A city GPU fabric hosts public-health and permitting tenants on the same Spectrum-X underlay. How should operators isolate those tenant AI workloads?
Select an answer to reveal the explanation.
Short Explanation
Think of BGP-EVPN like separate civic office wings on one campus—same Spectrum-X building, different locked corridors. Give public-health and permitting their own overlays so their AI workloads do not wander into each other’s space.
Full Explanation
When a city GPU fabric hosts public-health and permitting tenants on the same Spectrum-X underlay, isolation must be enforced in the overlay control plane, not hoped for through shared Layer-2 habits. BGP-EVPN multi-tenancy is the Spectrum-aligned mechanism that keeps each tenant’s Ethernet overlay isolated while still sharing the same high-performance underlay. Separate VRFs, route distinguishers, and carefully scoped route targets ensure public-health AI prefixes are not imported into the permitting tenant and vice versa. That preserves confidentiality, blast-radius limits, and independent change windows for civic agencies that must not see each other’s models or datasets.
Provisioning a shared EVPN VNI with distinct route targets for tenant prefixes fails by concept: one shared VNI still collapses the tenant overlay boundary, and route targets alone cannot prevent cross-tenant reachability or leakage within that common VNI. Applying Spectrum-X adaptive routing with per-tenant PFC priorities on shared fabric queues similarly fails; adaptive routing and PFC are traffic-engineering tools, not multi-tenant security boundaries, and shared fabric queues do not keep tenant workloads apart. Mapping tenants to separate VLANs with jumbo MTU for RoCE traffic separation also misses the requirement; VLANs and MTU settings are Layer-2 transport details, not an EVPN overlay control plane, so they do not enforce the tenant isolation the city needs.
Exam caveat: BGP-EVPN isolation is only as strong as route-target policy and VRF membership; a later mis-export can reopen leakage even if the initial design was correct. Operational check: after onboarding, verify from a public-health GPU host that permitting tenant prefixes are absent from the local VRF, confirm NetQ or EVPN show commands list distinct tenants, and document route-target import/export for both agencies so city operators can re-validate isolation after every EVPN change.