County finance requires Spoof Guard on the treasury overlay so VMs cannot spoof MAC or IP addresses. How is that enabled in the NSX GUI?
Select an answer to reveal the explanation.
Short Explanation
Spoof Guard is a name-tag checker at the segment door: only the MAC/IP NSX already learned may speak. Stick a Spoof Guard segment profile on the treasury segment in Networking—IDFW, FT, and NAT64 are not that checker.
Full Explanation
County finance Spoof Guard on the treasury overlay is enabled by applying a Spoof Guard segment profile to that finance segment in Networking. Spoof Guard constrains VMs from using unauthorized MAC/IP bindings on the civic treasury LAN, reducing spoofing risk against financial workloads. Identity Firewall on the Tier-0 uses directory groups for user-based firewalling; it is not Spoof Guard for MAC/IP spoofing on a segment. vSphere Fault Tolerance duplicates a VM for compute continuity; it is not an anti-spoof segment control. NAT64 on the Edge translates IPv6/IPv4; it is not the VCTA-NV Spoof Guard method. Exam caveat: Spoof Guard can break legitimate dual-homed or manually configured addresses if discovery/allow lists are wrong—coordinate with finance sysadmins before enforcing on production treasury VMs. Operational check: attach Spoof Guard to the treasury segment, test a known-good VM, attempt an unauthorized address change in a lab clone, confirm block, and document the profile in the finance security baseline. In municipal operations, record the chosen control and the rejected alternatives in the change ticket so future on-call staff understand which failure modes would affect city services. Re-validate after the next maintenance window that the same GUI path and realized state still hold under the current NSX build used by the civic platform team.