A regional hospital keeps every monitor in one endpoint group. Only the ICU subnet may open one port to the records group. Which construct limits the contract to that subnet?
Select an answer to reveal the explanation.
Short Explanation
A microsegment is a velvet rope inside a larger ballroom. You match the ICU addresses, put only that smaller group on the contract, and the other monitors stay outside it. A contract on the whole monitor group would wave every screen through, which is more access than the hospital asked for.
Full Explanation
ACI microsegmentation classifies endpoints by attributes such as an IP address, even when they share a base endpoint group. A microsegmented group that matches the ICU subnet can consume a contract the records group provides, so only those endpoints are allowed the one port. The rest of the monitors stay in the broader group and do not inherit that contract. Putting the contract on the entire monitor group would allow every monitor, which fails the requirement to limit the flow to the ICU subnet. A taboo is a deny construct. Naming the port in a taboo would block that traffic, not permit it. Preferred group on a VRF lets member groups communicate broadly. It does not express a single port for one subnet, so it is wider than the hospital rule. Caveat: the attribute has to match the real ICU addresses, and a more specific contract or a taboo elsewhere can still block the port you meant to allow. Operational check: confirm the ICU endpoints are classified into the microsegmented group and that a monitor outside that subnet cannot open the port.