Clinic VMs on the same overlay segment must not talk east-west except for approved application ports. Which NSX-T feature enforces that micro-segmentation?
Select an answer to reveal the explanation.
Short Explanation
Micro-segmentation is a lock on each clinic vNIC, not a trip to a hardware firewall. That lock is Distributed Firewall. vMotion moves VMs, vSAN encrypts disks, and BLAST draws desktops.
Full Explanation
Distributed Firewall enforces east-west policy at the virtual NIC, which is NSX-T micro-segmentation for clinic VMs on the same overlay segment. Workloads can share a segment yet still be isolated except for approved application ports—locks on each clinic door rather than a trip to a hardware firewall. vMotion is live migration, not a firewall. vSAN encryption protects data at rest on disks and is not Distributed Firewall. Horizon BLAST is a display protocol and is not micro-segmentation. Exam caveat: micro-segmentation is about policy at the vNIC; being on the same segment does not imply unrestricted east-west trust. Operational check: place clinic tiers in groups, publish allow rules only for required ports with default deny, generate unauthorized east-west traffic and confirm drop, and verify vMotion, vSAN encryption, and BLAST were not used as the control. Document the civic rationale in the change record so the next operator can restate why the correct control matches the agency outcome, why each distractor fails by concept, and which NSX Manager view confirms the result after publish. Document the civic rationale in the change record so the next operator can restate why the correct control matches the agency outcome, why each distractor fails by concept, and which NSX Manager view confirms the result after publish.