The business-license desk needs its own logical router southbound to agency segments, linking north to the city's provider gateway. Which gateway role is that?

A Tier-1 gateway is the tenant or department logical router: it connects southbound to overlay segments for the business-license desk and northbound to a Tier-0 that serves as the city's provider gateway. Tier-1 is the department lobby—segments hang off it, and it walks upstairs to the city's Tier-0 rather than buying a hardware router per desk. A VLAN transport zone defines span for VLAN-backed segments; it does not replace the department router. vCenter HA restarts VMs after host failure and is not the tenant router. NSX Intelligence analyzes flows and can recommend policy; it is not the southbound gateway for agency segments. Exam caveat: when stems ask for the departmental southbound router that still links to a provider gateway, the role is Tier-1, not Tier-0 and not a transport zone. Operational check: create or inspect the business-license Tier-1, confirm segments attach south and a Tier-0 link exists north, test default-gateway reachability from a desk VM, and ensure Intelligence, vCenter HA, and VLAN transport zones were not named as that router. Keep the civic framing visible in runbooks so the next operator can restate why the correct control fits the agency outcome, why each distractor fails by concept, and which Manager or fabric view proves the design after change.