County guest Wi-Fi VMs must not talk to court case-management VMs, and both can land on the same overlay transport. What control should the administrator use?
Select an answer to reveal the explanation.
Short Explanation
Overlay east-west can walk around a ToR ACL like a skybridge over a locked lobby door. Distributed Firewall rides with the VM, so guest Wi-Fi still cannot reach case-management. Access policies and USB device control are not that packet path.
Full Explanation
County guest Wi-Fi VMs must be kept from court case-management VMs even when both can land on the same overlay transport. Distributed Firewall with security groups follows the VMs and enforces east-west policy where physical ToR ACLs cannot see encapsulated overlay conversations.
A physical top-of-rack ACL only assumes overlay east-west still hits the ToR, which Geneve overlay often bypasses between hosts. Workspace ONE Access policies do not filter VM-to-VM packets on the overlay. Carbon Black Cloud device-control USB rules on court VMs address peripherals, not overlay east-west isolation from guest Wi-Fi workloads.
Exam caveat: overlay east-west security is a DFW problem; physical ACL-only answers are classic traps.
Operational check: place guest Wi-Fi and case-management VMs in distinct groups, publish deny between them, migrate a test pair across hosts, confirm deny still hits, and document overlay-aware micro-segmentation for courts.
Overlay-aware DFW keeps guest Wi-Fi VMs from quiet walks into court case data when ToR ACLs never see Geneve. After deny rules publish, vMotion both endpoints, retest, and archive Traceflow screenshots proving enforcement survived host movement for the courts accreditation package.