A city data center hosts Parks recreation apps and Police records apps that must not share broadcast or routing tables. Which design best delivers tenant traffic isolation for both Layer 2 and Layer 3?
Select an answer to reveal the explanation.
Short Explanation
Picture two city departments sharing a building but needing separate hallways and elevators. Parks and Police each get their own L2 VNI/VLAN so broadcasts stay local, plus their own VRF so routes never mix. Host firewalls alone are like sticky notes on an unlocked door—they help, but they are not tenant isolation.
Full Explanation
In EVPN-VXLAN municipal fabrics, tenant isolation is enforced with separate Layer 2 domains (VLAN/VNI/bridge-domain) and separate Layer 3 contexts (routing instances/VRFs). That combination prevents ARP/broadcast crossover and route-table mixing between Parks and Police. Shared VLANs, a single VNI, or stuffing both tenants into inet.0 collapses isolation. Junos multitenancy for JN0-683 starts with these L2 and L3 boundaries.