A regional hospital keeps every clinical workstation in one EPG, but only imaging virtual machines, matched by a VM attribute, may open one port to the PACS servers. Which change permits only those virtual machines?
Select an answer to reveal the explanation.
Short Explanation
The big workstation group is a full waiting room, and you only want the imaging patients called. You match those virtual machines with a microsegmented EPG and a contract for the one port toward the PACS servers. Opening the whole VRF, or merging the groups, lets everyone else in too.
Full Explanation
A base EPG that contains every clinical workstation cannot tell imaging virtual machines from the others. A microsegmented EPG classifies endpoints by attributes such as VM properties, and those matching endpoints are pulled into the uSeg EPG. A contract between that uSeg EPG and the PACS EPG, with a filter for the one port, then permits only that classified set. That is both the selection and the whitelist the hospital asked for. Preferred group permits broad communication among the EPGs that are members. It does not match a VM attribute and it does not limit traffic to one port. Hardware proxy is a forwarding choice in which the spine answers unknown unicast from the COOP database. It does not classify virtual machines or install a contract. Merging workstations and PACS into one EPG uses the default intra-EPG permit, so every workstation can reach PACS and the attribute match is gone. Caveat: the attribute has to be one the VMM domain actually reports, or the uSeg EPG stays empty and the contract has no endpoints to hit. Operational check: confirm the imaging VMs land in the uSeg EPG, test the one port to PACS, and confirm a non-imaging workstation in the base EPG cannot open it.