Which scope type is used when the subnet address needs to be 'leaked' to a different context or tenant?

Question

Options

• Apublic
• Bshared
• Cinfra
• Dprivate

• A
  3% (1)
• B
  12% (4)
• C
  3% (1)
• D
  82% (27)

Explanation

Private scope is the designated scope type when a subnet address must be "leaked" - that is, made reachable - across VRF contexts or tenants in platforms like Cisco ACI. A private-scoped subnet belongs to a specific context but can be selectively shared with another context through route leaking, keeping the address space internal rather than exposing it to external routing.

Public (A) is wrong because public scope advertises the subnet to external networks via an L3Out, which is outbound internet/WAN reachability - not cross-tenant internal leaking.

Shared (B) is wrong because shared scope makes a subnet broadly available across all VRFs simultaneously, whereas leaking targets a specific context; these are distinct mechanisms.

Infra (C) is wrong because infra scope is reserved for the underlying fabric/infrastructure networking layer (e.g., VTEP addresses, spine/leaf communication), not tenant workload addressing.

Memory tip: Think of it as "Private → Pipe to another tenant" - the subnet stays private (not public), but you run a controlled pipe (leak) to another context. The "P" in Private = Pipeline between tenants.

No community discussion yet for this question.