A water utility must prove OT historian VMs stay in a Distributed Firewall group separate from citizen portal VMs for NERC-like separation evidence. What should the administrator produce?
Select an answer to reveal the explanation.
Short Explanation
Who is on the plant-floor roster is the whole question. Export the OT Distributed Firewall group, line it up with the asset inventory, and prove the citizen portal VMs are not on that list.
Full Explanation
A water utility proving OT historian VMs stay in a Distributed Firewall group separate from citizen portal VMs for NERC-like separation must map current NSX-T security-group membership to the OT asset inventory and show citizen VMs are not members. Treat group membership as the utility fence line roster: auditors need the live list of who is inside the OT yard, not a theory paper. A Biba-model write-up with no security-group membership export fails by concept because integrity-model prose without membership data does not prove OT separation in NSX. vMotion compatibility lists from the disaster-recovery cluster fail because vMotion compatibility is migration feasibility, not OT versus citizen group membership. Workspace ONE Intelligent Hub version numbers for SCADA hosts that are not enrolled fail because Hub versions on unenrolled SCADA hosts do not show NSX security-group separation. Exam caveat: group membership mapped to OT inventory is the assurance artifact for OT separation; integrity essays, vMotion lists, and Hub versions are not membership proof. Operational check: export OT security-group members, reconcile to the OT asset inventory, confirm citizen portal VMs are absent, re-check after asset changes, and archive the membership map for the utility separation evidence pack.