Water-utility Site Recovery Manager recovery places OT jump boxes on a disaster-recovery cluster that also hosts citizen portal VMs. What must the administrator preserve?
Select an answer to reveal the explanation.
Short Explanation
Disaster recovery is not an excuse to seat the plant-floor jump boxes in the lobby. Keep the same grouping and Distributed Firewall isolation so OT stays off the citizen DMZ even at DR.
Full Explanation
When water-utility Site Recovery Manager recovery places OT jump boxes on a disaster-recovery cluster that also hosts citizen portal VMs, the administrator must preserve DR security groups and Distributed Firewall policy that keep OT jump boxes isolated from the citizen DMZ. Treat OT jump boxes as utility control rooms that must not share an open hallway with the citizen lobby even at the warm site. Recovering OT jump boxes onto the citizen DMZ segment to simplify addressing fails by concept because address convenience must not collapse OT and citizen trust zones. Disabling Distributed Firewall at DR so all recovered VMs can find each other fails because unconstrained east-west access destroys the isolation the utility must preserve. Using Horizon desktop pools as the OT isolation boundary at DR fails because Horizon pool design is not NSX-T Distributed Firewall isolation between OT jump boxes and citizen workloads. Exam caveat: DR must carry forward OT versus citizen security groups and DFW policy; co-location on a cluster does not justify mixing segments or disabling DFW. Operational check: verify DR groups and DFW rules isolate OT jump boxes from citizen portal VMs, Traceflow between zones expecting deny, and document OT isolation preservation in the utility SRM runbook.