A fleet garage auditor asks for evidence of SD-Access segmentation intent without receiving live ISE policy tree exports. What documentation artifact best captures VN and SGT design for civic compliance?
Select an answer to reveal the explanation.
Short Explanation
Auditors want the zoning map, not the locksmith’s keyring. A VN/SGT matrix shows which civic roles share a network neighborhood and which badges get which rules—without handing over live ISE trees or RADIUS secrets. Underlay MTU sheets and VXLAN pcaps do not explain segmentation intent.
Full Explanation
A fleet garage auditor asking for evidence of SD-Access segmentation intent without live ISE policy tree exports should receive design matrices mapping Virtual Networks and Scalable Group Tags to civic roles and trust boundaries. That artifact captures macro and micro segmentation intent for compliance without dumping secrets or raw overlays.
A dump of every RADIUS shared secret used at garage switches is sensitive credential material, not a segmentation design record.
Raw packet captures of every VXLAN frame for thirty days are unwieldy and poor intent documentation.
Only the underlay MTU spreadsheet with no overlay policy context misses VN/SGT design entirely.
Exam caveat: keep matrices versioned with change tickets so auditors see when tenancy boundaries moved.
Operational check: publish the current VN/SGT matrix, map each garage role to tags, and store it in the compliance repository. Review the matrix quarterly with security and fleet operations. In municipal operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the platform code and policy revisions used by the civic network team.