Explanation
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.
JSON Web Tokens are composed of three parts, separated by a dot (.): Header, Payload, Signature. Therefore, a JWT typically looks like the following:
xxxxx.yyyyy.zzzzz
The header typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 or RSA.
The second part of the token is the payload, which contains the claims. Claims are statements about an entity (typically, the user) and additional data.
To create the signature part you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that.

VTEP, or VXLAN Tunnel Endpoint, is the component in VXLAN architecture responsible for encapsulating and decapsulating Ethernet frames. It acts as the interface between the overlay network where VXLAN operates and the underlay network, which is typically the physical network infrastructure. When encapsulating, the VTEP adds VXLAN headers to the original Ethernet frame, creating a VXLAN packet that can be transmitted over the underlay network. Upon reaching the destination VTEP, the process is reversed, and the VXLAN headers are removed to recover the original Ethernet frame for delivery within the destination network segment.
References:
* Implementing and Operating Cisco Service Provider Network Core Technologies (SPCOR) source book
* Cisco's official training and certification resources on VXLAN and VTEP functionalities.

From the "show vlan brief" we learn that Finance belongs to VLAN 110 and all VLANs (from 1 to
1005) are allowed to traverse the trunk (port-channel 1). Therefore we have to remove VLAN 110 from the allowed VLAN list with the "switchport trunk allowed vlan remove " command. The pruning feature cannot do this job as Finance VLAN is active.