最新のNCP-NS-7.5問題集で試験を準備する

An administrator needs to delegate the management of security policies to a dedicated SecOps team. To enforce the principle of least privilege, the administrator assigns the predefined Flow Policy Author role to a user on the team. The user confirms they can create, monitor, and enforce security policies. However, when attempting to build a new application security policy for a set of newly deployed VMs, the user reports they are unable to create a new category to group these VMs. The option is not available in the Prism Central UI.
Which statement explains this behavior?

• A. The user's role must be assigned with a scope for the specific projects they manage.
• B. The user is missing the Flow Admin role, which is required for category management.
• C. The Flow Policy Author role must be cloned into a custom role before it can be used.
• D. The Flow Policy Author role can only apply policies to existing categories by design.

An administrator needs to ensure all web traffic (HTTP/HTTPS) from a specific subnet (10.100.20.0/24) is redirected through a third-party virtual firewall inside the VPC for Layer 7 inspection before reaching the internet. The firewall VM has an IP of 10.100.30.5 and is connected to a different subnet. What should be done to enforce this specific traffic path?

• A. Configure a Policy-Based Route (PBR) on the VPC with a re-route IP 10.100.30.5.
• B. Create a Network Policy with a high priority with the source 10.100.20.0/24, destination of 10.100.30.5 on port 80 & 443.
• C. Create a FNS policy with an allow rule for the FW IP 10.100.30.5.
• D. Move the Firewall VM into the same subnet and set the default GW of the web servers to 10.100.30.5.

An administrator wants to configure the subnet 10.1.1.0/24 to stretch across two VPCs over a Network Gateway in VXLAN mode. The VMs on this subnet need to communicate with a traffic pattern of size 2000 Bytes. What is the minimum MTU required in the underlay network to ensure communication happens without fragmentation or traffic drops?

• A. 2108 Bytes
• B. 2058 Bytes
• C. 9216 Bytes
• D. 2116 Bytes

A VDI policy in Flow Network Security allows access to specific resources only when users from the Admins Active Directory group log into a VM. Some administrators report that when they log in to certain VMs, access is blocked (default deny applies), while the same user accounts work correctly when logged on to other VMs. When checking the VM details in Prism Central, operations observes that the expected dynamic category based on the logged-in AD user is not assigned on the affected VMs. What is the most likely reason for this behavior?

• A. The affected VMs allowed login using cached credentials without contacting the Domain Controller.
• B. The Prism Central Active Directory service connection is misconfigured or has failed.
• C. The security policy is in Monitor mode, so the dynamic category assignment is not applied.
• D. The Admins group contains nested AD groups, and only the top-level group is synchronized by Prism Central.

Refer to Exhibit:

An administrator is reviewing an enforced security policy "Secure 3-VM Inventory App", as shown in the exhibit. The policy's inbound rules are configured to allow traffic from specific sources to each tier of the application. The visualization shows one blocked traffic flow. Based on the information presented in the exhibit, which statement best describes this behavior?

• A. The Inventory App VM is being blocked from initiating a connection to the AppTier: Database category.
• B. The AppTier: FrontEnd and AppTier: AppLogic entities are on different subnets.
• C. The AppTier: Database category is being blocked from initiating a connection to the Inventory App VM.
• D. The security policy is blocking traffic because the Inventory App VM is using a port not allowed by the policy.