Which description of EPG is true?

EPGs can contain endpoints from both virtual machines and physical devices, making the statement that they can 'only' be linked to physical devices incorrect.

Communication between EPGs is governed by contracts, which dynamically define permitted interactions and security policies, rather than static path binding.

EPGs are tenant-specific; an EPG belongs to a single tenant and cannot contain endpoints from multiple tenants across tenant boundaries, as tenants are isolated domains.

In Cisco ACI, an EPG (Endpoint Group) defines a group of endpoints that require similar network policies, such as security, QoS, or monitoring. While EPGs are usually associated with specific subnets through a Bridge Domain (BD), ACI offers flexibility where multiple EPGs can be associated with the same Bridge Domain, thereby sharing the same Layer 2 broadcast domain and IP subnet. This allows different policy applications to different groups of endpoints within the same logical subnet, enabling granular policy control without strict IP address boundaries.