Public-health on-premises NSX-T uses a default-deny Distributed Firewall. The agency's cloud SDDC still has any-any on its NSX-T instance. Auditors ask why production-like workloads are wide open in the cloud. What should the administrator flag?

When public-health on-premises NSX-T uses a default-deny Distributed Firewall but the agency's cloud SDDC still has any-any on its NSX-T instance and auditors ask why production-like workloads are wide open in the cloud, flag inconsistent security posture across clouds: the cloud SDDC needs equivalent NSX-T Distributed Firewall policy, not an assumption that on-premises default deny covers it. Each NSX fabric enforces its own policy; on-premises default deny does not stretch to a separate cloud NSX any-any estate. Closing that gap restores civic parity for clinical workloads. NSX Federation is required on this security exam, so on-premises default deny already stretches automatically fails by concept because Federation is not automatically present and on-prem deny does not auto-stretch without a designed multi-site policy model. Carbon Black Cloud prevent-only on on-premises sensors is sufficient parity for the cloud SDDC fails by concept because endpoint prevent-only is not equivalent to cloud SDDC micro-segmentation. Workspace ONE UEM compliance on staff laptops substitutes for cloud SDDC micro-segmentation fails by concept because laptop compliance does not micro-segment cloud SDDC workloads. Exam caveat: hybrid clouds need equivalent DFW posture per fabric—do not claim Federation auto-stretch, CBC, or UEM replace cloud SDDC policy. Operational check: implement default-deny-equivalent DFW in the cloud SDDC, compare rule coverage to on-premises, remediate gaps found by audit, and publish a multi-cloud posture checklist in the public-health security governance pack for municipal healthcare compliance.