An administrator needs to configure a security policy that controls VM-to-VM communication within a category defined as secured entity.
Which configuration action should the administrator take to restrict all intra-tier communication between the VMs within a category defined as secured entity?

• A. Use deny-all intra-tier traffic configuration in the policy.
• B. Set the security policy to allow-specific traffic for intra-tier communication.
• C. Apply the policy with inbound rules that block all inter-VM communication.
• D. Configure the security policy with allow-all intra-tier traffic.

When cloning a Flow Network Security policy, what should be verified before enabling Enforce mode?

• A. The cloned policy must be renamed before it can be enforced.
• B. The cloned policy must first be saved before it can be enforced.
• C. The cloned policy's secured entities reference the intended categories.
• D. The cloned policy is configured to a different scope than the source policy.

An administrator is designing a Transit VPC to provide shared corporate services (e.g., DNS) for two tenant VPCs:
VPC-A requires WAN access using NAT.
VPC-B requires WAN access without NAT.
Both VPCs connect to the Transit VPC for shared services hosted on the corporate network.
Shared services residing in the Transit VPC use routed IP addressing for WAN connectivity.
Which two configuration elements should the administrator implement on the Transit VPC? (Choose two.)

• A. Associate one No-NAT external VLAN to the Transit VPC router for underlay connectivity.
• B. Create two Overlay external subnets in the Transit VPC: one for VPC-A and one for VPC-
• C. Use one Overlay external subnet in the Transit VPC to which both VPCs will connect.
• D. Associate both a NAT and a No-NAT external VLAN to the Transit VPC to support separate egress paths.

Refer to the exhibit.

In the AD-VDI Departmental SecPol policy shown in the exhibit, ADGroup: Engineering is configured as a secured entity in a VDI Security Policy. Prism Central shows 2 / 2 active sessions under this group, but the administrator confirms that three Engineering users are currently logged in to persistent VDI desktops. The third user's VM shows no ADGroup assignment in its VM details in Prism Central, even after the user has successfully logged in. All three users are members of the same AD group, and the Domain Controller event logs confirm a successful interactive login for the third user. Which condition explains why the third user's VM is not being assigned the ADGroup: Engineering category?

• A. The third user's VM has been assigned an AppType category, preventing ID-Based categorization.
• B. The Flow Identity Service has been disabled in Prism Central for the VM the third user is logging in to.
• C. The Active Directory Service account used by Prism Central is locked.
• D. The Flow Network Security policy scope does not include the VLAN where the third user's VM resides.

A VPC admin creates a policy to allow traffic between two IP subnets but forgets to enable reverse direction.
What happens in this scenario?

• A. Traffic is blocked completely because the policy is invalid.
• B. Traffic flows only in one direction, blocking return traffic.
• C. Traffic flows bidirectionally because policies are stateful by default.
• D. Policy is rejected by Prism Central during validation.