A shared-services tenant hosts DNS and directory servers that selected agencies must reach without opening full mesh connectivity. Which pattern fits?
Select an answer to reveal the explanation.
Short Explanation
Shared services are the city mailroom: agencies get a controlled window, not master keys to each other's offices. Leak or extranet only what DNS/directory need—never full-mesh every VRF into every other VRF just to make ping pretty.
Full Explanation
Shared-services designs intentionally relax isolation in a least-privilege way: specific route imports, RTs, or firewall paths toward the shared-services tenant, not unrestricted inter-tenant meshes. Putting shared apps in the underlay or relying on broadcast undermines overlay multitenancy. Controlled exceptions remain exceptions—documented and minimal.