ACI Management and Data Plane Separation
Short answer
B Create a Tenant in Cisco APIC to accomplish management policy and data plane separation.
Question
Key Takeaways
The exam tests the understanding of ACI hierarchy; candidates often confuse traffic segmentation (BD) with administrative isolation (Tenant).
This question addresses the fundamental Cisco ACI object responsible for isolating management policy from data plane traffic. It clarifies that while Bridge Domains segment traffic, the Tenant is the logical container enforcing this separation.
Common mistake: Candidates frequently select Bridge Domain, incorrectly assuming that Layer 2 segmentation equates to the required management and data plane separation.
Expert Analysis
Why the Answer Is Correct
In Cisco ACI, a Tenant is the primary organizational unit that provides complete separation between different sets of policies and data planes. By creating distinct Tenants, an administrator ensures that management configurations (policies) are isolated from the data forwarding plane, preventing cross-tenant interference and ensuring security boundaries.
Why the Other Options Are Wrong
Bridge domains (Option D) are Layer 2 forwarding constructs used to segment broadcast domains within a tenant; they do not inherently separate management policy from the data plane across the fabric. Contracts (Option C) define communication rules between End Groups but do not provide the structural separation required. Application profiles (Option A) group EPGs and contracts for deployment but rely on the Tenant for isolation.
Community Comment Notes
Community feedback shows a split, with some users correctly identifying the Tenant as the separator of management and data planes. Others mistakenly argue for Bridge Domains, confusing logical network segmentation with the broader architectural separation provided by Tenants.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always distinguish between 'segmenting traffic' (Layer 2/Layer 3 objects like BDs/VRFs) and 'organizational isolation' (Tenants). If the question asks about separating management from data or isolating groups entirely, think Tenant first.
Frequently Asked Questions
Why isn't Bridge Domain the answer?
What does a Tenant isolate?
Community Votes
66% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 6 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 6
-
designated 👍 2 Answered BB is correct = management policy and data plane separation
-
Marinheiro 👍 1 Answered CContracts In addition to EPGs, contracts (vzBrCP) are key objects in the policy model. EPGs can only communicate with other EPGs according to contract rules. The following figure shows the location of contracts in the management information tree and their relation to other objects in the tenant. https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/policy-model-guide/b-Cisco-ACI-Policy-Model-Guide.html#id_107453
-
udo2020 👍 1 Answered DA Bridge Domain (BD) is a Layer 2 forwarding construct that provides separation between management, policy, and data planes. By configuring different bridge domains, you can segment traffic within the fabric, effectively achieving the goal of separating management policy and the data plane.
-
Aamir_Inamdar 👍 1 Answered DAs tenant already created for mgmt and question is must be created to separate management and data plane so I think BD us correct
-
Ceara 👍 1 Answered BTenant should be the answer
Show 1 more comment
-
Ceara 👍 1 Answered BTenant
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.