A university campus must isolate student, faculty, research, and IoT traffic into separate policy domains while allowing granular access between labs and printers inside each domain. Which scalable group and virtual network design achieves macro- and microsegmentation together?
Select an answer to reveal the explanation.
Short Explanation
You need big walls between dorms and labs, plus smaller doors inside each space. Virtual networks draw the campus boundaries while scalable groups handle person-to-printer permissions inside them.
Full Explanation
The correct approach works because SD-Access virtual networks provide macrosegmentation with separate routing and VRF-like isolation between communities such as students and faculty, while scalable group tags enable microsegmentation with identity-based SGACL enforcement within each virtual network for granular lab-to-printer access. Reversing the roles fails by concept because scalable groups encode group identity for fine-grained policy, not separate routing domains, and virtual networks provide topological isolation, not endpoint identity. Using a single virtual network with VLAN separation fails by concept because it collapses macrosegmentation and depends on VLAN sprawl rather than fabric virtualization, losing scalable routing isolation between communities. Using distribution ACLs with profiling fails by concept because manual ACLs do not scale with identity mobility and lack the fabric integration of virtual networks and scalable groups for centralized policy. For the exam, remember virtual network equals macro VRF separation and scalable group equals micro tag policy; in practice verify virtual network to scalable group mappings and test SGACL contracts for lab resources.