During GBP design review, stakeholders debate default deny between groups versus default allow with explicit denies. What should the team recognize about that choice?
Select an answer to reveal the explanation.
Short Explanation
Zero-trust folks usually lock every interior door then hand out keys (default deny). Open-floor folks leave doors unlocked and post a few “keep out” signs (default allow). GBP lets the city pick that posture on purpose—it is not hard-wired by VXLAN.
Full Explanation
During GBP design review, when stakeholders debate default deny between groups versus default allow with explicit denies, the team should recognize that default deny versus default allow between groups is a deliberate GBP security posture decision. Cities choose whether unknown inter-group relationships fail closed with explicit allows, or remain permissive until explicit denies are written; that choice drives residual risk for cameras, payment, and agency tiers. The default posture is not fixed by VXLAN and cannot be dismissed as a non-decision—VXLAN encapsulation does not dictate group default behavior. Default allow is not mandatory because EVPN cannot signal deny results; GBP policy can express deny as well as allow outcomes for overlay group relationships. Default deny also is not limited to underlay BGP and never to overlay groups; the debate here is specifically about overlay GBP posture. Exam caveat: treat inter-group default posture as an intentional security design control on JNCIP-DC style questions. Operational check: document the municipality’s chosen default (prefer default deny for zero-trust civic fabrics), implement a small allow list between approved groups in the lab, verify an undocumented pair fails, and capture that evidence for the security architecture review.