A city data center hosts Parks recreation apps and Police records apps that must not share broadcast or routing tables. Which design best delivers tenant traffic isolation for both Layer 2 and Layer 3?
Select an answer to reveal the explanation.
Short Explanation
Picture two city departments sharing a building but needing separate hallways and elevators. Parks and Police each get their own L2 VNI/VLAN so broadcasts stay local, plus their own VRF so routes never mix. Host firewalls alone are like sticky notes on an unlocked door—they help, but they are not tenant isolation.
Full Explanation
On a municipal EVPN-VXLAN fabric, tenant traffic isolation for both Layer 2 and Layer 3 is delivered by giving each agency its own L2 VNI or VLAN plus a dedicated L3 routing instance or VRF. Parks recreation and Police records therefore keep separate broadcast domains and separate routing tables, so ARP floods and tenant prefixes never share a common civic forwarding context. That dual boundary is the describe-level multitenancy pattern Juniper fabrics use when departments must not see each other's east-west traffic.
Putting both apps on the same VLAN and relying on host firewalls fails the L2 isolation concept: a shared broadcast domain still lets ARP and flooded frames cross even if hosts try to filter later. Stretching one shared VXLAN VNI across both agencies and filtering only at the Internet edge leaves an intra-fabric L2 party line; edge filters do not stop department-to-department overlay chatter. Merging both agencies into inet.0 so operators can see every prefix in one table collapses L3 isolation by design and mixes civic route policy.
Exam caveat: host firewalls and Internet-edge ACLs are useful defenses, but they are not substitutes for per-tenant L2 domains and VRFs on the JNCIP-DC exam narrative.
Operational check: on a Parks leaf and a Police leaf, confirm distinct VNI/bridge-domain and routing-instance bindings, then verify Parks ARP never appears in the Police MAC table and Parks prefixes never install in the Police VRF before declaring isolation complete.