Illumio Platform and Breach Containment Fundamentals
What this domain tests
This domain checks that you can describe Illumio's architecture without confusing the control plane with the data plane, and that you can explain how the platform contains a breach rather than merely reporting one.
Core building blocks
- PCE (Policy Compute Engine) - the control plane. It stores labels, computes policy, and distributes it. Traffic never flows through the PCE.
- VEN (Virtual Enforcement Node) - a lightweight agent on each managed workload. It reports flow telemetry to the PCE and enforces policy locally using the host firewall (iptables on Linux, Windows Filtering Platform on Windows).
- Labels - workloads are described by label dimensions, commonly Role, Application, Environment, Location (RAEL). Policy is written against labels, never IP addresses, so it survives re-addressing and autoscaling.
- Illumination - the PCE's flow map of who actually talks to whom, used to draft policy from observed traffic.
Breach containment
Containment means shrinking the blast radius fast. Because the VEN sits on the host, you can ringfence a workload so it can talk only to itself and the PCE, cutting lateral movement in seconds while you investigate. Label changes also re-scope policy immediately.
Worked example
A production VM starts scanning internal hosts on TCP 445. The analyst applies a ringfence to that workload. The VEN drops all traffic except PCE communication, so the infected host cannot reach the database tier. No firewall change ticket, no subnet re-architecture. After forensics, the workload is rebuilt and the ringfence is removed.
Traps that cost marks
- Believing the PCE is inline or is itself a firewall.
- Assuming visibility mode blocks anything - it only reports.
- Forgetting that policy needs labels applied first; unlabeled workloads fall outside intended rules.
- Treating microsegmentation as a replacement for EDR; the exam expects complementary layers.