A company Is deploying NSX micro-segmentation in their vSphere environment to secure a simple application composed of web. app, and database tiers.
The naming convention will be:
* WKS-WEB-SRV-XXX
* WKY-APP-SRR-XXX
* WKI-DB-SRR-XXX
What is the optimal way to group them to enforce security policies from NSX?
The answer is C. Group all by means of tags membership.
In the scenario, the company is deploying NSX micro-segmentation to secure a simple application composed of web, app, and database tiers. The naming convention will be:
WKS-WEB-SRV-XXX
WKY-APP-SRR-XXX
WKI-DB-SRR-XXX
Using tags membership has several advantages over the other options:
It is more simple and efficient than doing a service insertion to accomplish the task. Service insertion is a feature that allows for integrating third-party services with NSX, such as antivirus or intrusion prevention systems. Service insertion is not necessary for basic micro-segmentation and can introduce additional complexity and overhead.
It is more flexible and granular than creating an Ethernet based security policy. Ethernet based security policy is a type of policy that uses MAC addresses as the source or destination criteria. Ethernet based security policy is limited by the scope of layer 2 domains and does not support logical constructs such as segments or groups.
To learn more about tags membership and how to use it for micro-segmentation in NSX, you can refer to the following resources:
VMware NSX Documentation: Security Tag 1
VMware NSX Micro-segmentation Day 1: Chapter 4 - Security Policy Design 2
VMware NSX 4.x Professional: Security Groups
VMware NSX 4.x Professional: Security Policies
Which two of the following are used to configure Distributed Firewall on VDS? (Choose two.)
According to the VMware NSX Documentation, these are two of the ways that you can use to configure Distributed Firewall on VDS:
NSX API: This is a RESTful API that allows you to programmatically configure and manage Distributed Firewall on VDS using HTTP methods and JSON payloads. You can use tools such as Postman or curl to send API requests to the NSX Manager node.
NSX UI: This is a graphical user interface that allows you to configure and manage Distributed Firewall on VDS using menus, tabs, buttons, and forms. You can access the NSX UI by logging in to the NSX Manager node using a web browser.
Which troubleshooting step will resolve an error with code 1001 during the configuration of a time-based firewall rule?
An error with code 1001 during the configuration of a time-based firewall rule often indicates a time synchronization issue. Restarting the NTP service on the ESXi host can resolve this issue by ensuring that the host's time is synchronized correctly, which is essential for time-based rules to function accurately.
An architect receives a request to apply distributed firewall in a customer environment without making changes to the network and vSphere environment. The architect decides to use Distributed Firewall on VDS.
Which two of the following requirements must be met in the environment? (Choose two.)
Distributed Firewall on VDS is a feature of NSX-T Data Center that allows users to install Distributed Security for vSphere Distributed Switch (VDS) without the need to deploy an NSX Virtual Distributed Switch (N-VDS). This feature provides NSX security capabilities such as Distributed Firewall (DFW), Distributed IDS/IPS, Identity Firewall, L7 App ID, FQDN Filtering, NSX Intelligence, and NSX Malware Prevention. To enable this feature, the following requirements must be met in the environment:
An NSX administrator would like to create an L2 segment with the following requirements:
* L2 domain should not exist on the physical switches.
* East/West communication must be maximized as much as possible.
Which type of segment must the administrator choose?
An overlay segment is a layer 2 broadcast domain that is implemented as a logical construct in the NSX-T Data Center software. Overlay segments do not require any configuration on the physical switches, and they allow for optimal east/west communication between workloads on different ESXi hosts. Overlay segments use the Geneve protocol to encapsulate and decapsulate traffic between the hosts. Overlay segments are created and managed by the NSX Manager.
Anissa
2 days agoJade
3 days agoMaryann
1 months agoQuentin
1 months agoLettie
2 months agoShelba
2 months agoYuki
2 months agoDenna
3 months agoAndra
3 months agoFrankie
3 months agoKatheryn
4 months agoBerry
4 months agoJerry
4 months agoShalon
5 months agoCorinne
5 months agoColby
5 months agoTeresita
5 months agoVallie
6 months agoLarue
6 months agoFanny
6 months agoScot
6 months agoTarra
7 months agoLyndia
7 months agoMurray
7 months agoTimothy
7 months agoGwen
7 months ago