A lab leaf uses DHCP on a production management VLAN and pulls a production configuration. What design control best prevents this failure mode?
Select an answer to reveal the explanation.
Short Explanation
Lab gear on the production DHCP lane is like a trainee grabbing the live city playbook. Keep lab and production provisioning domains separate so a lab leaf cannot lease production options and configs. Segregation beats hoping nobody notices.
Full Explanation
Isolate lab and production DHCP provisioning domains so a lab leaf on the wrong VLAN cannot obtain production ZTP artifacts and pull live city configs. Advertising lab MACs into production EVPN enlarges blast radius instead of containing it. Identical DHCP options in lab and production make accidental production pulls more likely. Disabling DHCP logging hides mistakes rather than preventing them. Exam caveat: Separate scopes, VLANs/VRFs, and file repositories are the primary control—not hope and tribal knowledge. Operational check: Place a lab leaf on lab-only provisioning services and confirm it cannot resolve or fetch production role files. In civic data-center operations, record the expected CLI or collector evidence for this concept so the next on-call engineer can validate fabric behavior without re-deriving the design under incident pressure. In civic data-center operations, record the expected CLI or collector evidence for this concept so the next on-call engineer can validate fabric behavior without re-deriving the design under incident pressure. In civic data-center operations, record the expected CLI or collector evidence for this concept so the next on-call engineer can validate fabric behavior without re-deriving the design under incident pressure.