A public health clinic places clinicians and guest kiosks in the same Virtual Network but must still block kiosk-to-EHR traffic unless policy allows it. Which fabric capability provides that micro-segmentation?
Select an answer to reveal the explanation.
Short Explanation
Same VN is like sharing a building floor—macro walls are already open. Scalable Group Tags are the badge colors that say who may walk into which rooms. Tag the kiosks and clinicians, write policy that denies kiosk-to-EHR, and the fabric can block that chat even though they share the VN.
Full Explanation
When a public-health clinic places clinicians and guest kiosks in the same Virtual Network but still needs separation, micro-segmentation via Scalable Group Tags and group-based policy is the lever. Same-VN groups still require explicit policy to communicate, limiting lateral movement even though they share an overlay routing space—useful when VLAN/VN sprawl must stay bounded.
Splitting the underlay into per-floor OSPF areas so kiosks never learn EHR prefixes attacks the underlay IGP instead of applying fabric group policy and is the wrong plane for this control.
Relying only on longer VN names so operators remember not to bridge groups is operational folklore, not enforcement.
Advertising both groups into a shared services VN without SGTs interconnects without micro-segmentation controls the stem requires.
Exam caveat: micro-seg complements macro VN separation; if stronger isolation is mandatory, different VNs may still be appropriate—SGTs are not a substitute for regulatory air gaps when policy demands them.
Operational check: assign distinct SGTs to clinician and kiosk test hosts in the same VN, enforce deny-lateral policy, and verify EHR access rules. Keep the clinic’s group matrix aligned with HIPAA-minded network controls.