City security reviewers fear ZTP means switches will pull unauthenticated configuration from anywhere on the Internet. Which description best reflects ZTP’s trust boundary in a Juniper DC design?
Select an answer to reveal the explanation.
Short Explanation
ZTP is not “download config from the open Internet”—it is more like a badge-gated warehouse on the city management LAN. Reviewers should focus on locking down DHCP and the file server the leaves are pointed to. Controlled provisioning paths beat fear of random Internet grabs.
Full Explanation
ZTP’s trust boundary in a Juniper DC design still depends on controlled DHCP and file-server paths on the intended management network, not arbitrary Internet pulls. City security review should focus on scoping and hardening those civic management services. Requiring public CDN downloads with no local controls describes an unsafe anti-pattern, not a sound municipal ZTP boundary. Claiming ZTP disables all management-plane ACLs until first commit invents a blanket bypass that is not the defining model. Requiring unrestricted outbound HTTPS from every data-plane VLAN confuses data-plane openness with management provisioning reachability. Exam caveat: Weak DHCP/file-server design creates the risk reviewers fear; the existence of ZTP does not require open Internet config fetching. Operational check: Map provisioning VLANs/VRFs and file-server ACLs; confirm untrusted data-plane VLANs cannot reach municipal ZTP artifacts. In civic data-center practice, treat the correct concept as part of a controlled management design rather than an isolated checkbox, and document the expected show-command or log evidence so the next on-call engineer can prove the fabric behavior without re-deriving the theory under pressure.