A game studio keeps production and beta virtual machines in one EPG, so those machines can communicate freely. The beta machines carry a distinct attribute and need their own contract policy. Which construct classifies them by that attribute?
Select an answer to reveal the explanation.
Short Explanation
Everyone is wearing the same team jersey, and a few of them also have a sticker you can sort on. You classify the beta machines with a microsegmented EPG that matches that attribute, then hang the contracts you want on that group. Isolation inside the original EPG does not read the sticker, so it cannot build this policy.
Full Explanation
A base EPG in ACI includes every endpoint on the attached ports, and endpoints in that EPG can communicate with each other by default. A microsegmented EPG classifies endpoints that are already in a base EPG by an attribute such as a virtual-machine property, an address, or a tag. The studio can match the beta attribute, place those machines in the microsegmented EPG, and apply contracts that the rest of the original EPG does not use. Intra-EPG isolation stops communication inside an EPG. It does not read a beta attribute, and it does not create a separate contract scope for one subset of machines. Hardware proxy tells a bridge domain to send unknown unicast to the spine COOP database. It does not sort endpoints by a virtual-machine attribute. A static path binding places an EPG on a leaf port and a VLAN. It does not split that EPG into attribute groups. Caveat: the endpoints still need a base EPG, and the attribute has to be one the APIC can actually see or the microsegmented EPG stays empty. Operational check: confirm the beta machines land in the microsegmented EPG, confirm their contracts differ from the production machines, and test the path the new contract is supposed to allow.