Emergency-management sensitive models run on InfiniBand HCAs that must not see every partition. What should operators do?
Select an answer to reveal the explanation.
Short Explanation
You don't protect high-sensitivity civic workloads with service levels or bandwidth caps — those just manage traffic priority, not who can reach whom. Restrict PKey membership so those HCAs can't see partitions they shouldn't.
Full Explanation
Emergency-management sensitive models on InfiniBand HCAs that must not see every partition require restricted InfiniBand PKey membership. Least-scope membership limits which partitions those HCAs can join so high-sensitivity civic workloads cannot reach unrelated tenant domains on the shared fabric. Enforcing InfiniBand Service Level differentiation for civic workload isolation fails by concept: SLAs manage traffic priority and congestion, not partition visibility, so sensitive HCAs can still see unrelated fabric domains unless PKey membership is restricted. Enabling IPoIB connected mode on sensitive HCAs for isolation fails because IPoIB is an IP encapsulation layer over InfiniBand; it does not restrict which partitions an HCA can join and leaves fabric-level reachability intact. Applying InfiniBand bandwidth quotas to sensitive civic HCA traffic fails because rate limits throttle throughput but do not limit partition membership or block RDMA paths to unrelated tenants. Exam caveat: NCP-AIN multi-tenancy security emphasizes restricting PKey membership for sensitive workloads rather than relying on service-level differentiation, IPoIB connected mode, or bandwidth quotas for isolation. Operational check: enumerate PKeys on the emergency-management HCAs, remove nonessential memberships, verify required civic partitions still work, and confirm RDMA to unrelated agency partitions fails.