Question 580
A hub-and-spoke enterprise VPN should prevent direct spoke connectivity. Observed: Two spoke sites unexpectedly exchange routes without the central hub. Which change-acceptance control is most relevant to preventing this exact failure?
Explanation
Correct Answer
The control is specific to the initial failure. It requires the result Spokes communicate through the hub without direct route import between spokes. and treats Two spoke sites unexpectedly exchange routes without the central hub. as a failure signal. The causal concern is spoke import/export rt policy grants direct spoke route membership.
Incorrect Answers
It is valid for another service scenario but checks the new vrf learns only one existing site after provisioning. This case instead needs a gate for two spoke sites unexpectedly exchange routes without the central hub and evidence that spokes communicate through the hub without direct route import between spokes.
The proposed control is tied to site-of-origin extended-community filtering is missing and can cause routing feedback, typically observed when both PEs advertise the same CE prefix with inconsistent site-of-origin tags. Here the target is spoke import/export rt policy grants direct spoke route membership; monitor spokes communicate through the hub without direct route import between spokes.
This gate monitors a different failure, a customer subnet is absent on the far side while local sites exchange correctly. It would not detect the current problem: Two spoke sites unexpectedly exchange routes without the central hub. The appropriate check requires spokes communicate through the hub without direct route import between spokes.