1V0-642 · Question #58
Which NSX component enforces security rules between two virtual machines that are on the same Layer 2 segment?
The correct answer is C. NSX distributed Firewall. mware-nsx-network-virtualization-platform-white-paper.pdf (page 3)
Question
Which NSX component enforces security rules between two virtual machines that are on the same Layer 2 segment?
Options
- ANSX Manager
- BDistributed Router
- CNSX distributed Firewall
- DNSX Controller
How the community answered
(36 responses)- A11% (4)
- B3% (1)
- C83% (30)
- D3% (1)
Explanation
mware-nsx-network-virtualization-platform-white-paper.pdf (page 3)
Topics
Community Discussion
12
Kavya H.Jun 17, 2026C is the right answer here. The NSX Distributed Firewall is the only component in this list that actually lives in the hypervisor kernel on every ESXi host, which means it can inspect and enforce rules on traffic between two VMs sitting on the same L2 segment before that traffic ever leaves the vNIC. That east-west enforcement point is exactly what makes the DFW valuable in micro-segmentation scenarios, because a traditional perimeter firewall or even the Distributed Router never sees that intra-segment traffic at all. NSX Manager is your management plane and the Controller cluster handles the control plane, so neither of those touches the data path directly.
Grace U.Jun 18, 2026Kavya nailed the core concept, and one detail worth locking in for the exam is that the DFW enforces specifically at the vNIC level, so when a VM vMotions to a different host the security policy travels with it, which is exactly the kind of nuance the question writers love to probe.
Henrike J.Jun 26, 2026The correct answer is C, NSX Distributed Firewall. The DFW is the only component here that operates as a kernel module inside each ESXi host, meaning it can inspect and enforce policy on traffic between two VMs sitting on the same L2 segment without that traffic ever leaving the hypervisor, a classic east-west enforcement scenario. NSX Manager is the management plane for configuration, NSX Controller handles the control plane for logical networking state distribution, and the Distributed Router handles inter-VXLAN routing, none of which sit in the data path between same-segment VMs. If you see any question on this exam asking about intra-segment or east-west security enforcement, go straight to the DFW every time.
Johan G.Jun 28, 2026Worth adding that the DFW enforcement point is the VDS port on the source vnic, so the frame never even reaches the virtual switch fabric before policy is applied, which is why it catches intra-host VM-to-VM traffic that a physical or edge firewall would never see.
Carlos M.Jun 26, 2026Took this one on my exam last month and almost got tripped up because I was second-guessing the Distributed Router, but the key word is "security rules" not routing, so the Distributed Firewall is the only one that makes sense since it runs as a kernel module on each ESXi host and can inspect traffic between VMs on the same L2 segment without it ever leaving the hypervisor. Locked in C and moved on without looking back.
Henrike J.Jun 28, 2026Carlos has the right answer but worth being precise: the Distributed Firewall enforcing micro-segmentation at the vNIC level is what lets it catch east-west traffic between VMs on the same host before it ever hits the virtual switch, which is the detail that separates it from perimeter-based controls on the exam.
Johan G.Jun 26, 2026The distractor that catches people is B, since the Distributed Router sits in the data plane and does handle intra-segment traffic forwarding, but routing is not enforcement. The Distributed Firewall is the right call here because it runs as a kernel module in each ESXi host and applies stateful policy at the vNIC level, so it intercepts east-west traffic even when two VMs never leave the same L2 segment, making C correct.
Henrike J.Jun 29, 2026Johan is right that the DFW wins on enforcement, but worth adding that the stateful inspection happens before the traffic even hits the vSwitch port group, which is exactly why it catches same-host, same-segment flows that a traditional perimeter or even the NSX Edge firewall would never see.
Grace U.Jun 27, 2026The trick here is that a traditional perimeter firewall never even sees traffic between two VMs sitting on the same Layer 2 segment, because that traffic never has to leave the segment to get routed. The NSX Distributed Firewall is different because it lives right inside the ESXi hypervisor kernel and enforces policy at the virtual NIC of every VM, so it intercepts that east-west traffic before it even hits the wire. The Manager and Controller are control-plane components handling configuration and state distribution, and the Distributed Router only comes into play when traffic needs to cross between different IP subnets. I remember sitting with this exact question on my actual exam and almost second-guessing myself toward the Distributed Router, then I caught myself and thought, wait, the question says same Layer 2 segment, so routing is not even involved here, and once I framed it that way the DFW was the only answer that made sense.
Nina C.Jun 27, 2026Good one, this tripped me up too at first. The key is that something has to enforce rules right at the vNIC level so traffic never even leaves the host to hit a perimeter firewall, and option C is the only one that actually sits in the data plane at that level rather than just managing or routing things. Quick question though, do you know why the Distributed Router wouldn't work here even though it also runs on each host? I want to make sure I'm clear on the line between routing and actual policy enforcement.
Kavya H.Jun 28, 2026The Distributed Router moves packets between subnets but has no policy table of its own, so it just forwards whatever the kernel hands it, while the Distributed Firewall sits as a kernel module that inspects and enforces rules on every frame before the vNIC even sees it.
Brenda K.Jun 7, 2026C is your only pick here, the dFW lives right on the vNIC.