An auditor asks for proof that Parks servers cannot ARP Courts servers across the municipal fabric. Which verification concept matters most for Layer 2 isolation?
Select an answer to reveal the explanation.
Short Explanation
Auditors love simple pictures: different VNIs means Parks ARP never rings the Courts doorbell. If they share an L2 domain, no amount of matching OSPF metrics will satisfy that ARP question. Show separate L2 domains—then sleep well.
Full Explanation
When an auditor asks for proof that Parks servers cannot ARP Courts servers across the municipal fabric, the Layer 2 isolation verification that matters most is showing that tenants use separate L2 domains or VNIs so ARP and broadcasts do not cross. Evidence must speak to the broadcast domain boundary, not to unrelated underlay symmetry, because ARP isolation is an L2 property.
Confirming that both tenants share one VNI so MAC tables stay synchronized is proof of the opposite of isolation. Proving OSPF metrics on spines are identical for both tenants is an underlay ECMP hygiene check that does not address ARP crossover. Demonstrating DHCP relay disabled globally on all IRB interfaces may matter for DHCP design but does not prove ARP isolation between agencies.
Exam caveat: match the verification artifact to the isolation layer named in the stem—L2 proof needs domain/VNI separation evidence.
Operational check: document distinct VNI/bridge-domain IDs, capture Parks ARP, and show zero Courts reception; optionally clear MAC tables and confirm no cross-tenant MAC learning before closing the audit item. Retain the packet capture and VNI mapping screenshots with the audit ticket so re-certification does not restart from anecdotes.