A parks department onboards contractor tablets into the fabric and must ensure they cannot reach finance servers. Which policy approach best expresses that least-privilege intent?
Select an answer to reveal the explanation.
Short Explanation
Contractors need park apps, not the finance vault. Give their devices a restricted SGT and write group policy that says that tag cannot talk to finance server tags. Least privilege becomes a clear group-to-group rule instead of a scavenger hunt through IP ACLs.
Full Explanation
Parks contractors on tablets must not reach finance servers. Mapping contractors to a restricted Scalable Group Tag and denying that SGT’s access to finance server groups via group-based policy best expresses least privilege inside the fabric. Identity-driven micro-segmentation scales better than hoping VLANs alone stop lateral movement.
Placing contractors in the finance VN and relying on longer hostnames for separation puts them in the wrong trust domain and uses non-enforcement folklore.
Advertising contractor subnets into every VN so finance firewalls can merely log them expands reachability instead of denying it.
Removing ISE so edges apply only identical port ACL 1 everywhere loses dynamic identity and collapses policy fidelity.
Exam caveat: ensure AuthZ results actually assign the restricted SGT and that the GBAC matrix includes explicit deny to finance—missing matrix rows often default permissively depending on design.
Operational check: onboard a contractor test tablet, confirm restricted SGT, and verify finance server paths are denied while needed contractor apps work. File the contractor SGT row in the parks least-privilege matrix. In municipal operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the platform code and policy revisions used by the civic network team.