Distributed Firewall rules for fleet-maintenance VMs should follow tags rather than static IP lists. Which NSX-T feature defines that dynamic membership?
Select an answer to reveal the explanation.
Short Explanation
Tag the fleet VMs and drop them in a group — the firewall then follows the name tag, not a typed IP list. Snapshots, Horizon pools, and vSAN policies are not that membership list.
Full Explanation
NSX tags and groups define dynamic membership that Distributed Firewall and gateway firewall can use as sources and destinations. Fleet-maintenance DFW rules should follow tags rather than static IP lists so policy tracks the workload like a name badge. That is the security-inventory feature for policy that follows civic workloads as they move. vSphere snapshots capture VM state; they are not security groups. Horizon desktop pools are EUC inventory and are not NSX groups. vSAN storage policies govern disks, not DFW membership. Exam caveat: tags must be applied consistently and groups must use those tags—empty or mistyped tags produce empty groups and surprising allows or denies. Operational check: tag fleet-maintenance VMs, build an Inventory Group from the tag, use the group in a DFW rule, vMotion a VM, and confirm membership and enforcement still follow without editing IP lists. Document the civic rationale in the change record so the next operator can restate why the correct control matches the agency outcome, why each distractor fails by concept, and which NSX Manager view confirms the result after publish. Document the civic rationale in the change record so the next operator can restate why the correct control matches the agency outcome, why each distractor fails by concept, and which NSX Manager view confirms the result after publish.