City innovation staff ask whether moving to an SDDC means the city can retire firewalls. What should the operator identify?
Select an answer to reveal the explanation.
Short Explanation
Software-defined is not the same as "no security gear." The city still firewalls; the enforcement just moves into the hypervisor. Turning off every firewall because NSX arrived would be like removing every lock because the keys are digital.
Full Explanation
Firewalling is virtualized in software—for example with a distributed firewall—but the city does not stop using firewalls when it adopts an SDDC. Innovation staff should expect micro-segmentation and gateway firewall services as first-class controls, not a firewall-free overlay. Overlay tunnels are not inherently a replacement for policy. Carbon Black prevention is endpoint security, not the network firewall plane. A Horizon Unified Access Gateway may protect VDI access but is not "the only remaining firewall" for the data center. Exam caveat: physical edge firewalls often remain for north-south internet boundaries while NSX handles much east-west and software-defined edge policy. Operational check: show a distributed firewall rule protecting a civic app tier and identify where north-south perimeter policy still applies. Keep municipal naming and change tickets aligned with the software objects so civic audits can trace intent. Prefer verifying with a non-production agency workload before promoting the same pattern to life-safety systems. Record realization state and underlay health in the runbook used by on-call city operators. Keep municipal naming and change tickets aligned with the software objects so civic audits can trace intent.