2V0-41.24 Question 282
Single answerAn administrator is tasked with creating a new segment in VMware NSX-T to isolate a group of VMs. The segment must allow communication between VMs on the same segment but block traffic to external networks or other segments. Which configuration step should the administrator take to ensure this requirement is met?
- A
Configure the segment with an overlay transport zone and enable the 'Connected Gateway' option.
- B
Configure the segment with a VLAN transport zone and set an appropriate VLAN ID.
- C
Configure the segment without attaching it to any Tier-1 or Tier-0 Gateway.
- D
Configure the segment with an overlay transport zone and attach it to a Tier-1 Gateway with firewall rules to block external traffic.
Show answer and explanation
Correct answer: C
Explanation
To isolate a segment and restrict communication to only intra-segment traffic, the segment should not be attached to any Tier-1 or Tier-0 Gateways. This ensures no routing or external network access is available, meeting the requirement to block traffic to external networks or other segments.
- A. Incorrect.
This option is incorrect because enabling the 'Connected Gateway' option would attach the segment to a Tier-1 Gateway, which allows routing to external networks unless explicitly blocked.
- B. Incorrect.
This option is incorrect because configuring a VLAN transport zone with a VLAN ID is used for VLAN-backed segments, but it does not inherently block traffic to external networks or other segments.
- C. Correct.
This option is correct because creating a segment without attaching it to any Tier-1 or Tier-0 Gateway ensures the segment remains isolated, allowing only intra-segment communication between VMs.
- D. Incorrect.
This option is incorrect because attaching the segment to a Tier-1 Gateway introduces routing capabilities, and additional firewall rules would be needed to achieve isolation. This is unnecessary when isolation is the primary goal.