NSX Set 6 Flashcards
Which component is not a security service facilitated by Guest or Network Introspection?
a. Data loss prevention
b. Network Address Translation
c. Malware protection
d. Vulnerability management
b. Network Address Translation
Which security service is not facilitated by Network Introspection?
a. Intrusion prevention
b. Data security
c. Malware protection
d. Antivirus protection
d. Antivirus protection
Which statement is a valid example of a security service protecting a virtual
machine?
a. The logical switch sends traffic that leaves the virtual machine and is directed to the security service appliance.
b. The distributed firewall sends traffic that arrives for the virtual machine from the security service appliance.
c. The ESXi host redirects virtual machine traffic to the security service module running in the host’s kernel.
d. The ESXi host redirects the virtual machine traffic to the security service appliance using the IOChain.
a. The logical switch sends traffic that leaves the virtual machine and is directed to the security service appliance.
What is the first step in consuming a security service from a provider?
a. Register the security service with NSX Manager.
b. Register the security service with vCenter.
c. Register the ESXi hosts with the security service.
d. Create a profile with the security service provider.
a. Register the security service with NSX Manager.
Which is not a dynamic selection option for a security group?
a. Virtual machine name
b. Computer OS name
c. LDAP group
d. Entity
c. LDAP group
How do you prevent a virtual machine from being a member of a security group?
a. Do not include the virtual machine in the Define Dynamic Objects view.
b. Do not include the virtual machine in the Select Objects to Include view.
c. Add the virtual machine to the Select Objects to Exclude view.
d. Add the virtual machine to the NSX Manager’s Exclusion List.
c. Add the virtual machine to the Select Objects to Exclude view.
If two security policies are associated with the same security group, which policy gets enforced first?
a. The security policy that is associated first
b. The security policy that is associated last
c. The security policy that has the highest weight
d. The security policy with the most secure service
c. The security policy that has the highest weight
Which is not a policy that can be configured as part of a security policy?
a. Guest Introspection Services
b. Network Introspection Services
c. Distributed firewall rule
d. SpoofGuard
d. SpoofGuard
A security policy named Santa Maria is configured with a distributed firewall
rule and then applied to a security group named La Pinta.
Based on this configuration, which two conditions are true? (Choose two.)
a. The source or the destination of the distributed firewall rule is La Pinta.
b. The distributed firewall rule is added below any existing rules, but above the default rule.
c. Both the source and destination of the distributed firewall rule can be Any.
d. Santa Maria can be applied to another security group.
e. The distributed firewall rule is added at the top so it will be enforced before any existing rules.
a. The source or the destination of the distributed firewall rule is La Pinta.
d. Santa Maria can be applied to another security group.
Where are security tags created?
a. In NSX Manager
b. In vCenter
c. In Service Composer
d. In the security service provider
a. In NSX Manager
How does VMware Data Security provide its services to virtual machines?
a. VMware Data Security scans, via an appliance, data stored in protected virtual machines to check against security compliance.
b. VMware Data Security scans, via NSX Manager, data stored in protected virtual machines to check against security compliance.
c. VMware Data Security scans, via vCenter, data stored in protected virtual machines to check against security compliance.
d. VMware Data Security scans, via NSX Edge, data stored in protected virtual machines to check against security compliance.
a. VMware Data Security scans, via an appliance, data stored in protected virtual machines to check against security compliance.
Which two components are required to successfully implement VMware Data Security? (Choose two.)
a. A data security appliance deployed to the data center where you want to enable Data Security.
b. An EPSEC-MUX agent deployed to the ESXi host where you want to enable Data Security.
c. A security policy with Guest Introspection Services of Data Security.
d. A logical firewall rule that allows Data Security, applied to the virtual machines that require protection.
b. An EPSEC-MUX agent deployed to the ESXi host where you want to enable Data Security.
c. A security policy with Guest Introspection Services of Data Security.
Which two steps are used to enable data collection in a virtual machine? (Choose two.)
a. Right-click the virtual machine and select Edit Settings. In the VM Options tab, check the Enable Activity Monitoring Data Collection box.
b. In the virtual machine’s Manage tab, select NSX Activity Monitoring, click Edit, and answer Yes in the pop-up window.
c. Add the virtual machine to the Security Group Activity Monitoring Data Collection.
d. From the Networking and Security home page, select Activity Monitoring. In the VM Activity tab, click Add VM.
b. In the virtual machine’s Manage tab, select NSX Activity Monitoring, click Edit, and answer Yes in the pop-up window.
c. Add the virtual machine to the Security Group Activity Monitoring Data Collection.
What activity is displayed by the Inter Container Interaction activity report?
a. Activities between virtual machines running on the same ESXi host.
b. Activities between virtual machines in the same cluster.
c. Activities between monitored virtual machines.
d. Activities of users in the selected Active Directory group.
c. Activities between monitored virtual machines.
What two appliances must be deployed for Activity Monitoring to work? (Choose two.)
a. VMware Data Security virtual appliance
b. VMware Activity Monitoring virtual appliance
c. NSX Data Security virtual appliance
d. Universal services virtual machine
a. VMware Data Security virtual appliance
d. Universal services virtual machine
