A company wants to set up a new department using private cloud resources. The new department needs access to sales and financial data, but it should be prohibited from accessing human resources…

VSAN (Virtual Storage Area Network) is a technology for pooling and virtualizing storage resources across hosts, not a mechanism for controlling network-level access between organizational departments.

A VLAN creates isolated Layer 2 broadcast domains within a software-defined network, allowing administrators to place the new department and HR data on separate VLANs and apply ACLs at the inter-VLAN routing layer to permit access to sales and financial VLANs while explicitly denying access to the HR VLAN.

GRE (Generic Routing Encapsulation) is a tunneling protocol used to encapsulate one protocol inside another for transport across networks, and does not provide the logical segmentation or access control needed to restrict departmental data access.

VPN creates encrypted tunnels for secure remote or site-to-site connectivity but does not segment an internal virtual network or provide the intra-environment access controls needed to isolate one department from a specific data set.