A financial firm on SD-Access must separate retail banking, trading, and guest access, enforce distinct policies for contractors within banking, and keep segmentation scalable without adding VLANs per group. Which macrosegmentation approach with scalable groups meets these isolation needs?
Select an answer to reveal the explanation.
Short Explanation
You need buildings for departments and badges for roles inside them. Virtual networks isolate the big tenants while group tags handle fine-grained rules, like floors plus keycards. No VLAN sprawl required.
Full Explanation
Correct design uses distinct virtual networks for retail, trading, and guest to provide VRF-separated routing, overlapping IP support, and regulatory isolation, plus scalable group tags for contractor versus employee roles inside banking enforced by TrustSec SGACLs without new VLANs, combining macro and micro segmentation with mobility. A single virtual network with only tags handles roles scalably but leaves all departments in one VRF and routing table, so guest and trading lack control-plane separation and depend solely on tag policy, failing macro isolation. Building a dedicated virtual network for every contractor role achieves isolation but multiplies VRFs, route targets, and border handoffs, recreating VLAN sprawl as VRF sprawl and violating the scalability requirement. Keeping correct virtual networks but controlling contractors with IP-based ACLs preserves macro isolation yet ties policy to DHCP-assigned addresses that break on roaming and reassignment, losing identity-based, centralized ISE enforcement that tags provide. For exams, distinguish forwarding separation from role policy: virtual networks separate forwarding instances while tags separate identities within an instance, and any stem stressing no new VLANs with role distinctions expects tags. In practice confirm Catalyst Center shows three VRF-mapped networks, ISE authorization assigns contractor tags, and the TrustSec matrix permits only intended tag-to-tag traffic.