Municipal cybersecurity SOC AI traffic must stay isolated from 311 model serving on the same Spectrum-X fabric. What should designers establish?
Select an answer to reveal the explanation.
Short Explanation
SOC AI is the locked evidence room; 311 models are the public lobby—same Spectrum-X building, different EVPN tenants. Draw BGP-EVPN boundaries so sensitive cybersecurity traffic never mixes with resident-service model farms.
Full Explanation
Municipal cybersecurity SOC AI traffic and 311 model serving may share Spectrum-X capacity, but they must not share tenant reachability. Designers should establish BGP-EVPN tenant boundaries that keep sensitive SOC AI workloads in their own tenant away from 311 models. Separate EVPN tenants/VRFs limit lateral movement, protect investigative or detection models and datasets, and allow independent QoS and change policy. On a city Spectrum fabric, multi-tenancy is how shared Ethernet AI underlay coexists with strict civic isolation requirements.
Controlled EVPN route-target leaking between SOC VRF and 311 VRF to enable joint model inference fails by concept: peak civic demand is not a reason to collapse security boundaries, and intentional route-target leaking grants unwanted East-West reachability between SOC and 311. Dedicated SOC VLAN identifiers with separate VNIs inside the common municipal tenant serving 311 models likewise fails—VLAN and VNI separation inside one tenant still leaves SOC workloads reachable from 311 models, so it does not establish the required tenant boundary. Spectrum-X quality-of-service schedules prioritizing sensitive SOC AI flows over 311 serving queues likewise fails—QoS only changes forwarding priority, it does not prevent SOC and 311 reachability or replace tenant-level isolation.
Exam caveat: EVPN tenant boundaries isolate overlay routing; they do not replace identity, encryption, or SOC host controls, and mismanaged route targets can reintroduce leakage later. Operational check: confirm SOC and 311 use distinct VRFs and non-overlapping RT policies, verify SOC GPU addresses are absent from the 311 VRF (and the reverse), and include isolation verification in every Spectrum-X EVPN change affecting either municipal tenant.