Water-utility compute hosts need overlay for distributed firewall and Guest Introspection, while Edge uplinks need VLAN connectivity to the civic core. How should transport zones be assigned?
Select an answer to reveal the explanation.
Short Explanation
Transport zones are labeled pipes: overlay for apartment hallways, VLAN for the street hookup. Hang the overlay TZ on compute so DFW and Guest Introspection land there, and hang the VLAN TZ on Edge uplinks—do not mash both into one overlay pipe.
Full Explanation
Transport zones are deliberate assignments: water-utility compute hosts that need overlay for Distributed Firewall and Guest Introspection belong on the overlay transport zone, while Edge uplinks that must reach the civic core on VLANs belong on the VLAN transport zone as designed. Mixing those roles collapses the labeled pipes that keep overlay hallways and street uplinks distinct.
Putting compute and Edge on a single overlay transport zone and ignoring VLAN uplinks breaks the Edge’s VLAN connectivity model to the core. Leaving transport zones empty and attaching DFW directly to vCenter clusters skips NSX fabric preparation entirely. Using a Workspace ONE Access network range as the transport zone confuses IdP client-IP ranges with NSX host-switch transport design.
Exam caveat: overlay TZ for prepared compute security path; VLAN TZ for Edge uplinks—exam items often punish “one TZ for everything.”
Operational check: assign overlay TZ to SCADA or historian compute, assign VLAN TZ to Edge uplinks, confirm TEPs and uplinks healthy, then validate DFW/GI on compute and gateway path on Edges separately.
Mis-assigned transport zones show up later as mysterious uplink or GI failures on water-utility hosts. After assigning overlay to compute and VLAN to Edge uplinks, verify TEP interfaces on compute, confirm Edge uplinks learn civic core VLANs, and only then enable Guest Introspection and DFW pilots so troubleshooting stays on one plane at a time.