A municipal zero-trust initiative needs microsegmentation with group tags and policy inside an existing EVPN-VXLAN VNI rather than creating a new VNI per tier. Which Juniper data-center security approach fits that goal?
Select an answer to reveal the explanation.
Short Explanation
GBP is name tags on badges plus rules about who can talk to whom—inside the same big room (VNI). You do not need a new room for every job title. CoS marks priority; it is not microseg policy.
Full Explanation
When a municipal zero-trust initiative needs microsegmentation with group tags and policy inside an existing EVPN-VXLAN VNI rather than creating a new VNI per tier, the Juniper data-center security approach that fits is Group-Based Policy (GBP) that classifies endpoints into groups and enforces inter-group policy in the fabric. GBP assigns endpoints to groups and applies allow or deny relationships between those groups, including east-west controls inside one VNI, so application tiers need not each consume a separate overlay segment. Underlay CoS only, without overlay group classification, prioritizes queues but does not express group-to-group session policy for civic workloads. Disabling EVPN MAC learning so all east-west traffic floods increases flooding and weakens control rather than delivering microsegmentation. Replacing VXLAN with pure VLAN stitching across every leaf reintroduces large L2 domains and does not provide GBP-style group policy. Exam caveat: map “microsegmentation inside a VNI with group tags” to GBP on the JNCIP-DC describe level. Operational check: classify two lab endpoints into different GBP groups within one municipal VNI, apply an inter-group deny, verify the session fails while same-group or explicitly allowed pairs succeed, and document that no extra VNI was required for the tier split.