The city SOC enables the host-based firewall in Carbon Black Cloud policy for remote assessor laptops. How should that control be understood?
Select an answer to reveal the explanation.
Short Explanation
Think laptop deadbolt, not data-center corridor gates. Carbon Black host firewall lives in the sensor policy on those assessor PCs and does not stand in for NSX Distributed Firewall.
Full Explanation
When the city SOC enables the host-based firewall in Carbon Black Cloud policy for remote assessor laptops, understand it as a Carbon Black Cloud sensor policy setting on those endpoints—not a replacement for NSX-T Distributed Firewall. Think laptop deadbolt, not data-center corridor gates. Treating it as replacing NSX-T Distributed Firewall for every civic SDDC workload fails by concept because CBC host firewall is endpoint policy, while NSX DFW protects east-west SDDC workloads. Configuring it on the T0 gateway as an identity firewall section fails because host firewall is not an NSX T0 Identity Firewall object. Calling it a Workspace ONE Access network-range policy that blocks SMB fails because Access network ranges govern SSO conditions, not CBC sensor host firewall. Exam caveat: keep VMware firewall planes distinct—CBC host firewall on sensors versus NSX DFW/Identity Firewall in the SDDC versus Access network ranges for auth. Operational check: confirm the host-firewall setting is enabled on the assessor sensor policy, verify rules apply on a sample laptop, and ensure NSX DFW remains in place for SDDC workloads independently. Document which plane owns which control in the assessor remote-access design so future tickets do not disable NSX thinking CBC replaced it.