During a county audit, Parks and Transit are discovered on the same VLAN even though policy requires Layer 2 tenant isolation. What is the primary isolation failure?
Select an answer to reveal the explanation.
Short Explanation
Same VLAN means same party line—everyone hears everyone else's ARP. If Parks and Transit share that broadcast domain, Layer 2 tenant isolation is already broken no matter what pretty VRF names you stuck on a slide. Fix the L2 boundary first; underlay timers and RD trivia will not save you.
Full Explanation
During a county audit, discovering Parks and Transit on the same VLAN means the primary Layer 2 tenant isolation failure is a shared broadcast domain that lets ARP and flooded frames cross between departments. VLAN membership defines the civic party line: if both agencies sit on that line, isolation policy is already broken at L2 regardless of how carefully operators tune unrelated underlay knobs.
Wrong answers miss the concept. Only OSPF hello timers being wrong on the underlay spines is an underlay adjacency concern and does not explain L2 tenant crossover on a shared VLAN. Missing BGP route distinguishers from the management VRF is an L3/BGP hygiene topic for a different table, not the broadcast-domain failure the auditor found. Setting MAC aging on the core longer than STP forward delay is a spanning-tree timing discussion and does not restore separate L2 tenant domains.
Exam caveat: when a scenario says “same VLAN,” map it immediately to shared BUM/ARP risk; do not chase underlay IGP or RD distractors first.
Operational check: list VLAN/VNI membership for Parks and Transit endpoints, confirm they are not co-resident in one bridge domain, capture ARP from a Parks host, and prove it never reaches Transit ports before signing the audit finding closed.