VMware Certified Advanced Professional - Network Virtualization Deploy Practice Exam 2025: Latest Questions

An administrator is preparing an NSX-T design for a multi-tenant environment. They want centralized management, policy configuration, and lifecycle operations from a single control point. Which NSX-T component provides this functionality?

A team is designing north-south routing for NSX-T. They need dynamic routing with the physical network and must ensure stateful services (for example, NAT) can be applied at the boundary. Which component should be used to provide this north-south connectivity?

An administrator must create a micro-segmentation policy allowing only HTTPS from an application tier to a database tier, while denying all other east-west traffic by default. Which NSX-T feature is best suited to implement this requirement?

After joining a new ESXi host to a cluster, workloads on that host cannot reach overlay segments, while workloads on other hosts can. Which item should be verified first to ensure the host participates in NSX overlay networking?

A customer wants to extend an existing VLAN-backed network into NSX-T while keeping the same IP addressing and default gateway on the physical network. Workloads in NSX should be able to communicate with VLAN workloads without changing the gateway. Which design meets this requirement?

A security team requires that only a specific set of VMs can be placed into a 'PCI' security group, and membership must be based on VM tag criteria rather than static IP addresses. Which NSX-T capability best satisfies this requirement?

An administrator creates a new Tier-1 Gateway and connects multiple overlay segments. East-west traffic between segments works, but north-south traffic to the physical network fails. The Tier-0 and Edge Cluster are known-good for other tenants. What is the most likely missing configuration on the new Tier-1?

A new distributed firewall policy was published, but traffic is still allowed between two VM groups that should be blocked. The rule is present and appears correct. Which NSX-T troubleshooting step is most appropriate to validate which rule is actually being hit by the traffic flow?

A design requires high availability for stateful north-south services and consistent routing behavior during an Edge Node failure. Which approach is recommended to meet this requirement in NSX-T?

After migrating to NSX-T overlay, some VMs intermittently lose connectivity to a remote overlay segment. Packet captures show the underlay MTU is smaller than the encapsulated overlay packets, and fragmentation is occurring. What is the most appropriate corrective action?

An administrator needs to allow ESXi hosts on an overlay transport node profile to dynamically discover remote TEP endpoints without manually adding VTEP IPs. Which NSX-T component provides this function?

A security team wants to restrict access to a three-tier application using identity-based rules for end users connecting to the web tier. Which NSX-T feature should be used to meet this requirement?

A network team wants to simplify VLAN-backed segment deployment for multiple clusters by ensuring the correct VLAN and teaming policy are applied automatically when a segment is created. What NSX-T construct best supports this goal?

A customer requires multi-tenancy where each tenant has its own routing domain and can advertise identical RFC1918 subnets without conflict. Tenants must also have independent north-south policies and NAT. Which design best meets the requirement?

An application uses an FQDN that resolves to multiple IP addresses which can change frequently. The security team wants firewall rules to automatically adapt without manual IP updates. What is the most appropriate NSX-T approach?

A virtual machine connected to an overlay segment cannot reach its default gateway on the Tier-1. Other VMs on the same segment can reach it. The VM can ping other VMs on the segment. No firewall rules are configured to block traffic. Which is the most likely cause?

A provider must offer centralized north-south firewalling for multiple Tier-1 gateways while keeping east-west enforcement distributed at the vNIC. Which NSX-T capability combination best satisfies this requirement?

After deploying a new Edge node, an administrator notices that north-south traffic intermittently fails when the active Edge changes during maintenance. The configuration uses a Tier-0 with stateful services enabled. Which deployment choice most directly improves service continuity during Edge failover events?

An organization has strict change control and wants deterministic security policy evaluation across multiple teams. They want to prevent a tenant team from accidentally overriding a platform team's critical deny rules. Which NSX-T policy design best addresses this?

A troubleshooting engineer observes that a VM on an overlay segment can reach VMs on the same ESXi host but not VMs on other hosts. The VM can ARP for local peers but remote peer MAC addresses are not learned. Underlay IP connectivity between host TEPs is confirmed. Which is the most likely NSX-T issue?

An administrator must provide north-south connectivity for multiple overlay segments to an existing physical network. The physical network team requires a dynamic routing protocol and wants the NSX-T environment to advertise connected overlay networks. Which NSX-T component should be configured to meet this requirement?

A security team requires micro-segmentation rules that follow workloads as they move between clusters. The team wants to avoid using IP addresses due to frequent IP changes. Which object type should the administrator use as the primary match criteria in Distributed Firewall rules?

A deployment uses Transport Node Profiles to prepare ESXi hosts. Some hosts fail to join the transport node collection with an error indicating insufficient available IP addresses for tunnel endpoints. Which configuration should be checked first to resolve this issue?

An organization wants to insert a third-party firewall appliance into specific east-west flows between two application tiers while keeping other east-west traffic distributed for performance. Which NSX-T feature best meets this requirement?

After configuring a Tier-0 Gateway with BGP to a physical router, routes from NSX appear on the physical router, but no routes from the physical router are learned in NSX. The BGP neighbor status shows 'Established' on both sides. Which NSX-T configuration is the MOST likely cause?