A regional planning commission is drowning in per-IP extended ACLs for municipal apps and wants a more scalable SD-Access alternative. Which approach best replaces that ACL sprawl?
Select an answer to reveal the explanation.
Short Explanation
Line ACLs that chase every IP are like rewriting the guest list every time someone changes desks. Group-based policy tags roles and apps, then allows or denies group-to-group. The commission maintains intent, not a novel-length ACL on every hop.
Full Explanation
A regional planning commission drowning in per-IP extended ACLs should replace thousands of line ACLs with group-based policy using Scalable Group Tags for municipal application access. SGTs express user-to-app intent at group scale, which is the SD-Access alternative to ACL sprawl on civic campuses.
Duplicating the same extended ACL on every underlay P2P interface without using groups multiplies the sprawl onto the underlay.
Converting every ACL ace into a static route tagged with BGP communities only confuses routing tags with security policy enforcement.
Moving all municipal apps into promiscuous VLAN 1 to eliminate filtering removes security rather than scaling it.
Exam caveat: GBAC still needs accurate classification and an maintained matrix—tags without policy rows do not equal least privilege.
Operational check: pilot one app with SGT-to-SGT rules replacing a lengthy ACL, compare hit counts and access outcomes, then expand. Archive the old ACL and new matrix mapping for the commission’s compliance file. In municipal operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the platform code and policy revisions used by the civic network team.