keeping meter prefixes out of finance routing without depending on NAT myths or hoping operators never mistype. All VRFs do not share one global RIB unless a hypervisor Type 2 license is installed—that invents a license dependency and denies default isolation. VRFs do not always redistribute into each other whenever OSPF is enabled anywhere; OSPF inside a VRF stays in that VRF unless policy redistributes or leaks across. IoT VRFs do not automatically prefer finance defaults through recursive GRE resolution; that is not a VRF default property. Exam caveat: default isolation is configuration-dependent over time—someone adding a static leak, mutual redistribution, or shared-global interface can silently reconnect IoT meters to finance. Operational check: confirm IoT and finance VRFs on public-works routers show disjoint RIBs, attempt reachability from meter prefixes to finance (should fail), and alert on any new inter-VRF route-target or redistribute statements in change control.