Two transit fare-collection VMs share the same NSX-T overlay segment. What is true about east-west inspection?
Select an answer to reveal the explanation.
Short Explanation
Sharing a hallway does not skip the checkpoint at each office door. Distributed Firewall sits on the vNIC, so two fare VMs on the same segment still get inspected—no physical hairpin required.
Full Explanation
Two transit fare-collection VMs on the same NSX-T overlay segment still have their east-west flow inspected by the Distributed Firewall at each vNIC. Sharing a segment is sharing a hallway, not skipping the checkpoint at each office door: Distributed Firewall is enforced at the virtual NIC, so same-segment pairs do not get a free pass. Claiming same-segment traffic bypasses Distributed Firewall and requires a physical hairpin firewall fails by concept because NSX-T Distributed Firewall does not depend on L3 routing between segments to inspect; hairpinning to a physical firewall is an outdated workaround, not the NSX-T model. Calling same-segment traffic always north-south that must use Gateway Firewall fails because north-south is traffic entering or leaving the overlay through the Edge, not two overlay VMs chatting on one segment. Asserting visibility only to Carbon Black Cloud network sensors fails because endpoint sensors complement but do not replace Distributed Firewall enforcement and logging for overlay east-west policy. Exam caveat: Distributed Firewall inspects at the vNIC regardless of whether endpoints share a segment; do not equate same-segment with bypass, Gateway Firewall, or Carbon Black Cloud-only visibility. Operational check: apply a Distributed Firewall deny or allow between the two fare VMs on the shared segment, verify hits with Traceflow or rule counters without inserting a physical hairpin, confirm Gateway Firewall is not required for that pair, and document same-segment east-west inspection in the transit micro-segmentation standard.