Which two application isolation options are available when Kubernetes is deployed with the ACI CNI plug-in? (Choose two.)

Question

Options

• AProcess Isolation
• BNamespace Isolation
• CCluster Isolation
• DServer Isolation
• EVM Isolation

• A
  14% (6)
• B
  74% (31)
• C
  2% (1)
• D
  7% (3)
• E
  2% (1)

Explanation

Namespace Isolation (B) and Cluster Isolation (C) are the two application isolation options supported by the Cisco ACI CNI plug-in - the question likely has C as the second correct answer. With ACI CNI, namespace isolation maps each Kubernetes namespace to its own ACI Endpoint Group (EPG), enforcing network policy boundaries between namespaces within a shared cluster. Cluster isolation treats the entire Kubernetes cluster as an isolated unit within its own ACI tenant, separating it from other clusters on the same fabric.

Why the others are wrong:

• (A) Process Isolation is an OS-level concept (cgroups/namespaces in Linux), not an ACI CNI networking construct.
• (D) Server Isolation is not a defined ACI CNI isolation mode - server-level segmentation is handled by the underlying ACI fabric policy, not the CNI plug-in directly.
• (E) VM Isolation - while VMs host Kubernetes nodes, the ACI CNI plug-in doesn't expose "VM isolation" as a named application isolation option; it operates at the namespace and cluster level.

Memory tip: Think "N-C" = Namespace & Cluster - two scopes, two isolations. Namespace is within a cluster; Cluster is across the fabric. ACI CNI gives you both granularities.

No community discussion yet for this question.