Which Cisco solution enables microsegmentation for virtual switch endpoints?

Why the Answer Is Correct

Cisco ACI is the only option whose documented microsegmentation feature explicitly lists the virtual endpoints named in the question: Cisco ACI Virtual Edge (formerly the Data Center Virtual Edge), Cisco Application Virtual Switch (AVS), Microsoft vSwitch, and VMware vSphere Distributed Switch (VDS). In ACI, the Application Policy Infrastructure Controller (APIC) defines the microsegmentation policy and the ACI fabric enforces it, mapping endpoints into endpoint groups (EPGs) using network- or VM-based attributes via uSeg. This gives administrators the identity-driven, east-west allow-list enforcement that a zero-trust model requires between workloads on the same virtual switch. Because the question describes both deploying and controlling microsegmentation across heterogeneous virtual switches, only the ACI/APIC policy model satisfies the whole scenario.

Why the Other Options Are Wrong

Option A, shown as "Cisco Titration" (Cisco Tetration, now folded into Cisco Secure Workload), is a workload visibility and analytics platform — it consumes flow telemetry and scores behaviour, but it is not the component that programs segmentation policy onto AVS or vSphere Distributed Switch. Option B, Cisco DCNM, is a legacy fabric management and provisioning tool for Nexus/data center switches and does not implement EPG-based microsegmentation for hypervisor virtual switches. Option C, Cisco Stealthwatch (now Secure Network Analytics), is a NetFlow-based detection and response product; it alerts on anomalous flows but does not enforce per-endpoint segmentation policy. None of these three appears in Cisco's supported-endpoint list for ACI microsegmentation.

Community Comment Notes

Several learners converge on the same evidence: as amtf8888 explains, "the Cisco Application Policy Infrastructure Controller (APIC) manages microsegmentation policies, and the Cisco ACI fabric enforces the policies," and then reproduces the supported-endpoint list that matches the question word for word. XBfoundX adds the mechanism detail, quoting that ACI microsegmentation lets you "automatically assign endpoints to logical security zones called endpoint groups (EPGs)" using network- or VM-based attributes (uSeg). CCNPWILL cut straight to the tell-tale phrase, noting "CISC Data Center virtual edge.... cmon..." — that product name points at ACI alone. Only dorf05 argued for the Tetration white paper, which is an understandable confusion because Tetration is marketed around zero trust, but that documentation is about visibility-driven policy discovery rather than the vSwitch enforcement scope described here.