Public health wants every VM whose name starts with ehr- in one NSX security group, but also wants membership that survives a later rename. What should the administrator recommend?
Select an answer to reveal the explanation.
Short Explanation
A name prefix works—until someone helpfully renames ehr-sql01 to sql-ehr-01 and the VM falls out of the club. Tags stay put when the hostname changes.
Full Explanation
Public health can build an NSX security group today with name-prefix criteria for VMs starting with ehr-, but tag-based membership is the more durable pattern when VMs are renamed later. Prefix groups break when helpful operators rename ehr-sql01 to sql-ehr-01; tags survive hostname churn on clinical systems.
Claiming name-prefix membership is the only supported NSX group type and tags cannot be used is false. Replacing the group with a nightly CSV of BIOS UUIDs from vCenter is brittle automation theater. Using a Workspace ONE Access group named ehr- as Applied To confuses IdP groups with NSX workload membership.
Exam caveat: prefer tags for durable EHR grouping when renames are likely; prefixes are convenience, not destiny.
Operational check: tag EHR VMs, build tag-based groups, demonstrate a rename that keeps membership, migrate off prefix-only groups for critical clinical policy, and publish a tagging standard.
Tags outlive EHR renames that break prefix groups in public health. Migrate critical clinical rules to tags, keep prefixes only for temporary discovery, and add a rename playbook that checks NSX membership before hostname changes in change windows. Keep before/after membership proof across an EHR rename with the clinical change record so the next on-call engineer can prefer tags over prefixes without rediscovering hostname fragility under pressure.