You've been asked to build a route-based hub and spoke network, with policy control for traffic travelling from spoke to spoke. Which two of the following configuration options will meet this requirement? (Choose two.)
A. Place the spoke tunnel interfaces in the trust zone and create policies on the spokes.
B. Place the spoke tunnel interfaces in the untrust zone and create policies on the spokes.
C. Create a single tunnel interface in the trust zone at the hub and enable intra-zone blocking.
D. Create separate tunnel interfaces at the hub and place them in different zones, then create policies at the hub.
Answer: BD
2. You have created a virtual router called VSYSA-vr and made it shareable. You then create the VSYS using the WebUI, telling it to use an existing VR and selecting the VR called VSYSA-vr.
What is the status of the virtual router after you create the VSYS?
A. The router will be the default router but will no longer be shared.
B. The router will be the default router and will still have a shareable status.
C. The system will not let you use a shared virtual router when you create a new VSYS. The initial virtual router must be private.
D. The system will not create a private vr for the VSYS but will assign the untrust-vr as the default router. The shared Virtual router will not be the default router.