Policy requires that the cameras group must not initiate sessions to the finance group on the city EVPN-VXLAN fabric. How does GBP express that intent?
Select an answer to reveal the explanation.
Short Explanation
Least privilege in plain English: camera badges cannot open finance doors. GBP writes that as a group-to-group deny for east-west traffic. Underlay IGP tricks or turning off snooping do not encode that intent.
Full Explanation
When policy requires that the cameras group must not initiate sessions to the finance group on the city EVPN-VXLAN fabric, GBP expresses that intent with an inter-group GBP policy that denies camera-initiated flows to finance endpoints. Inter-group policies encode least-privilege east-west rules between classified groups so surveillance devices cannot open paths into payment or ledger systems even when they share broader fabric reachability. Advertising cameras only in the underlay IS-IS database may affect underlay topology visibility but does not implement overlay group session policy between civic groups. Forcing cameras onto a separate DCI VLAN with no overlay policy relocates Layer 2 adjacency without expressing GBP allow or deny between groups. Disabling IGMP snooping so multicast replaces unicast policy breaks multicast optimization and still fails to enforce camera-to-finance session denial. Exam caveat: map “group A must not initiate to group B” directly to inter-group GBP deny (or equivalent least-privilege) on the describe exam. Operational check: place a lab camera endpoint and a finance endpoint in their respective GBP groups, apply the inter-group deny, attempt a camera-initiated session, confirm it fails, and verify an explicitly allowed or same-group control flow still succeeds for evidence.