A company is building a network fabric for an AI training cluster that will train...

VXLAN EVPN provides scalable logical segmentation without requiring physically separate fabrics. Separate VXLAN Network Identifiers can isolate individual AI training projects, while Cisco's Group Policy Option adds a security group identifier to the VXLAN header and enables granular microsegmentation through security-group policies. This makes it possible to isolate tenant or project traffic while selectively allowing access to common services such as centralized storage.

Cisco specifically describes GPO as supporting microsegmentation within VXLAN EVPN fabrics and granular traffic control between application segments. This approach preserves a high-performance shared fabric, avoiding the operational complexity and resource inefficiency of constructing physically separate networks for every project. Cisco also positions VXLAN EVPN as an architecture for AI/ML environments requiring segmentation, secure multitenancy, and scalable high-throughput communication.

Option A provides strong isolation but wastes switching resources and complicates shared-storage connectivity. Option C relies on conventional VLAN boundaries and centralized router ACL enforcement, introducing scaling and potentially additional forwarding constraints. Option D confuses QoS classification with security segmentation; DSCP identifies service classes but is not a security-isolation mechanism.

Study Guide Reference: 2.1 Evaluate network deployment based on bandwidth, latency, scalability, and security.

===============