A city wants to stop sending east-west traffic between library VMs out to a hardware firewall and back. Which NSX Data Center benefit matches that use case?
Select an answer to reveal the explanation.
Short Explanation
Hairpinning is like sending two clerks on the same floor out through the street and back just to talk. NSX inspects at the vNIC in the hypervisor instead. That distributed enforcement is the benefit.
Full Explanation
Stopping east-west hairpinning between library VMs is a Distributed Firewall benefit: in-kernel enforcement at the vNIC inspects traffic on the host path so VM-to-VM packets need not leave to a hardware firewall and return. That removes the trombone path traditional designs impose on same-cluster traffic. Forcing all library VM-to-VM traffic through a single physical firewall pair preserves hairpinning and its latency and capacity costs. Disabling the Distributed Firewall so hairpinning remains required is the opposite of the benefit. Using vMotion as an east-west packet filter confuses mobility with security inspection. Exam caveat: some north-south or compliance flows may still use gateway or perimeter firewalls; the benefit is about east-west distribution, not abolishing all edge inspection. Operational check: capture a same-host east-west flow between library tiers, confirm it is allowed or denied by DFW without traversing the perimeter pair, and document residual north-south paths that still use the gateway firewall on updated library application diagrams. In municipal operations, record the chosen control and the rejected distractors in the change ticket so future on-call staff understand which failure modes would affect city services. Re-validate after the next maintenance window that the same design still holds for the current NSX build and the agency workloads that depend on it.