Health and Finance each have separate VRFs, but an engineer adds a broad route-leak policy that imports Finance prefixes into Health. What is the main multitenancy risk?
Select an answer to reveal the explanation.
Short Explanation
Separate VRFs are the locked filing cabinets; a sloppy leak policy is leaving the keys on the counter. Once Finance routes appear in Health, Layer 3 isolation is gone even if the instance names still look tidy. Leaks are fine when deliberate and least-privilege—not when they are copy-paste accidents.
Full Explanation
L3 tenant isolation depends on independent routing tables. Importing another tenant's prefixes via route leaking (or overly broad RTs) creates reachability that policy intended to forbid. That is an isolation breakage, not an underlay BFD, Type-2, or MTU problem. Controlled extranet or shared-services leaks must be explicit, minimal, and reviewed—not accidental interconnects between Health and Finance.