Permit-system VMs need a shared logical Layer 2 broadcast domain even when they sit in different racks. Which SDN building block provides that virtual switching?
Select an answer to reveal the explanation.
Short Explanation
A segment is the software version of a VLAN—one virtual hallway the permit VMs can shout across, even if they live in different racks. A datastore holds disks, and smart groups or watchlists are not Layer 2 networks.
Full Explanation
Permit-system virtual machines that need one logical Layer-2 broadcast domain across different racks use an NSX segment (logical switch). The segment is the SDN virtual-switching building block: attached vNICs share a broadcast domain independent of physical rack or host location because overlay encapsulation carries the frames between prepared hosts. A vSphere datastore presents storage capacity for VMDKs; mounting a datastore is not connecting a network and cannot create a broadcast domain. A Workspace ONE smart group enrolls or targets devices for management and is not an L2 network. A Carbon Black watchlist tracks endpoint detections or isolation intent; it does not switch Ethernet frames among permit VMs. Exam caveat: the segment still depends on transport-zone membership and transport-node preparation; creating a segment alone does not magically attach hosts outside the zone. Associate depth is identifying the segment as the L2 construct, not designing multi-tier routing. Operational check: create the segment in the correct transport zone, attach permit VMs on different racks/hosts, and verify they share L2 (ARP/ping) while confirming datastore, Workspace ONE, and Carbon Black objects are not listed as the VM network attachment.