A water utility wants a default-deny stance inside the historian application rather than one data-center-wide rule. What should the administrator configure?
Select an answer to reveal the explanation.
Short Explanation
A policy is a labeled folder of rules, and the folder should hang on the historian group—not on the entire civic data center. That is how you get default deny inside the app without boiling the ocean.
Full Explanation
A water utility that wants default-deny inside the historian application—not one fabric-wide hammer—should use an Application-category security policy scoped to the historian group, including a default deny inside that application. Application scoping contains blast radius while expressing zero-trust inside the historian estate.
A single any-any distributed firewall rule at the fabric default with no application grouping fails least privilege. One gateway firewall rule on the Tier-0 uplink listing every historian port is north-south thinking for an east-west application problem. A Carbon Black prevention policy marked Application and applied to every transport node is not NSX Application-category DFW scoping.
Exam caveat: Application-category policies with scoped default deny are how NSX expresses per-app zero trust.
Operational check: create historian Application policy and groups, allow only required east-west flows, place app-scoped default deny, test, and keep fabric-wide defaults from replacing app policy.
Application-scoped default deny is the water utility’s per-app zero trust. Keep historian Application policy ownership with OT security, review allows quarterly, and ensure fabric-wide defaults never override the historian section without an explicit exception record.