Emergency-operations wants security groups that follow VMs when those VMs move between clusters. Which SDDC network-virtualization concept should the candidate identify?
Select an answer to reveal the explanation.
Short Explanation
When emergency VMs change clusters, their “who can talk” badge should move with them. Workload-centric groups follow the VM; a sticker on the old switch port does not.
Full Explanation
Emergency-operations wants security groups that follow VMs between clusters. That is workload-centric policy defined around groups that move with VMs rather than around a fixed physical port. NSX grouping and distributed firewall bind to workload identity so cluster moves do not require rewriting port-based ACLs. Firewall rules valid only on the original physical switch port fail after migration. Horizon entitlements do not replace distributed firewall grouping for server east-west control. Recabling the destination cluster before policy can apply is the anti-pattern. Exam caveat: destination hosts must be prepared transport nodes in the appropriate zones, and group membership criteria must still match after the move. Operational check: move an emergency test VM to another prepared cluster and verify the same security group and DFW rules remain effective without editing physical ACLs. Keep municipal naming and change tickets aligned with the software objects so civic audits can trace intent. Prefer verifying with a non-production agency workload before promoting the same pattern to life-safety systems. Record realization state and underlay health in the runbook used by on-call city operators.