300-420 Exam Dumps : Designing Cisco Enterprise Networks (ENSLD) v1.1

The correct solution is a management VRF with SSH keys for device access. A management VRF creates a separate routing and forwarding table for management traffic, keeping administrative reachability isolated from production and overlay routes. That directly satisfies the requirement that the overlay network must not cause routing issues and makes troubleshooting easier for operations teams because management reachability can be validated independently. Cisco VRF design uses separate routing tables to isolate traffic and can support overlapping addresses or independent routing policy. For secure device access, SSH with key-based authentication provides encrypted administrative sessions and stronger authentication than clear-text or password-only methods. Private VLANs and ordinary VLANs provide Layer 2 separation but do not create independent routing tables. TACACS+ and RADIUS are AAA systems; they are useful but do not define the management transport architecture. Separate physical interfaces can be useful out-of-band, but the best match for overlay isolation and operational simplicity is management VRF plus SSH keys. Reference topics: management VRF, secure device access, SSH public-key authentication, routing-table isolation, enterprise management design.

Route leaking on R13 and R9 is required so the Level 1 area can make a better exit decision toward the server. In an IS-IS hierarchy, Level 1 routers know detailed topology only inside their own area. For destinations outside the area, they normally follow the closest attached Level 1/Level 2 router, which can produce suboptimal latency when another exit has a better end-to-end path. Route leaking selectively injects more specific Level 2 reachability information into Level 1, allowing routers in the New Office area to evaluate a better path instead of blindly following the nearest attached-bit exit. Changing metric style on R8 alone does not import the external-area route information needed for better path selection. A static route could force a path but would not be a scalable dynamic IS-IS design. Making R8 Level 1/Level 2 does not solve the need to expose the relevant route through the correct area boundary. Reference topics: IS-IS Level 1 and Level 2, attached bit, route leaking, interarea optimization, latency-aware routing.

Cisco SD-Access uses virtual networks as macro-segmentation boundaries, and those VNs are represented as VRF instances in the fabric. By design, separate VNs do not communicate directly inside the overlay unless the design introduces controlled inter-VN routing. Cisco SD-Access designs commonly use an external fusion router, firewall, or shared-services device to map fabric VNs to external VRFs and selectively exchange routes between them. That is the correct design because it preserves segmentation while allowing policy-controlled access to shared resources or selected networks. GRE tunnels between fabric edges are not the normal SD-Access inter-VN communication method and would bypass the intended fabric policy model. Security Group Tags provide microsegmentation within or across policy domains, but SGTs do not by themselves leak routes between separate virtual networks. Route leaking on fabric border nodes is not the recommended standalone answer here because inter-VN communication is normally provided through a fusion device or firewall outside the fabric. Therefore, the correct solution is external fusion routing with controlled VRF route exchange.