Transit and water departments share Spectrum-X leaf switches but must not see each other’s AI VRFs. Which approach provides that isolation?
Select an answer to reveal the explanation.
Short Explanation
Transit trains and water pumps can share the same Spectrum-X rails without sharing the passenger manifest—BGP-EVPN VRFs keep each department’s AI routes private. A shared EVPN instance with distinct VLAN tags won't isolate you, because VLAN tags split broadcast domains, not tenant routing tables.
Full Explanation
Transit and water departments can share Spectrum-X leaf switches for municipal AI Ethernet capacity while remaining logically isolated. The correct approach is BGP-EVPN with separate VRFs so each department’s AI fabric overlay stays in its own tenant. EVPN carries tenant-specific routes with route distinguishers and targets that prevent transit training or inference prefixes from being imported into the water VRF unless operators deliberately allow it. Shared leaf hardware and underlay ECMP do not imply shared L3VPN tables; that is the point of Spectrum multi-tenancy for civic fabrics.
Advertising both departments in a shared EVPN instance using distinct VLAN tags for traffic separation fails because VLAN tags only segment L2 broadcast domains inside one EVPN instance; they do not create separate VRFs, so transit and water AI prefixes remain visible to each other. Placing each department in a separate VRF while exporting EVPN Type-2 routes through a common border VRF also fails—the shared border VRF can import and forward prefixes between tenants, so the departments are not truly isolated. Enabling Spectrum-X adaptive routing with a shared RoCE profile to balance department traffic also fails because adaptive routing and RoCE profiles optimize path selection and lossless forwarding but do not create VRF boundaries, leaving transit and water AI traffic in the same shared routing context.
Exam caveat: separate VRFs isolate control- and data-plane reachability between tenants; they do not replace host hardening, encryption policy, or out-of-band management controls that cities still need for regulated workloads. Operational check: on a shared Spectrum-X leaf, show per-VRF EVPN routes for transit and water, confirm non-overlapping route targets, attempt a controlled negative reachability test between a transit GPU and a water GPU address, and archive the VRF policy snippets used for municipal audit trails.