Parks is adding a DR site that needs its own NSX-T security fabric. The requirement is local distributed firewall, not a multi-site routing design. How should NSX-T be deployed there?
Select an answer to reveal the explanation.
Short Explanation
A second fire station does not need a national dispatch network on day one—it needs its own trucks. Stand local Managers and local DFW at parks DR; Federation is a networking design, not the VCP-SEC prerequisite for site security.
Full Explanation
A parks DR site that needs local distributed firewall—not a multi-site routing program—should deploy a local NSX-T Manager cluster and local DFW. Local security fabric at DR meets the requirement without treating NSX Federation as a mandatory prerequisite for site micro-segmentation.
Building Federation with Global Manager first because “every second site requires it” overstates Federation as a security prerequisite when the ask is local DFW. Stretching a single Manager cluster across WAN without a local control plane is a fragile anti-pattern for DR independence. Skipping NSX at DR and relying on Workspace ONE Access policies cannot micro-segment park VMs at the hypervisor data path.
Exam caveat: Federation is a multi-site networking/policy design choice; local Managers plus local DFW are valid when the requirement is site security, not global routing.
Operational check: stand local Managers and prepare local transport nodes at DR, publish local DFW for park workloads, verify realization offline from production Managers, and document DR as an independent security fabric in the parks recovery plan.
Local DR Managers keep parks security recoverable when production is unreachable—Federation can wait for a true multi-site routing program. After local DFW is live at DR, perform an isolated restore or failover tabletop that publishes a DR-only rule, prove it does not depend on production Managers, and file that independence statement with emergency management.