A small to medium-sized enterprise customer has a campus network that consists of 10GE and 40GE wired links with an Internet access link of 1GE to the service provider. The network connects to the Int

Question

Options

• Aat the data center
• Bin the core layer
• Cin the WAN
• Dat the Internet gateway
• Eat theaccess layer

• A
  2% (1)
• B
  5% (3)
• C
  8% (5)
• D
  83% (49)
• E
  2% (1)

Explanation

The requirement is to monitor traffic leaving the customer network, generated by staff. The optimal DPI placement is at the Internet gateway [D] for the following reasons:

1. Natural choke point: All outbound staff traffic must pass through the 1GE Internet uplink before reaching the service provider. This single bottleneck is the ideal inspection point.
2. Bandwidth efficiency: The Internet link is 1GE - significantly lower than the internal 10GE/40GE links. DPI hardware/software processes far less traffic here, reducing cost and performance impact.
3. Redundant firewalls are already here: The Internet gateway already houses security infrastructure, making DPI a natural co-location.

Why not the other options:

• Core layer [B]: Internal core links are already saturated (10GE/40GE); adding DPI processing increases congestion. Also captures internal east-west traffic unnecessarily.
• Access layer [E]: Many distributed switches make DPI deployment expensive and complex; not a practical single point of inspection.
• Data center [A]: Does not capture outbound staff traffic originating from campus endpoints.
• WAN [C]: The WAN is the service provider's domain - outside the customer's administrative control.

No community discussion yet for this question.