An elections office wants one NSX group for the tabulation application and another for the election-night zone, then DFW rules that mean tabulation-app inside that zone. What construct should the administrator use?
Select an answer to reveal the explanation.
Short Explanation
Nested groups are folders inside folders. Drop the tabulation app group into the election-night zone group and the rule can talk about both in one breath.
Full Explanation
An elections office that wants one NSX group for the tabulation application and another for the election-night zone, then rules meaning tabulation-app inside that zone, should nest the application group inside the zone group so policy can target the combined membership. Nested groups express intersection-style intent without flattening everything into one IP set.
Flattening every VM into a single IP set abandons grouping discipline. Creating two Carbon Black sensor groups and nesting them in NSX Applied To does not nest NSX security groups. Using only a Tier-1 static route to express app-plus-zone membership confuses routing with security grouping.
Exam caveat: nested NSX groups are the construct for app-inside-zone policy wording.
Operational check: create tabulation and election-night groups, nest app into zone, publish DFW using the nested group, verify only in-zone tabulation members match, and document nesting for election-night runbooks.
Nested tabulation-inside-zone groups keep election-night intent readable. Export effective members before polls open, freeze membership changes during certification windows, and rehearse the nest in a dry run so night-shift engineers are not inventing IP sets under pressure.