An enterprise's applications run on VMware VMs in its data center, on bare-metal Linux servers, and on instances in two public clouds. The security team wants one microsegmentation policy model enforced consistently at each workload regardless of where it runs. Which approach does Cisco Secure Workload use?
Select an answer to reveal the explanation.
Short Explanation
Instead of building a fence around every neighborhood, you give every house its own lock and one master key policy. Secure Workload's agents program each host's native firewall, so the same rules follow the workload whether it's a VM, bare metal or a cloud instance. Don't fall for network-edge answers — they can't see traffic between two workloads on the same segment.
Full Explanation
Cisco Secure Workload enforces microsegmentation at the workload itself. A centrally computed policy, built from application dependency mapping and human review, is translated into rules that software agents apply through the operating system's native firewall, such as iptables or ipset on Linux and the Windows Filtering Platform on Windows. Because enforcement travels with the workload, the same policy model applies on virtual machines, bare-metal servers and cloud instances, and it controls east-west traffic even between workloads on the same subnet. A hardware firewall at each data center and cloud edge only sees traffic crossing that edge, so flows between workloads inside a segment remain uncontrolled, and the policy would differ by location. Configuring native security groups separately in each cloud produces inconsistent policies across environments and does nothing for on-premises VMs or bare metal. VLAN segmentation with routed ACLs is coarse, tied to network topology, and cannot follow a workload that moves or scales. Exam caveat: Secure Workload also offers agentless options for some cloud and container environments, but the defining model is workload-level enforcement from a single policy. Operational check: confirm agents report as enforcing on each workload type and test that a denied flow between two hosts on the same subnet is actually dropped.