A city needs east-west isolation between permitting web VMs and tax database VMs that share the same NSX segment. Which firewall should the administrator configure?
Select an answer to reveal the explanation.
Short Explanation
Same-segment VM-to-VM is hallway traffic, not the front door. Distributed Firewall sits on the vNIC and can separate permitting web from the tax database without a north-south hairpin. Gateway firewall and ToR ACLs miss that east-west path.
Full Explanation
East-west isolation between city permitting-web and tax-database VMs that share the same NSX segment is enforced with Distributed Firewall rules between those security groups. Same-segment overlay conversations are filtered at the vNIC by DFW; they do not need to hairpin to a Tier-0 to be controlled.
Gateway firewall rules on the Tier-0 uplink miss same-segment east-west that never leaves toward the gateway. A physical top-of-rack ACL between two ports on the same host fails when overlay traffic never hits that ACL path. Carbon Black Cloud prevention is endpoint control and is not the primary east-west network micro-segmentation engine for those VM groups.
Exam caveat: same-segment east-west → DFW; north-south at uplink → gateway firewall—do not swap them.
Operational check: build permitting-web and tax-database groups, publish DFW allow/deny between them, generate test traffic on the shared segment, confirm DFW hits, and show Traceflow does not require Tier-0 for the deny.
Same-segment permitting-to-tax isolation is why cities buy Distributed Firewall. After groups and rules publish, run Traceflow between the VMs, confirm the drop is DFW not routing, and show leadership that Tier-0 ACLs were never in the path—so future designs stop requesting physical ACL “fixes” for overlay neighbors.