ACI Management and Data Plane Separation
An engineer must implement management policy and data plane separation in the Cisco ACI fabric. Which ACI object must be created in Cisco APIC to accomplish this goal?
Community Votes
66% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests the understanding of ACI hierarchy; candidates often confuse traffic segmentation (BD) with administrative isolation (Tenant).
This question addresses the fundamental Cisco ACI object responsible for isolating management policy from data plane traffic. It clarifies that while Bridge Domains segment traffic, the Tenant is the logical container enforcing this separation.
Candidates frequently select Bridge Domain, incorrectly assuming that Layer 2 segmentation equates to the required management and data plane separation.
Community Discussion (6 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
In Cisco ACI, a Tenant is the primary organizational unit that provides complete separation between different sets of policies and data planes. By creating distinct Tenants, an administrator ensures that management configurations (policies) are isolated from the data forwarding plane, preventing cross-tenant interference and ensuring security boundaries.Why the Other Options Are Wrong
Bridge domains (Option D) are Layer 2 forwarding constructs used to segment broadcast domains within a tenant; they do not inherently separate management policy from the data plane across the fabric. Contracts (Option C) define communication rules between End Groups but do not provide the structural separation required. Application profiles (Option A) group EPGs and contracts for deployment but rely on the Tenant for isolation.Community Comment Notes
Community feedback shows a split, with some users correctly identifying the Tenant as the separator of management and data planes. Others mistakenly argue for Bridge Domains, confusing logical network segmentation with the broader architectural separation provided by Tenants.Official Reference
Exam Strategy
Always distinguish between 'segmenting traffic' (Layer 2/Layer 3 objects like BDs/VRFs) and 'organizational isolation' (Tenants). If the question asks about separating management from data or isolating groups entirely, think Tenant first.
Frequently Asked Questions
Why isn't Bridge Domain the answer?
Bridge Domains segment traffic at Layer 2 within a tenant but do not isolate management policies from the data plane globally.
What does a Tenant isolate?
A Tenant isolates configuration, policies, and data forwarding planes from other tenants in the ACI fabric.