VPN head-end capacity runs out next quarter and the cheapest fix is exempting the two heaviest SaaS destinations - which traffic do you hand an adversary?
answer
- bytes measure relief, not exposure
- score capacity, surface, yield, reversibility
- media is loud and tells you little
- a general SaaS is an arbitrary channel
- owner, reason, compensating control, expiry
basics
~20 sRank candidates by exposure, not by bytes. Real-time media over UDP is the defensible first exemption: huge volume, narrow and stable destinations, almost no inspection yield. A general-purpose file or web SaaS is the opposite on every axis.
solid answer
~50 sThe trap is ranking by byte volume, because that ranks by what relieves the concentrator rather than by what it opens. Score each candidate on four axes: how much head-end load it removes; how wide and how multi-tenant the destination space is; how much the inspection stack actually yields on that traffic today; and how reversible the exemption is. Real-time media scores well on all four - it is a large continuous stream, addressed to a defined set of endpoints, and a proxy learns almost nothing from it - so it is the exemption to make first. A general file-sharing or web SaaS gives back less capacity while opening an arbitrary upload path to shared address space. Whatever you choose, write it down with an owner, an expiry and the compensating control, so an exemption made under capacity pressure does not become permanent by default.
go deeper
Know that exempting a destination from the tunnel relieves the head-end and simultaneously removes every corporate control from that path.
Explain why the heaviest traffic is often the cheapest to exempt, and what the inspection stack still yields on encrypted traffic it merely carries.
Demonstrate an explicit ranking across capacity returned, destination surface, inspection yield and reversibility, and insist on an owner, a compensating measure and an expiry for whatever you exempt.
Own the pattern rather than the instance: repeated exemptions are a capacity plan that was never funded, and each one removes visibility that a later purchase does not restore.
## Why the obvious ranking is the wrong one When the head-end is saturated, the natural instinct is to sort destinations by bytes and exempt from the top. That sort answers exactly one question - which entry buys the most relief - and says nothing about what the entry opens. Bytes and exposure are close to uncorrelated: the heaviest flow in most estates is media, which carries almost no defensive signal, while a modest-volume general-purpose SaaS is an arbitrary two-way channel to shared address space. ## Four axes worth scoring **1. Capacity returned.** Sessions, concurrent bandwidth at peak, and the inspection tier's licensed throughput. Measure at the busy period, not the daily mean; the shortfall is a peak problem. **2. Destination surface opened.** How many prefixes, how stable, and whether the space is dedicated to that vendor or shared front-end infrastructure serving many parties. A narrow, stable, single-purpose destination set is cheap to exempt; a broad CDN prefix list is expensive whatever its byte share. **3. Inspection yield forgone.** Be honest about what the stack gets from this traffic *today*. For encrypted real-time media the answer is close to nothing beyond the fact that a call happened. For a general web or file service, the path still yields destination, volume, timing, direction and, above all, an enforcement point where a policy verdict can be applied. Giving up the second is far more expensive than giving up the first even when the second is a fifth of the bytes. **4. Reversibility.** Can you withdraw this exemption on a weekday morning without a change window and without a wave of failures? A media exemption is generally reversible - performance degrades, work continues. An exemption that users have quietly built workflows around is not. ## The shape of the answer Media over UDP is the first and most defensible exemption in almost every estate, and saying so is not a cop-out: it is the case where capacity relief is enormous and the visibility given up is genuinely small. Beyond it the trade turns sharply. The second-heaviest destination is usually the one that deserves the purchase instead, and the correct move is often to exempt media, buy less capacity than originally quoted, and stop. Then there is the part that separates a defensible decision from a drift: whatever is exempted becomes a written entry with an owner, a stated reason, a compensating measure and an expiry date. The point is not paperwork. An exemption granted under a temporary shortfall becomes permanent the moment nobody is required to re-justify it, and that is how estates accumulate lists whose entries predate everyone in the room. ## Compensating measures on a path you cannot see You cannot enforce in a path you have removed yourself from, so compensation has to come from the two ends: - **The endpoint**, where the agent still records process and connection activity - weaker evidence, on the asset you assume is compromised, and only as good as its coverage. - **The destination**, where the service's own tenant controls and audit trail apply - real, and blind to anything that used your uninspected lane to reach an account that is not yours. - **Narrowness at the point of exemption**: smallest prefix, specific transport and ports, not the vendor's whole published estate. ## The arithmetic to state out loud Capacity demand grows with headcount, roughly linearly and predictably. An exemption is a step change that never grows back. If the shortfall is structural - the workforce is growing 30% a year and this is the second exemption in eighteen months - then exemptions are being used as a substitute for a capacity plan, and each round removes visibility that no later purchase restores, because nobody re-tunnels a destination the workforce has learned is fast. ## What a weak answer sounds like "Exempt the top two by volume, we can always revisit it." It ranks by the wrong key, it treats reversibility as free, and it leaves no owner, no expiry and no record of which traffic stopped being inspected - so the next engineer inherits an entry with no reasoning attached and will not dare remove it.
- Why is byte volume the wrong key to rank exemption candidates by?Volume measures how much relief an exemption buys, not how much it opens. The heaviest stream in most estates is encrypted real-time media, which yields almost no defensive signal, while a modest-volume general-purpose service is a two-way channel to shared address space. Ranking by bytes reliably picks the safest candidate and the most dangerous one indistinguishably.
- What compensating control can you actually apply once a destination is exempt?Only end-based ones. Endpoint telemetry still records process and connection activity, though it sits on the asset you assume is compromised. The destination's own tenant controls and audit trail apply to your tenant and nothing else. Beyond that, keep the exemption narrow by prefix and transport - narrowness is the only in-path control you have left.
- The exemption is meant to be temporary until the capacity purchase lands. How do you make that true?Give the entry an expiry date rather than a review cadence, name the person who must re-justify it, and record the specific traffic that stopped being inspected. Then withdraw it on the date even if the purchase slipped, and let the resulting pressure be visible - an exemption with no expiry is a permanent decision made by whoever was on shift.
Cutting the queue at the busiest door is not the same as cutting it at the door that matters; the crowded one is often the one carrying nothing worth checking.
saying these in an interview costs you the question
- Ranks exemption candidates by byte volume
- Assumes an exemption can be withdrawn later at no cost
- Treats encrypted traffic as worthless to inspect, so free to exempt
- Leaves no owner, reason or expiry on the entry
- Uses exemptions repeatedly instead of a capacity plan