Health and Finance each have separate VRFs, but an engineer adds a broad route-leak policy that imports Finance prefixes into Health. What is the main multitenancy risk?
Select an answer to reveal the explanation.
Short Explanation
Separate VRFs are the locked filing cabinets; a sloppy leak policy is leaving the keys on the counter. Once Finance routes appear in Health, Layer 3 isolation is gone even if the instance names still look tidy. Leaks are fine when deliberate and least-privilege—not when they are copy-paste accidents.
Full Explanation
Health and Finance already have separate VRFs, which is the correct L3 isolation starting point, but a broad route-leak policy that imports Finance prefixes into Health creates the main multitenancy risk: uncontrolled route leaking can defeat Layer 3 tenant isolation between the VRFs. Once Finance routes install in Health, Health workloads can forward toward Finance destinations as if the cabinets were unlocked—even though the instance names still look separate on paper.
VXLAN UDP ports renegotiating and dropping underlay BFD sessions is unrelated control-plane mythology; route leaks do not rewrite VXLAN UDP behavior that way. EVPN Type-2 routes stopping because RTs must be identical globally confuses RT policy with a false global-identity rule and does not describe the leak risk. IRB MTU automatically shrinking below 1500 on every leaf is not a consequence of importing routes between tenant VRFs.
Exam caveat: separate VRFs only isolate what you do not leak; exam items often test that a careless import/export policy quietly undoes multitenancy.
Operational check: show route table for Health before and after the leak policy, confirm Finance prefixes are absent unless an approved least-privilege extranet exists, and review RT import lists so only explicitly blessed shared-services routes ever cross.