Question 680
A managed services provider requires access to VPN routes for a security inspection node. Observed: One tenant bypasses inspection due to a direct imported route. What operational check best guards against this problem returning?
Explanation
Correct Answer
This control asks for the same recovery evidence (Allowed tenant traffic traverses the inspection service with symmetric return paths) and flags recurrence of the same failure (One tenant bypasses inspection due to a direct imported route). It targets the underlying issue, rt policy permits an alternate direct path that avoids the approved service chain, rather than a different service problem. The exact cadence must be agreed with operations.
Incorrect Answers
The proposed control is tied to the provider path appears less preferable to the direct intra-area backdoor path, typically observed when sham-link connectivity is missing and a customer backdoor link becomes preferred. Here the target is rt policy permits an alternate direct path that avoids the approved service chain; monitor allowed tenant traffic traverses the inspection service with symmetric return paths.
This gate monitors a different failure, core transit traffic starts following a customer internet gateway. It would not detect the current problem: One tenant bypasses inspection due to a direct imported route. The appropriate check requires allowed tenant traffic traverses the inspection service with symmetric return paths.
It is valid for another service scenario but checks the remote pe sees the updated vpnv4 prefix but ce traffic cannot return. This case instead needs a gate for one tenant bypasses inspection due to a direct imported route and evidence that allowed tenant traffic traverses the inspection service with symmetric return paths.