A municipal multitenant data center can stretch Layer 2 to a remote site for one agency but must not offer that stretch to others. What isolation principle applies?
Select an answer to reveal the explanation.
Short Explanation
Think of stretch like a VIP skybridge: you build it for the agency that paid for it, not for every office in the building. Multitenancy is not only separate VRFs—it is also which overlay services (including L2 DCI stretch) each tenant is allowed to use.
Full Explanation
A municipal multitenant data center that can stretch Layer 2 to a remote site for one agency but must not offer that stretch to others illustrates that tenant isolation includes controlling which DCI or L2-stretch features each tenant receives. Multitenancy is not only separate VRFs—it is also which overlay services and stretch options each civic department is allowed to consume.
Any leaf that supports VXLAN must stretch every VNI to every remote PE is false; stretch is provisioned per VNI/tenant service, not as an all-or-nothing leaf capability. Stretch is not merely an underlay OSPF knob that cannot be applied per tenant. Once EVPN is enabled, tenants do not automatically inherit identical DCI options; operators choose which instances and VNIs participate in stretch.
Exam caveat: feature enablement at the fabric level is not the same as per-tenant service entitlement—exam stems often test that distinction.
Operational check: inventory which VNIs/RTs are exported toward the remote PE, confirm only the authorized agency appears in the stretch, and verify other agency VNIs have no remote Ethernet A-D or IMET membership for that DCI. Also compare stretch RT export policy on both DCI edges after each change so a template copy-paste does not quietly extend Parks stretch to Courts.