Exam NCM-MCI topic 1 question 5 discussion

Actual exam question from Nutanix's NCM-MCI

Question #: 5
Topic #: 1

An administrator of a Nutanix Enterprise Cloud has microsegmentation enabled and a firewall VM installed. The security team notifies the administrator that one of the VMs hosted in the environment has been exhibiting suspect network activity. The administrator wants to isolate the VM from the production network, but must still be able to access it to perform diagnostics.
What should the administrator do to meet the requirement?

A. Disable the vNIC on the affected VM
B. Quarantine the VM using the Forensic Method
C. Create a firewall rule that blocks VM traffic but permits diagnostic access
D. Create a security policy with a service chain directing that VMs traffic to the firewall

Show Suggested Answer

Suggested Answer: B 🗳️

by Yasser_Mohamed at Aug. 16, 2021, 1:28 p.m.

Comments

Submit Cancel

mogmog

8 months, 1 week ago

Selected Answer: B

Forensic. Isolates the VM from all traffic except traffic from categories specified in the built-in quarantine policy. The allowed categories contain forensic tools that enable you to perform forensics on the VM. https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Flow-Guide-v5_17:mul-quarantine-rule-configuration-c.html

upvoted 2 times

Cromo19

2 months, 2 weeks ago

Agreed, answer is B.

upvoted 1 times

...

Treasure

11 months, 1 week ago

The “Forensic” option allows the limitation of inbound/outbound traffic to that which is specified from the “Add Forensic Tools” tab.

upvoted 2 times

...

nabillose

11 months, 1 week ago

Quarantining the VM using the Forensic Method would also isolate the VM, but it would not allow for diagnostic access. Option: C