A school district needs classroom egress to traverse an inspection path before reaching the internet. Which virtual-network role should automation place in that path?
Select an answer to reveal the explanation.
Short Explanation
Picture egress like school buses that must pass the checkpoint before the highway—the router or NVA is that forced turn. Automation should steer district outbound traffic through the inspection path, not spray it straight to an unfiltered exit. No-default-route lockdowns just strand classrooms when they need controlled internet.
Full Explanation
School-district classroom egress that must traverse an inspection path needs a router or network virtual appliance (NVA) in the forwarding path to steer traffic through that inspection service before internet breakout. Routers and NVAs implement routing policy, user-defined routes, or service chaining so outbound flows are forced through proxies, firewalls, or secure web gateways rather than taking an unfiltered default exit. Automation should place and maintain that steering role so classroom traffic consistently hits inspection regardless of which classroom VLAN originated the session.
A public recursive resolver with no filtering as the only hop fails because DNS resolution alone does not inspect or constrain general IP egress, and an unfiltered resolver actively undermines content and threat controls. Hairpinning all classroom traffic through student Chromebooks fails on architecture: endpoints are not a governed district inspection plane, and peer hairpinning is neither scalable nor policy-authoritative. Removing default routes so classrooms cannot leave the LAN at all fails the requirement to reach the internet via an inspection path—it blocks egress instead of steering it.
Exam caveat: inspection can be a physical appliance, virtual NVA, or cloud security service; the exam concept is forced steering through that path via routing/NVA placement, not the vendor product name.
Operational check: from a classroom test host, confirm outbound sessions traverse the inspection hop (path, logs, or tunnel counters), verify policy denials appear when blocked categories are tested, and ensure route tables still provide a default or service route via the NVA rather than an bypass default to raw internet.