Courts must keep production case-management VMs from talking to the test cluster even if an Application-category rule later allows the same ports. Where should the prod-versus-test separation be placed?
Select an answer to reveal the explanation.
Short Explanation
NSX reads the policy book from the top. Environment sits above Application, so prod must not hug test gets decided before the app’s port list even speaks.
Full Explanation
NSX-T distributed firewall categories evaluate in a fixed order: Ethernet, Emergency, Infrastructure, Environment, then Application. Environment is the intended place for prod-versus-test isolation so those hits occur before Application rules. Placing the separation only in Application, treating Ethernet as a MAC override, or using Access does not produce that precedence.