2V0-41.24 Question 263
Single answerAn organization is using VMware NSX to segment its network and enforce security policies. The security team wants to ensure that firewall rules are applied consistently to workloads as they move between hosts and clusters. Which of the following workflows would be most appropriate to achieve this objective?
- A
Create Distributed Firewall (DFW) rules and associate them with dynamic security groups.
- B
Configure Gateway Firewall rules on the Tier-1 Gateway.
- C
Manually configure firewall rules on each ESXi host in the cluster.
- D
Use NSX Intelligence to automatically discover and enforce security policies.
Show answer and explanation
Correct answer: A
Explanation
To ensure security policies are consistently applied to workloads as they move between hosts and clusters, administrators should leverage the Distributed Firewall (DFW) in NSX. By associating DFW rules with dynamic security groups, policies automatically follow workloads based on their tags or attributes, ensuring compliance and scalability in dynamic environments.
- A. Correct.
Correct: Distributed Firewall (DFW) rules, when associated with dynamic security groups, ensure consistent enforcement of policies across workloads, even as they are moved between hosts and clusters.
- B. Incorrect.
Incorrect: Gateway Firewall rules are applied at the edge of the network (on Gateways) and are not suitable for enforcing policies at the workload level across multiple hosts.
- C. Incorrect.
Incorrect: Manually configuring firewall rules on each ESXi host is error-prone, time-consuming, and does not scale well for dynamic environments.
- D. Incorrect.
Incorrect: While NSX Intelligence can help discover security gaps and suggest policies, it does not directly enforce firewall rules. Policies must still be created and applied using the Distributed Firewall.