A regional hospital must isolate one imaging server with a tighter policy based on a VM attribute, without moving it to a new VLAN or opening every port across the application tier. Which ACI construct classifies that server?
Select an answer to reveal the explanation.
Short Explanation
Microsegmentation is a name tag on one guest, not a new building. You classify the imaging server by its attribute so a tighter contract can follow that tag alone. A VRF-wide permit would open every EPG, which is far more than this hospital asked for.
Full Explanation
ACI microsegmentation places an endpoint into a uSeg EPG based on attributes such as VM name, IP, MAC, or a custom tag, even when the endpoint stays on the same VLAN and bridge domain as its neighbors. The hospital can then provide or consume a tighter contract on that uSeg EPG without rewriting the whole tier. That attribute match is what classifies this one imaging server. A vzAny contract applies to every EPG in the VRF that consumes or provides it. It does not select one VM by attribute, and using it to open ports would widen reachability instead of isolating a single host. Hardware proxy is a forwarding choice for unknown unicast. The spine COOP lookup does not classify endpoints and does not install a contract permit. A second bridge domain is an L2 forwarding object. Creating one does not, by itself, sort endpoints by a VM attribute, and the requirement was to avoid a new VLAN just to quarantine this server. Caveat: the uSeg EPG still needs the right contract, and a broader contract on the base EPG can remain in force for the other endpoints. Operational check: confirm the imaging endpoint shows the uSeg EPG in its classification, then test that only that server hits the tighter policy.