A county wants east-west controls between tax and GIS VMs that sit on the same cluster. Which NSX Data Center benefit matches that use case?
Select an answer to reveal the explanation.
Short Explanation
Same cluster does not mean same trust. NSX puts a firewall at the vNIC so tax and GIS can share hosts without sharing an open LAN. DRS and a giant VLAN are not that east-west control.
Full Explanation
East-west controls between tax and GIS VMs on the same cluster map to Distributed Firewall micro-segmentation, a primary NSX Data Center security benefit. Policy is enforced near the vNIC so same-host or same-cluster traffic can be allowed or denied without depending only on a north-south perimeter. vSphere DRS balances compute load; it is not an east-west firewall between those VMs. Stretching a single VLAN to every rack is a traditional Layer 2 approach and is not micro-segmentation. Disabling the underlay so the VMs cannot communicate at all is not a controlled security benefit—it simply breaks required application paths. Exam caveat: micro-segmentation is policy-driven east-west filtering, not connectivity destruction or a DRS substitute. Operational check: place tax and GIS VMs in tagged groups, publish DFW rules that permit only required ports, generate a denied flow in Traceflow or logs, and confirm the underlay remains healthy while the deny is enforced in the kernel firewall for the county security baseline. In municipal operations, record the chosen control and the rejected distractors in the change ticket so future on-call staff understand which failure modes would affect city services. Re-validate after the next maintenance window that the same design still holds for the current NSX build and the agency workloads that depend on it.