2V0-41.24 Question 52
Select 2You are tasked with designing a logical switching solution in an NSX-T Data Center environment for a multi-tenant setup. The tenants require network segmentation to isolate their workloads while ensuring they can connect to shared services like DNS and NTP servers. Which feature(s) of NSX-T logical switching would best address these requirements?
- A
Use VLAN-backed segments for tenant isolation and configure a centralized gateway for shared services.
- B
Create overlay-backed segments with unique Virtual Network Identifiers (VNIs) for each tenant and configure routers to connect to shared services.
- C
Leverage NSX-T Segment Profiles to enforce security policies for each tenant's segment.
- D
Use a single overlay segment for all tenants and apply Distributed Firewall (DFW) rules for traffic isolation.
- E
Configure Transport Zones to separate tenant traffic and connect them to an Edge Cluster for shared services.
Show answer and explanation
Correct answers: B, C
Explanation
To address multi-tenant network segmentation and shared service connectivity, overlay-backed segments with unique VNIs provide scalable and secure isolation. NSX-T Segment Profiles add an additional layer of security and operational policies tailored to each tenant. Combining these features ensures both isolation and shared service access while leveraging the advanced capabilities of NSX-T logical switching.
- A. Incorrect.
Using VLAN-backed segments can provide isolation, but they are less scalable compared to overlay-backed segments, especially in a multi-tenant environment. This approach does not leverage the full capabilities of NSX-T logical switching.
- B. Correct.
Overlay-backed segments with unique VNIs allow for tenant network segmentation and scalability. Configuring routers ensures shared services like DNS and NTP are accessible without compromising isolation.
- C. Correct.
NSX-T Segment Profiles can enforce specific security and operational policies for each tenant's segment, which helps maintain isolation and compliance.
- D. Incorrect.
A single overlay segment for all tenants would not meet the requirement for network segmentation, as it would allow tenants to potentially access each other's workloads despite Distributed Firewall rules.
- E. Incorrect.
Transport Zones are used to define the scope of logical networking but do not inherently provide tenant isolation or connectivity to shared services. This alone is not sufficient for the given scenario.