A company has a Mist campus fabric with a single VRF and must configure group-based policy (GBP) tags to isolate different types of endpoints. What would be an appropriate solution for this scenario?

Question

Options

• AAssign a separate GBP tag to each endpoint.
• BAssign GBP tags based on endpoint type.
• CAssign GBP tags based on endpoint location.
• DAssign a single GBP tag to all endpoints.

• A
  10% (5)
• B
  84% (42)
• C
  4% (2)
• D
  2% (1)

Explanation

Juniper Mist AI for Wired uses group-based policy (GBP) to enforce segmentation within a single VRF, without requiring separate VRFs per user group. GBP tags classify endpoints logically (e.g., employees, guests, IoT devices) and enforce security rules across the EVPN-VXLAN fabric. "Group-Based Policy (GBP) provides scalable segmentation by assigning tags to endpoints based on attributes such as user type, role, or device type. These GBP tags are then used in policies to control communication between groups." Option A is inefficient: assigning unique tags per endpoint is not scalable. Option C is incorrect: GBP is identity-based segmentation, not location-based. Option D is incorrect: assigning a single tag defeats the purpose of segmentation. Option B is correct: the best practice is to assign GBP tags based on endpoint type (e.g., servers, staff, IoT, guests), which then drives policy enforcement.

No community discussion yet for this question.