3V0-42.23 VMware NSX 4.x Advanced Design

Which three of the following are components of switch fabric design? (Choose three.)

Show answer and explanation

Correct answer: A, C, D

Spine-Leaf Architecture (Correct Answers - A, C, D):

Top-of-Rack (ToR) Switch: Connects ESXi hosts and NSX transport nodes within a rack.

Spine witch: Acts as the core switch layer , interconnecting all leaf switches for high-performance network fabric .

Leaf Switch: Connects ToR switches and compute nodes to the spine layer , forming a scalable fabric .

Incorrect Options:

(B - Middle-of-Rack Switch):

This is not a standard networking design term .

(E - End-of-Rack Switch):

Similar to Top-of-Rack switches , but typically not used in modern Spine-Leaf designs .

VMware NSX 4.x Reference:

NSX-T Physical Networking Guide

NSX-T Spine-Leaf Fabric Architecture Best Practices

A global bank has decided to overhaul its network infrastructure and adopt VMware NSX to enhance security and streamline management.

The bank handles sensitive financial data and has a massive customer base, making it a potential target for cyber threats.

Therefore, security is of paramount importance in this project.

A Network Solutions Architect is tasked with developing an NSX security design that incorporates security policy methodologies and adheres to

NSX security best practices. They must ensure the micro-segmentation of network components, implement distributed firewalling, and create

security policies that align with the bank's data protection requirements.

When considering NSX security VMware practices for the bank's deployment, what aspect is essential for enhancing the security posture?

Option A:
Avoid the use of distributed firewalls as they can complicate the network design.
Option B:
Implement a Zero Trust model and enforce policies at the Gateway level.
Option C:
Implement a Zero Trust model and enforce policies at the workload level.
Option D:
Deploy NSX in a single, large segment for simplicity.

Show answer and explanation

Correct answer: C

Implementing a Zero Trust Model at the Workload Level (Correct Answer C):

Micro-segmentation and NSX Distributed Firewall (DFW) allow enforcement of security policies at the workload level .

This ensures that even if one workload is compromised, lateral movement is restricted .

Incorrect Options:

(A - Avoiding Distributed Firewalls) → This contradicts NSX best practices . DFW is a core security feature that minimizes attack surfaces.

(B - Gateway-Level Security Only) → A gateway firewall alone cannot enforce granular micro-segmentation.

(D - Single Large Segment) → This increases the blast radius and is against Zero Trust principles .

VMware NSX 4.x Reference:

VMware NSX-T Security Reference Guide

Zero Trust Security Model in NSX-T

About this exam