VCP-VMC 2024 Question 191
Select 3A VMware Cloud Administrator is troubleshooting a workload running in VMware Cloud on AWS. The application is experiencing intermittent connectivity issues. Upon investigation, the administrator notices that the NSX Distributed Firewall (DFW) rules were recently updated. What steps should the administrator take to resolve the issue?
- A
Check the firewall rule logs to verify if traffic is being allowed or denied.
- B
Verify the sequence of the firewall rules to ensure no conflicting rules are overriding the intended behavior.
- C
Disable the NSX Distributed Firewall to confirm if it resolves the connectivity issue.
- D
Ensure that the Management Gateway (MGW) firewall rules are not blocking the workload traffic.
- E
Inspect the application’s logs for errors unrelated to network configuration.
Show answer and explanation
Correct answers: A, B, D
Explanation
The connectivity issue is likely related to recent changes in the NSX Distributed Firewall rules. The administrator should follow a systematic approach to identify if the rules are causing the problem. Analyzing firewall logs and verifying rule sequences can help pinpoint misconfigurations. Additionally, checking the Management Gateway firewall ensures that no other network component is contributing to the issue. Disabling the firewall is not a safe practice during troubleshooting, and application logs are not the primary focus in this NSX-related scenario.
- A. Correct.
Checking firewall rule logs helps determine if the traffic is being blocked or allowed, which is essential for pinpointing the issue.
- B. Correct.
The sequence of firewall rules in NSX DFW is critical, as a higher-priority rule may override a lower-priority rule, causing unintended behavior.
- C. Incorrect.
Disabling the NSX Distributed Firewall is not a recommended troubleshooting step as it may introduce security risks and disrupt other workloads.
- D. Correct.
The Management Gateway (MGW) firewall also controls traffic and could be another potential source of the issue if incorrectly configured.
- E. Incorrect.
While inspecting application logs is a good practice, this specific scenario focuses on NSX Distributed Firewall troubleshooting and does not immediately suggest an application-level issue.