Exam 350-701 topic 1 question 324 discussion

C ("intra") sounds most logical. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/4-x/virtualization/Cisco-ACI-Virtualization-Guide-42x/intra-epg-isolation-enforcement-42x.pdf

Intra-EPG Endpoint Isolation Intra-EPG endpoint isolation policies provide full isolation for virtual or physical endpoints; no communication is allowed between endpoints in an EPG that is operating with isolation enforced. Isolation enforced EPGs reduce the number of EPG encapsulations required when many clients access a common service but are not allowed to communicate with each other. An EPG isisolation enforced for all Cisco Application Centric Infrastructure (ACI) network domains or none. While the Cisco ACI fabric implements isolation directly to connected endpoints, switches connected to the fabric are made aware of isolation rules according to a primary VLAN (PVLAN) tag.

The configuration method that provides the options to prevent physical and virtual endpoint devices that are in the same base EPG or uSeg from being able to communicate with each other with VMware VDS or Microsoft vSwitch is "intra-EPG isolation". Therefore, the correct answer is C. intra-EPG isolation. Intra-EPG isolation is a policy that allows traffic isolation between endpoints within the same EPG or uSeg. This method provides granular control over traffic flows within an EPG, preventing unauthorized communication between endpoints. By enabling intra-EPG isolation, administrators can prevent lateral movement of threats and limit the potential impact of security breaches

Intra-EPG Isolation is an option to prevent physical or virtual endpoint devices that are in the same base EPG or microsegmented (uSeg) EPG from communicating with each other.

C. Intra-EPG Intra-EPG Isolation for VMware VDS or Microsoft Hyper-V Virtual Switch Intra-EPG Isolation is an option to prevent physical or virtual endpoint devices that are in the same base EPG or microsegmented (uSeg) EPG from communicating with each other. By default, endpoint devices included in the same EPG are allowed to communicate with one another. However, conditions exist in which total isolation of the endpoint devices from on another within an EPG is desirable. For example, you may want to enforce intra-EPG isolation if the endpoint VMs in the same EPG belong to multiple tenants, or to prevent