ETExamTower
Sign in
Q31Security

Several production and development database servers are in the same EPG and IP subnet. The IT security policy requires preventing connections between production and development. Which attribute must be used to assign the servers to separate microsegments?

← → navigate · a answer
Community votes
B
67% (2)
C
33% (1)
A
0% (0)
D
0% (0)
Discussion · 8
4
B is correct. By the way, It can't be C because IP-based microsegmented EPGs do not support classification for IP addresses in the same subnet.
B 3
Selected Answer: B B is the one... although cisco should make a better way to do this..
2
B is correct. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/virtualization/Cisco-ACI-Virtualization-Guide-42x/Cisco-ACI-Virtualization-Guide-421_chapter_0100.html
2
"If you want to use a network-based attribute and classify IP addresses in the same subnet, you have to use the MAC-based network attribute. IP-based microsegmented EPGs do not support classification for IP addresses in the same subnet. IP-based microsegmented EPGs are supported only when traffic needs Layer 3 routing. If the traffic is bridged, the microsegmentation policy cannot be enforced."
1
The network-based attributes are IP (IP address filter) and MAC (MAC Address Filter). You can apply one or more MAC or IP addresses to a uSeg EPG. So it can also be C!?
1
I was wrong. This is from Cisco Docu: e If you want to use a network-based attribute and classify IP addresses in the same subnet, you have to use the MAC-based network attribute. IP-based microsegmented EPGs do not support classification for IP addresses in the same subnet So B should be the answer.
C 1
Selected Answer: C It is not mentioned that VMware is used, and IP is left over
1
If you want to use a network-based attribute and classify IP addresses in the same subnet, you have to use the MAC-based network attribute. IP-based microsegmented EPGs do not support classification for IP addresses in the same subnet. IP-based microsegmented EPGs are supported only when traffic needs Layer 3 routing. If the traffic is bridged, the microsegmentation policy cannot be enforced. https://www.cisco.com/c/en/us/td/docs/dcn/aci/apic/5x/virtualization-guide/cisco-aci-virtualization-guide-53x/ACI-Virtualization-Guide-53x-microsegmentation.html