A hospital SD-Access design must keep clinical devices, staff IT, and building automation strictly separated with distinct address pools and policies, while still allowing granular user roles within each area. Leadership wants minimal policy sprawl and clear macro boundaries. Which scalable group and virtual network approach should the designer propose for this segmentation goal?
Select an answer to reveal the explanation.
Short Explanation
You'll get the cleanest separation when you give clinical, staff, and automation their own virtual networks for those big macro boundaries, like separate wings in your hospital. Then you can use scalable groups inside each one to carve out roles without creating policy sprawl.
Full Explanation
The correct design matches macro and micro controls to the stated goals because separate virtual networks provide isolated routing instances with distinct address pools and default policies for clinical, staff, and automation domains, creating clear macro boundaries that contain faults and simplify inter-domain policy, while multiple scalable groups inside each network represent granular user and device roles through identity-based contracts that scale without new subnets or renumbering. The single-virtual-network design using distinct groups for functions and roles is common in smaller campuses and preserves flexible contracts, yet it places all endpoints in one routing table and shared pool, violating the requirement for strictly separated pools and weakening macro containment so one contract error can expose cross-functional traffic. The separate-network design that enforces roles with IP access lists per subnet also reflects widespread enterprise practice and satisfies pool separation, yet it replaces tag-based role policy with topology-bound filters that must be rewritten after moves or growth, increasing operational sprawl and losing identity mobility. The separate-network design with only one group per network keeps pools and boundaries clean with very few policies, yet it imposes uniform access within each function and cannot differentiate physicians, nurses, guests, or controllers, violating granular roles within each area. For exam purposes, remember that virtual networks indicate routing-level macro segmentation while scalable groups indicate role-level micro segmentation, so avoid stretching one mechanism to perform both jobs. In practice, verify the design in Catalyst Center by confirming non-overlapping pools per network, multiple role tags mapped inside each network, and a concise contract matrix allowing only required flows.