350-601 Security Practice Question
A Cisco ACI fabric administrator wants to implement microsegmentation using Cisco Group-Based Policy (GBP) in a network that hosts virtual machines and bare-metal servers. Which component must be used to enforce microsegmentation policies for bare-metal servers?
⚠ Common exam trap
Cisco often tests the misconception that microsegmentation policies are enforced by the APIC or a virtual switch, but the trap here is that for bare-metal servers, the leaf switch is the enforcement point because there is no hypervisor to host a virtual switch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Leaf switch
In Cisco ACI, microsegmentation for bare-metal servers is enforced at the leaf switch using Cisco Group-Based Policy (GBP). Unlike virtual machines that rely on a virtual switch (e.g., Cisco AVS) to apply policies, bare-metal servers connect directly to the leaf switch via physical interfaces. The leaf switch uses the opflex protocol to receive policy definitions from the APIC and applies them at the port level, enabling microsegmentation without requiring a hypervisor or virtual switch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Application Policy Infrastructure Controller (APIC)
Why it's wrong here
APIC is the controller, not the enforcement point.
- ✗
Virtual Switch (e.g., Cisco AVS)
Why it's wrong here
Virtual switch only applies to VMs.
- ✗
External firewall appliance
Why it's wrong here
Firewall is not required; leaf enforces.
- ✓
Leaf switch
Why this is correct
Leaf switches enforce microsegmentation for bare-metal servers via PCAM.
Go deeper
Related to this question
About these practice questions
This 350-601 question is part of Courseiva's 984-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 350-601 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-601 exam.