Security Policy, Segmentation, and Micro-segmentation
This domain tests how segmentation is designed and enforced on CX 10000. Candidates must distinguish macro-segmentation (VRFs, VLANs, subnets) from micro-segmentation (fine-grained, workload-to-workload policy). The CX 10000 enables micro-segmentation without re-architecting the network: policy is expressed centrally and enforced at each leaf's DPU, so east-west traffic between tiers is inspected inline.
Understand policy structure: identity/group-based rules, default-deny posture, and how groups (rather than raw IP lists) scale policy. Know that policy is authored in a central manager and distributed to switches, and that enforcement depends on traffic being steered to the DPU. Review how segmentation maps to VRFs and how to keep tenant traffic isolated.
Traps:
- Assuming micro-segmentation requires host agents - on CX 10000 it is network-enforced at the DPU.
- Forgetting default-deny implications when a rule is missing.
- Believing VLANs alone provide micro-segmentation; they provide coarse separation only.
- Overlooking that policy must be distributed and steered, or it is not enforced.
Rule of thumb: macro-segmentation draws the walls (VRFs/VLANs); micro-segmentation is the door policy (stateful, group-based, default-deny). Worked example: web and DB tiers in the same VRF must talk only on the DB port. Create groups for web and DB, allow DB-port traffic from web to DB, deny all else. Because the DPU is stateful, return traffic is permitted automatically. Verify by checking policy hit counters and session tables, and confirm a denied flow is logged.
Also review logging and how segmentation supports compliance.