NSX-SEC Practice Test

NSX-SEC practice test: what's covered

• Distributed Firewall
• Gateway Firewall
• IDS/IPS
• Micro-Segmentation
• Groups
• Logs

Free NSX-SEC sample questions

1. A security engineer needs to limit east-west traffic between application tiers in a private cloud during a controlled production rollout. Which response is the BEST fit?

   • A. define security groups and distributed firewall rules that allow only required tier flows — with change evidence recorded
   • B. allow any-any between all workloads in the cluster — with change evidence recorded
   • C. rely only on perimeter firewalls for east-west paths — with change evidence recorded
   • D. place every VM on the public internet — with change evidence recorded
   Show answer

   Correct: A. define security groups and distributed firewall rules that allow only required tier flows — with change evidence recorded is the best answer because DFW micro-segmentation enforces least-privilege between workloads. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes group membership, rule hits, and denied east-west flows.

2. An administrator must limit east-west traffic between application tiers in a private cloud while investigating an urgent support case. Which action should be taken first?

   • A. define security groups and distributed firewall rules that allow only required tier flows — after confirming scope and ownership
   • B. allow any-any between all workloads in the cluster — after confirming scope and ownership
   • C. rely only on perimeter firewalls for east-west paths — after confirming scope and ownership
   • D. place every VM on the public internet — after confirming scope and ownership
   Show answer

   Correct: A. define security groups and distributed firewall rules that allow only required tier flows — after confirming scope and ownership is the best answer because DFW micro-segmentation enforces least-privilege between workloads. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes group membership, rule hits, and denied east-west flows.

3. A company plans to limit east-west traffic between application tiers in a private cloud during an audit-readiness review. Which design best meets the requirement?

   • A. define security groups and distributed firewall rules that allow only required tier flows — using the vendor-supported workflow
   • B. allow any-any between all workloads in the cluster — using the vendor-supported workflow
   • C. rely only on perimeter firewalls for east-west paths — using the vendor-supported workflow
   • D. place every VM on the public internet — using the vendor-supported workflow
   Show answer

   Correct: A. define security groups and distributed firewall rules that allow only required tier flows — using the vendor-supported workflow is the best answer because DFW micro-segmentation enforces least-privilege between workloads. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes group membership, rule hits, and denied east-west flows.

4. During troubleshooting, the team must limit east-west traffic between application tiers in a private cloud after a regional service change. Which next step is most defensible?

   • A. define security groups and distributed firewall rules that allow only required tier flows — with least privilege preserved
   • B. allow any-any between all workloads in the cluster — with least privilege preserved
   • C. rely only on perimeter firewalls for east-west paths — with least privilege preserved
   • D. place every VM on the public internet — with least privilege preserved
   Show answer

   Correct: A. define security groups and distributed firewall rules that allow only required tier flows — with least privilege preserved is the best answer because DFW micro-segmentation enforces least-privilege between workloads. The other choices are not the best fit because they either address the wrong layer, broaden access unnecessarily, or skip validation. Useful evidence includes group membership, rule hits, and denied east-west flows.

5. An administrator needs to limit east-west traffic between application tiers in a private cloud before approving a high-risk release. Which TWO actions provide the strongest implementation and verification? (Choose TWO)

   • A. define security groups and distributed firewall rules that allow only required tier flows — with monitoring and rollback defined
   • B. verify the result using group membership, rule hits, and denied east-west flows — with monitoring and rollback defined
   • C. allow any-any between all workloads in the cluster — with monitoring and rollback defined
   • D. rely only on perimeter firewalls for east-west paths — with monitoring and rollback defined
   • E. place every VM on the public internet — with monitoring and rollback defined
   Show answer

   Correct: A and B. define security groups and distributed firewall rules that allow only required tier flows — with monitoring and rollback defined and verify the result using group membership, rule hits, and denied east-west flows — with monitoring and rollback defined are correct because DFW micro-segmentation enforces least-privilege between workloads. The other options are not appropriate: they weaken scope, skip a required control, or do not provide reliable evidence for this VMware NSX Security scenario.

Last updated: 2026-10-19

NSX-SEC practice test FAQ