A shared-services tenant hosts DNS and directory servers that selected agencies must reach without opening full mesh connectivity. Which pattern fits?
Select an answer to reveal the explanation.
Short Explanation
Shared services are the city mailroom: agencies get a controlled window, not master keys to each other's offices. Leak or extranet only what DNS/directory need—never full-mesh every VRF into every other VRF just to make ping pretty.
Full Explanation
When a shared-services tenant hosts DNS and directory servers that selected agencies must reach without opening full-mesh connectivity, the fitting pattern is deliberate, least-privilege inter-tenant connectivity to the shared-services VRF only. Agencies get a controlled window to the civic mailroom, not master keys to each other's offices, which preserves multitenancy while still enabling common city services.
Importing every agency VRF into every other agency VRF to simplify troubleshooting creates a full-mesh leak nightmare and defeats isolation. Disabling all route targets so shared services are reached via broadcast only is nonsensical for L3 services and breaks EVPN RT discipline. Placing shared services in the underlay IGP so overlay isolation no longer applies punches a hole under the overlay model.
Exam caveat: shared services are an extranet/least-privilege design problem, not an excuse for fabric-wide route merging.
Operational check: allow only required shared-services prefixes into each agency VRF (or controlled reverse), confirm agency-to-agency prefixes remain absent, and test DNS reachability without lateral tenant routes. Re-test after RT changes that DNS works while a Parks host still cannot open a Transit prefix learned from a leaked full-mesh policy.