Courts must keep production case-management VMs from talking to the test cluster even if an Application-category rule later allows the same ports. Where should the prod-versus-test separation be placed?
Select an answer to reveal the explanation.
Short Explanation
NSX reads the policy book from the top. Environment sits above Application, so prod must not hug test gets decided before the app’s port list even speaks.
Full Explanation
Courts must keep production case-management VMs from talking to the test cluster even if a later Application-category rule allows the same ports. Place prod-versus-test separation in the Environment category so those rules evaluate before Application-category rules and win on first match.
Putting separation only in Application because “Environment is evaluated after Application” reverses category order. Ethernet-category Layer-2 MAC allows are the wrong layer for this environment separation story. A Workspace ONE Access risk policy that NSX evaluates after Application is not part of NSX category precedence.
Exam caveat: Environment before Application—use Environment for prod/test (and similar) separation that must outrank app allows.
Operational check: create Environment deny between prod and test case-management groups, attempt an Application allow on the same ports, confirm Environment still denies, and document category strategy for courts.
Environment-before-Application ordering protects courts prod from test even when ports match. Include category order in engineer onboarding quizzes, and periodically attempt a deliberate Application allow that should lose to Environment deny in a lab mirror of case-management.