ACI uSeg EPG Microsegmentation: Which Intra-EPG Isolation Settings Block Traffic?

350-601 By islever Editorial Last updated

Apply ACI concepts Apply network security

Short answer

D Enable Allow Micro-Segmentation on the EPG's VMM domain association, enforce Intra-EPG Isolation on the base EPG, and leave the uSeg EPG Unenforced so attribute-matched VMs are separated from the rest.

Question

The VMM domain is integrated between Cisco APICs and vCenter using a distributed vSwitch. The traffic must be blocked between a subset of endpoints in an
EPG based on specific VM attributes and the rest of the VMs in that EPG. Which set of actions blocks this traffic?
    1. Set Allow Microsegmentation under the EPG VMM Domain Association to ג€Trueג€ 2. Set Intra-EPG Isolation to ג€Unenforcedג€ for the EPG 3. Set Intra-EPG Isolation to ג€Unenforcedג€ for the uSeg EPG
    1. Set Allow Microsegmentation under the EPG VMM Domain Association to ג€Falseג€ 2. Set Intra-EPG Isolation to ג€Unenforcedג€ for the EPG 3. Set Intra-EPG Isolation to ג€Enforcedג€ for the uSeg EPG
    1. Set Allow Microsegmentation under the EPG VMM Domain Association to ג€Trueג€ 2. Set Intra-EPG Isolation to ג€Enforcedג€ for the EPG 3. Set Intra-EPG Isolation to ג€Enforcedג€ for the uSeg EPG
    1. Set Allow Microsegmentation under the EPG VMM Domain Association to ג€Trueג€ 2. Set Intra-EPG Isolation to ג€Enforcedג€ for the EPG 3. Set Intra-EPG Isolation to ג€Unenforcedג€ for the uSeg EPG
    Correct Answer

Key Takeaways

This item tests the interaction between Allow Micro-Segmentation, base-EPG isolation, and uSeg-EPG isolation; the main trap is enforcing isolation on the uSeg EPG and thereby isolating the subset from itself.

Cisco ACI microsegmentation with a VMware vDS VMM domain requires Allow Micro-Segmentation to be True and specific Intra-EPG Isolation settings to separate a uSeg EPG from its base EPG. The correct action set is D: base EPG Enforced, uSeg EPG Unenforced.

Common mistake: Option C is tempting because both EPGs are set to Enforced, but that also blocks traffic among the matching VMs inside the uSeg EPG, which the requirement does not ask for.

Expert Analysis

What the requirement actually asks The requirement is not "isolate every VM in the EPG." It is "separate a subset defined by VM attributes from the rest of the same base EPG." In ACI VMM integration, that subset is modeled as a uSeg EPG under the base EPG, so the first gate is the EPG's VMM domain association: Allow Micro-Segmentation must be True. Any option that sets it False (B) cannot create the attribute-based uSeg EPG and is out. The remaining distinction is which layer of Intra-EPG Isolation is enforced.

Why D fits and C overshoots Option D sets Intra-EPG Isolation to Enforced on the base EPG and Unenforced on the uSeg EPG. The base EPG enforcement is what blocks the attribute-matched VMs from reaching the ordinary VMs left in the base EPG, while the uSeg EPG being Unenforced lets the VMs inside that subset still communicate with each other. Option C also leaves the uSeg EPG Enforced, which isolates the subset from itself—stronger than the stated requirement. Option A leaves both Unenforced, so the base-EPG-to-uSeg separation is not enforced. The discussion captures this trade-off: one line of reasoning argues the goal is to block between the attribute-based group and the rest, not to completely isolate devices in the EPG, while another warns that Enforced on the uSeg EPG creates complete isolation among matching VMs.

Adjacent decisions and the flip The adjacent decision is "do you also need east-west isolation inside the subset?" If yes, the answer flips to C: enforce isolation on both the base EPG and the uSeg EPG. If the question only demanded ordinary EPG isolation with no attribute matching, you would not need a uSeg EPG at all; the base EPG's Enforced setting would be the relevant control. Keep the VMM domain detail in mind too: this is a vDS-backed VMM domain, so Allow Micro-Segmentation is a prerequisite on the EPG-to-VMM-domain binding.

Operational consequence Getting this wrong is visible as either leaked traffic (A: matching VMs still reach the rest of the EPG) or over-isolation (C: VMs inside the subset cannot talk to each other). In production, that can break clustered applications or leave a compliance boundary open, so verify the uSeg EPG's isolation state independently from the base EPG.

Official Reference

https://aci-lab.ciscolive.com/lab/pod4/segmentation/mseg

This link opens the official vendor documentation in a new tab.

Exam Strategy

When an ACI VMM-domain question mentions attribute-based separation, first confirm whether the requirement is between groups or within a group. "Between the uSeg EPG and the rest of the base EPG" calls for Allow Micro-Segmentation True and base-EPG isolation Enforced; setting the uSeg EPG to Enforced adds intra-subset isolation you were not asked for. Eliminate any option that sets Allow Micro-Segmentation False, because uSeg EPGs cannot be created without it.

Frequently Asked Questions

Does Allow Micro-Segmentation alone block traffic between a uSeg EPG and its base EPG?

No. Allow Micro-Segmentation enables uSeg EPG creation on the VMM domain association, but the blocking behavior comes from Intra-EPG Isolation being Enforced on the base EPG and left Unenforced on the uSeg EPG.

Why should the uSeg EPG's Intra-EPG Isolation be Unenforced instead of Enforced?

Enforcing it also isolates the attribute-matched VMs from each other inside the subset. The requirement only needs those VMs separated from the rest of the base EPG, so Unenforced preserves intra-subset communication.

What changes if the requirement also blocks traffic among the matching VMs?

Set Intra-EPG Isolation to Enforced on the uSeg EPG as well; that adds isolation within the subset, matching option C's behavior.

More 350-601 FAQ →

Community Votes

A
60%
C
20%
D
20%

60% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. Rocky_Truth 👍 6 Answered C
    C. 1. Set Allow Microsegmentation under the EPG VMM Domain Association to "True" 2. Set Intra-EPG Isolation to "Enforced" for the EPG 3. Set Intra-EPG Isolation to "Enforced" for the uSeg EPG. Setting "Allow Microsegmentation" to "True" enables the creation of uSeg EPGs. Setting "Intra-EPG Isolation" to "Enforced" for the EPG and uSeg EPG will allow for the enforcement of microsegmentation between the endpoints based on specific VM attributes. This will block the traffic between the subset of endpoints and the rest of the VMs in that EPG.
  2. GuyThatTakesDumps 👍 5
    c is the correct one
  3. groblok 👍 4 Answered D
    Intra-EPG Isolation Enforced = the main EPG can achieve isolation within itself. uSeg EPG Enforced = complete isolation each other and groups uSeg EPG Unenforced = controlled isolation can communicate with each other based on policies The request is to block traffic between a subset of endpoints in an EPG, not to completely isolate devices in an EPG
  4. saju777 👍 4
    I think its D. The Intra EPG Isolation option is left Unenforced here. https://aci-lab.ciscolive.com/lab/pod4/segmentation/mseg
  5. Ruzjio 👍 3 Answered A
    The goal here is to block traffic between VMM attribute based EP and the rest EP in same EPG. We do not have to block traffic within the VMM based attribute EP group and the normal EP group. So we don't need to set the Intra-EPG isolation to enforce in the base EPG and the uEPG.
Show 8 more comments
  1. H_nna 👍 3 Answered D
    I agree with saju777. Check out his reference, there is a config example: enforcement for intra-epg isolation to on, no need for additional enforcement cause its a standard EPG no useg EPG
  2. zoltaaan 👍 3 Answered A
    I would go with A too, intra-EPG isolation is not required, the question is asking for blocking traffic between uSeg EPG and the EPG.
  3. saju777 👍 3
    I meant uSeg Intra-EPG Isolation left Unenforced. Base EPG Intra-EPG Isolation is Enforced.
  4. hazemsalah87 👍 3 Answered A
    there is no requirement to block traffic between EPs in same EPG or same useg EPG
  5. mark_87 👍 2 Answered A
    Agreed, should be A
  6. Krans 👍 1 Answered A
    The answer is A: set Allow Micro-Segmentation to True, then set Intra-EPG Isolation to Unenforced on both the base EPG and the uSeg EPG. The odd characters such as “— in the options are a text-encoding error on the a public community thread page. They’re just broken quotation marks, so read the options as “True”, “Unenforced” and “Enforced”. Why A 1. Allow Micro-Segmentation = True. This creates a microsegment (uSeg) EPG, which picks out VMs by attributes such as VM name, operating system or tag. On a VMware distributed vSwitch, this setting forces VM traffic up to the ACI leaf instead of being switched locally inside the vSwitch. Without it, ACI never sees the traffic and can’t apply policy to it. So the option must be True, which rules out B. 2. The uSeg EPG does the blocking. Once the selected VMs move into the uSeg EPG, they’re in a different EPG from the rest. ACI blocks all traffic between EPGs by default unless a contract allows it. So the traffic between the subset and the rest is blocked automatically, with no isolation settings needed. 3. Intra-EPG Isolation = Unenforced on both. Intra-EPG isolation blocks traffic between endpoints inside the same EPG. The requirement only asks to block traffic between the two groups, not within each group. So both EPGs stay Unenforced, and the VMs in each group can still talk to each other. Why the others are wrong B: Micro-segmentation set to False means the uSeg EPG can’t work on the distributed vSwitch. C: Enforcing isolation on both EPGs would also block traffic between VMs within each group, which wasn’t asked for. D: Enforcing isolation on the base EPG would block the remaining VMs from talking to each other, which is also more than required. Moving endpoints into a separate EPG already blocks them from the rest. Intra-EPG isolation is only for blocking endpoints from each other within one EPG.
  7. zeppie 👍 1 Answered A
    The answer is A attending to the wording of the question. You want to block traffic between a subset of endpoints in an EPG, not between all endpoints in the EPG.
  8. Reikidude00 👍 1 Answered C
    Cant be A, traffic must denied between vm intra-epg

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

NX-OS Software Downgrade Impact Check

S-grade

Terraform ACI Provider Authentication and APIC DOS Threshold Counting

S-grade

MDS 9000 TE Port Channel for Multi-VSAN Trunking with Mismatch Suspension

S-grade

FCoE FC-Map Configuration to Prevent Cross-Fabric Talk

S-grade

← Back to 350-601 Study Guide