Illumio Associate flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Policy Compute Engine (PCE)

Central controller that stores labels, computes policy, and distributes policy blobs to VENs. It is typically deployed as a highly available cluster and is the management brain of the Illumio platform.

VEN

Virtual Enforcement Node: a lightweight kernel-level agent installed on hosts or VMs that observes traffic and enforces the policy blob locally, even when the PCE is unreachable.

CNE

Containerized VEN that protects Kubernetes pods, using namespace and pod labels for scope and enforcing policy at the pod level within the container runtime.

NEN

Network Enforcement Node: agentless enforcement at the network fabric, useful for appliances and unmanaged devices that cannot host a VEN. It enforces policy without host agents.

Label dimensions

Role (what the workload does), Application (the business service it belongs to), and Environment (prod, dev, staging). Location is an optional fourth dimension used for policy scope.

Enforcement modes

Visibility Only (illuminated, no blocking), Selective Enforcement (only allowlisted rules enforced, rest allowed), and Full Enforcement (default-deny plus allowlist). Mode is set per workload.

Pairing profile

Configuration that defines which labels a newly paired VEN receives and which PCE it connects to, automating onboarding of workloads into the correct policy scope.

Supercluster

Links multiple PCEs across regions so policy and labels can be managed globally while each PCE serves its local workloads, supporting global segmentation at scale.

Breach containment goal

Limit lateral movement. Once a workload is compromised, Full Enforcement on it and its peers prevents east-west spread to unrelated applications and data stores.

Rule anatomy

Providers (source label sets) to consumers (destination label sets), plus port/protocol or port range, and an optional scope. Rules are allow-only; there are no explicit deny rules.

Default deny

Under Full Enforcement, all traffic not explicitly allowed is blocked, including intra-application traffic unless a rule permits it. This is the core of least-privilege segmentation.

Rule scope

Restricts a rule to a specific application so it only matches traffic where provider and consumer share that scope. Unscoped rules apply globally and can create unintended allowances.

Policy coverage

Percentage of observed flows that current rules allow. Uncovered flows will be blocked under Full Enforcement, so raise coverage before enforcing.

Draft and provision

Policy changes move through draft, provision (compute on the PCE), and active states. Changes must be provisioned before VENs receive them; unprovisioned changes have no effect.

Impact analysis

Previews which flows a policy change will allow or block before you commit, letting teams validate rules and avoid outages during enforcement rollout.

IP lists and virtual services

Used as providers or consumers for external or unmanaged endpoints that cannot carry labels, such as third-party services, appliances, or load balancer front ends.

Ring-based rollout

Enforcement strategy that starts with high-value assets, then expands ring by ring to lower-risk groups, limiting blast radius of policy errors during rollout.

Policy test and trace

Simulates whether a given provider-to-consumer flow would be allowed under current rules, confirming allow or block before enforcement is applied.

Illumination map

Visual map of observed layer-3/layer-4 traffic between workloads grouped by labels, revealing which applications talk to each other and on which ports.

Potentially blocked flows

Flows that would be blocked if the workload were in Full Enforcement. They highlight policy gaps and risk before enforcement is turned on.

Insights anomaly detection

Flags unusual behavior such as a workload suddenly talking to many new destinations, unusual ports, or cross-environment traffic like dev to prod, which can indicate compromise.

Explorer flow search

Queries historical flows by label, IP, port, or time window to investigate incidents and validate segmentation during and after enforcement.

Labeling quality

Detection and policy quality depend on labels. Unlabeled or mislabeled workloads produce noisy maps and unreliable policy recommendations, so labeling comes first.

Risky ports in Insights

Insights surfaces high-risk services such as SMB and RDP in use, letting teams prioritize tightening rules around those protocols and reducing attack surface.

Flow export to SIEM

Flow data can be exported to SIEM and other tools for correlation with endpoint and network telemetry, extending detection beyond the Illumio platform.

Visibility-only prerequisite

You cannot safely enforce policy on traffic you have not first observed and understood. Visibility mode must precede enforcement for each workload group.

Zero Trust principle

Never trust implicitly based on network location; verify every request. Identity and context, expressed as labels rather than IP subnets, drive access decisions.

Microsegmentation

Fine-grained policy applied to individual workloads or small groups rather than coarse perimeter firewalls or VLANs, limiting lateral movement inside the data center.

East-west traffic risk

Workload-to-workload traffic inside the data center is the primary lateral-movement path for ransomware; microsegmentation targets it directly rather than relying on perimeter controls.

Ransomware containment strategy

Segment by application and environment so an infected host cannot reach backup servers, domain controllers, or other applications' databases, limiting the blast radius of an infection.

Least privilege segmentation

Allow only required ports and peers; block broad any-to-any rules and legacy flat-network allowances. This reduces the paths an attacker can use after compromise.

Defense in depth

Microsegmentation complements EDR, patching, MFA, and backups; it limits blast radius but does not replace endpoint detection or recovery capabilities.