Service chaining is the technique of connecting virtual network functions together to provide different types of network service connectivity. Service chaining uses software-defined networking (SDN) programmability to create a chain of connected network services, such as firewalls, load balancers, NAT, and intrusion protection. Service chaining can automate the provisioning of network applications that have different characteristics and requirements, such as security, latency, or quality of service (QoS). Service chaining can also optimize the use of network resources and improve application performance by using SDN analytics and performance tools to select the best available network paths and avoid network congestion. Service chaining is being used in many SDN and network functions virtualization (NFV) use cases and deployments, such as data centers, carrier networks, and virtual customer edge123. References:
* 1: What is Network Service Chaining or Service Function Chaining - SDxCentral
* 2: On service chaining using Virtual Network Functions in Network-enabled Cloud systems | IEEE Conference Publication | IEEE Xplore
* 3: Service function chaining - Gini5

In this architecture:
* A secure web proxy is introduced to inspect and filter all web (HTTP/HTTPS) traffic.
* Remaining traffic (non-web) must pass through an NGFW with IPS capabilities.
* Both the web proxy and NGFW reside between the collapsed distribution/core and internet edge.
To enforce that all web traffic is directed to the proxy appliance for inspection and non-web traffic follows its usual path to the NGFW:
A). Policy-Based Routing (PBR) on the Collapsed Core
This allows traffic classification based on destination port (e.g., TCP 80/443) and selectively reroutes web traffic to the proxy. Non-web traffic continues toward the NGFW. PBR is essential here because traditional routing (based only on destination IP) would not differentiate between traffic types.
D). Static Routing on the Appliance
The proxy appliance must return the traffic back toward the NGFW for final processing and internet egress.
This is typically achieved using static routes on the proxy device, ensuring the return path sends packets back to the correct firewall interface for consistent inspection.
#B. Policy-based routing on the internet edge: Not applicable here, as rerouting must occur closer to the source (collapsed core), before traffic reaches the internet edge.
#C. Policy-based routing on firewalls: This adds unnecessary complexity. Firewalls should focus on enforcing security policies, not traffic redirection logic in this scenario.
This approach adheres to CCDE v3.1 best practices by separating policy enforcement functions and enabling scalable, deterministic traffic flow through layered security appliances.

* SNMPv3 is recommended as it supports authentication and encryption, protecting SNMP traffic even across service provider MPLS VPN backbones.
* Healthcare environments require strong privacy and compliance (e.g., HIPAA), making SNMPv3 the correct protocol.
Why other options are incorrect:
* B & C: Syslog is unrelated to SNMP traps.
* D: SNMPv2 lacks security (unencrypted community strings).
* E: SSH secures CLI access but not SNMP.

* B (Spine must connect to every leaf):Spine-and-leaf designs require full mesh connectivity between spines and leaves to ensure consistent low-latency, non-blocking performance.
* E (Leaf must connect to every spine):Each leaf switch must connect to all spine switches to guarantee even load distribution and fault tolerance.
Other options explained:
* A: Spine switches should not connect to each other in standard spine-and-leaf designs.
* C: Leaf switches do not connect to each other directly.
* D: Endpoints connect to leaf switches, not spines.