Harborview keeps ESXi management on its own VLAN port group and keeps virtual-machine traffic on different port groups. Which vSphere networking concept is that separation?

Harborview keeping ESXi management on its own VLAN port group while virtual-machine traffic uses different port groups is separating VMkernel service networks from virtual-machine port groups. Staff hallways and public offices should not share the same door: management, vMotion, and other host services ride VMkernel adapters on dedicated networks, while guest application traffic rides VM port groups. That separation is a foundational vSphere networking concept for the civic SDDC. NSX micro-segmentation implemented as a Distributed Firewall policy enforces east-west allow or deny between workloads; it is valuable security but is not the same as splitting management VMkernel networks from VM port groups on the switch. An NSX overlay transport zone that replaces vCenter is incorrect on both counts—transport zones do not replace vCenter, and they are not the named concept of VMkernel versus VM port-group separation. Carbon Black host isolation from the endpoint console quarantines endpoints and does not define vSphere service versus VM network separation. Exam caveat: good designs still combine network separation with firewalling; the exam ask here is identifying the vSphere separation concept. Operational check: list VMkernel adapters and their port groups or VLANs, confirm management is not sharing a general VM data port group, and verify VM traffic uses distinct port groups as intended.