After first boot of the 911 NSX Managers, the install checklist requires SSH and API access only from jump hosts. How should the administrator treat that requirement?
Select an answer to reveal the explanation.
Short Explanation
The NSX management plane is the 911 station's master key box—only the jump room should reach it. Limit SSH and API to those networks during setup. Opening the WAN or swapping in Carbon Black Live Response is not Manager hardening.
Full Explanation
After first boot of 911 NSX Managers, harden management-plane access so SSH and API are limited to jump-host networks as part of setup. Emergency services control planes should not expose administrative protocols across the entire civic WAN.
Opening SSH and API to the entire civic WAN so on-call staff can reach Managers from home expands attack surface unacceptably. Moving Manager SSH onto Carbon Black Live Response does not replace network restriction of the management plane. Publishing Manager SSH through Workspace ONE Access as a SaaS web application misstates how Manager SSH/API hardening works.
Exam caveat: management-plane allow lists to jump hosts are install hardening, not optional polish after incidents.
Operational check: apply firewall or NSX rules restricting Manager SSH/API to jump networks, test admin access from the jump host and deny from a general VLAN, and document the jump-host standard in the 911 NSX hardening checklist.
Jump-host-only SSH/API on 911 Managers is the same discipline used for emergency radio consoles: limited doors, logged entry. Validate denies from a general workstation VLAN, forward Manager audit logs to the civic SIEM, and include management-plane allow lists in every tabletop for ransomware affecting the control plane.