5V0-41.21 VMware NSX-T Data Center 3.1 Security Question and Answers

Endpoint Protection (EPP) integrations with NSX-T Data Center typically involve installing a security agent on the virtual machines (VMs) in the environment. This agent communicates with the NSX-T Data Center platform to provide security features such as antivirus and intrusion detection.

In order for the agent to work properly, it is important that the correct drivers are installed on the VMs. Typically, this is done by installing VMware tools on the VMs, which provides the necessary drivers. However, in a brownfield environment, the VMs may already have VMware tools installed and the drivers may not be the correct version for the agent to work properly. In this case, it is recommended to perform a custom install of VMware tools and select the drivers specifically for the agent.

References:

• VMware NSX-T Data Center Endpoint Protection documentation https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/com.vmware.nsxt.epp.doc/GUID-C6F7F8C3-2F7B-4D5C-974F-F9C9E5BD5C5F.html
• VMware Tools documentation https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-D2F7D8C9-9D05-4F0F-A717-C4B4D4F4E4E4.html

For further reading, see the VMware NSX-T Data Center Administration Guide (https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/com.vmware.nsxt.admin.doc/GUID-A1A7F233-5F9F-4B2E-B3D3-0F8B593032F6.html)  for more information on configuring the

as the CVE filter can be used to filter out any events which are related to a specific vulnerability

as a system deployed inline with both ALERT and DROP action will provide the ability to block attacks when a match is found

For further reading, see the VMware NSX-T Data Center Administration Guide (https://pubs.vmware.com/NSX-T-Data-Center/index.html#com.vmware.nsxt.admin.doc/GUID-D9A6B1E7-FFCD-47A7-8E0C-FDD3DE6AC2B6.html)  for more information on configuring an IDS/IPS system.

For further reading, see the VMware NSX-T Data Center Administration Guide (https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/com.vmware.nsxt.admin.doc/GUID-4A4E9FBE-50B3-4F8F-B6C4-8527E7A08A67.html)  for more information on user accounts and permissions in NSX-T Data Center.

An administrator can use the FIREWALL RULE TAG and FIREWALL CONNECTION criteria to filter the logs on NSX. The FIREWALL RULE TAG criteria allows the administrator to filter the logs based on the tag assigned to each rule, while the FIREWALL CONNECTION criteria allows the administrator to filter the logs based on the connection status (e.g. accepted or denied).

For more information on how to filter firewall connection logs on NSX, please refer to the NSX-T Data Center documentation: https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.0/nsx-t-3.0-firewall/GUID-B6B835F2-B6F2-4468-8F8E-6F7B9B9D6E91.html

The NSX Edge nodes require access to the Internet to download category and reputation definitions, and a layer 7 gateway firewall rule must be configured on the tier-1 gateway uplink to capture DNS traffic. This will allow the URL Analysis service to analyze incoming DNS traffic and block malicious requests. For more information, please see this VMware Documentation article[1], which explains how to configure URL Analysis on NSX.

[1] https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.1/nsxt_31_url_analysis/GUID-46BC65F3-7A45-4A9F-B444-E4A1A7E0AC4A.html

When configuring members of a Security Group, the permitted membership criteria are Virtual Machine, Physical Machine, Cloud Native Service Instance, and IP Set.

For more information on configuring members of a Security Group, please refer to the NSX-T Data Center documentation: https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.0/nsx-t-3.0-security/GUID-C0F9A9A7-9A1E-41D9-A237-FED7A6F20A0A.html