Library automation updates NSX-T security tags from the CMDB with PowerCLI or Ansible. What is the security-policy automation mechanism?
Select an answer to reveal the explanation.
Short Explanation
Ansible is just the mailroom that sticks the right tag on the book cart. The policy still lives in NSX groups that match those tags—not in a paper CAB.
Full Explanation
When library automation updates NSX-T security tags from the CMDB with PowerCLI or Ansible, the security-policy automation mechanism is external orchestration that still lands as NSX tags and dynamic groups. Ansible is the mailroom sticking the right tag on the cart; enforcement remains NSX groups matching those tags and the Distributed Firewall bound to them. Treating a CISSP change-advisory board as replacing tagging fails by concept because CAB approval does not write tags or realize dynamic group membership—governance can gate automation but does not substitute for NSX objects. Encoding CMDB owners as a T0 static route fails because routing next-hops are not security tags and cannot drive Distributed Firewall group membership. Creating a Workspace ONE Access authentication method named CMDB fails because Access auth methods govern SSO, not NSX-T tag inventory for workload firewalling. Exam caveat: CMDB-driven tag orchestration is valid when it results in NSX tags and dynamic groups; CAB memos, T0 routes, and Access auth methods are not tag automation. Operational check: update a CMDB ownership field, run the Ansible/PowerCLI job, confirm the NSX tag on the VM, verify dynamic group membership and Distributed Firewall hits, and document the CMDB-to-tag mapping in the library automation runbook.