A security team bans Layer-2 stretch for a PCI segment between city data centers. Which policy-driven DCI choice follows?
Select an answer to reveal the explanation.
Short Explanation
When compliance says "no L2 stretch for PCI," the DCI answer is L3-only for that tenant. Keep the sensitive broadcast domain site-local.
Full Explanation
When security bans Layer-2 stretch for a PCI segment between city data centers, policy-driven design uses L3-only DCI for that sensitive tenant so the broadcast domain stays site-local while IP reachability still works across sites. Stretching the PCI VLAN anyway and relying on storm control alone for compliance violates the ban. Placing PCI endpoints in the underlay ASN to bypass tenant isolation is unsafe. Disabling EVPN entirely and bridging PCI frames as native Ethernet on the Internet is unacceptable. Exam caveat: L3 DCI must still meet encryption and segmentation controls the PCI program requires—stretch mode is only one control among many. Operational check: configure Type-5/L3 DCI for the PCI VRF, prove no L2 VNI stretch exists for that segment, capture absence of inter-site ARP, and attach the evidence to the municipal compliance package. Store L3-only PCI DCI evidence—including no L2 stretch proof—with the compliance package for each audit cycle. Store L3-only PCI DCI evidence—including no L2 stretch proof—with the compliance package for each audit cycle. Store L3-only PCI DCI evidence—including no L2 stretch proof—with the compliance package for each audit cycle. Store L3-only PCI DCI evidence—including no L2 stretch proof—with the compliance package for each audit cycle.