Group-Based Policy (GBP) is a micro-segmentation feature used to logically group endpoints with similar functions or security postures. The primary goal is to apply security policies to these groups (tags) rather than individual IP addresses. By assigning GBP tags based on endpoint type (e.g., 'IoT-Devices', 'Corporate-Laptops', 'Guest-Users'), an administrator can create scalable policies to control traffic flow and effectively isolate different types of devices from each other within the same VRF, fulfilling the scenario's requirement.

A. Assign a separate GBP tag to each endpoint.

This approach is not scalable and defeats the purpose of "group-based" policy, creating an unmanageable administrative overhead.

C. Assign GBP tags based on endpoint location.

While location can be a policy attribute, GBP's primary function is logical segmentation based on role or type, not physical location.

D. Assign a single GBP tag to all endpoints.

This would place all endpoints into one group, providing no segmentation or isolation, which is the opposite of the stated goal.

---

1. Juniper Mist Documentation, "Microsegmentation Using Group-Based Policies": This document explicitly states, "You can use group-based policies to segment traffic based on user or device groups instead of IP addresses. For example, you can create groups such as Students, Faculty, and IoT devices, and then create policies to permit or deny traffic between these groups." This directly supports assigning tags based on endpoint type. (Source: Juniper Networks TechLibrary, Mist Wired Assurance documentation).

2. Juniper Mist Documentation, "Campus Fabric IP Clos Deployment Guide": In the "Microsegmentation and Macro-segmentation" section, the guide explains that GBP provides micro-segmentation within a VRF. It describes creating policies between groups of users/devices, reinforcing the concept of grouping by type or role for policy enforcement. (Source: Juniper Networks TechLibrary, Campus Fabric Deployment Guides).