NSX improves the security of today's modern workloads by preventing lateral movement, which feature of NSX can be used to achieve this?

NSX prevents lateral movement primarily through micro-segmentation, which is a form of network segmentation. This is implemented using the NSX Distributed Firewall (DFW). The DFW operates at the virtual network interface (vNIC) of each workload, allowing for granular, stateful firewall policies to be applied between individual virtual machines, even if they reside on the same logical network segment. By enforcing a zero-trust security model and inspecting all East-West traffic, NSX can isolate a compromised workload and prevent threats from spreading laterally across the data center.

B. Virtual Security Zones: This is a result of applying network segmentation policies, not the feature itself. Segmentation is the action that creates these zones.
C. Edge Firewalling: The Edge Firewall (Gateway Firewall) secures the perimeter by inspecting North-South traffic (traffic entering/leaving the NSX environment), not the lateral East-West traffic between internal workloads.
D. Dynamic Routing: This is a networking function (e.g., BGP, OSPF) that manages traffic paths and reachability; it is not a security enforcement feature for preventing threats. ---

1. VMware NSX-T Data Center Product Documentation

"NSX-T Data Center Security" Guide. The introduction states

"The NSX Distributed Firewall (DFW) provides visibility and control for virtualized workloads and networks. You can create access control policies based on VMware vCenter objects like datacenters

and virtual machine names. The DFW provides security for east-west traffic in your data center." This highlights its role in securing East-West (lateral) traffic.

Source: VMware NSX-T Data Center Documentation

Security

"Distributed Firewall Overview".

2. VMware Glossary

"What is Micro-segmentation?". This official VMware resource directly links micro-segmentation to preventing lateral movement. It states

"By containing a breach to a small zone

micro-segmentation helps prevent the lateral movement of threats from one server to another across the data center."

Source: VMware

"VMware Glossary - What is Micro-segmentation?"

vmware.com/topics/glossary/content/micro-segmentation.

3. VMware White Paper

"The Intrinsic Security of the VMware Virtual Cloud Network". This paper explains the security model. On page 5

it details how the NSX Service-defined Firewall "prevents the lateral spread of threats by providing internal firewalling for every workload."

Source: VMware White Paper

"The Intrinsic Security of the VMware Virtual Cloud Network"

Page 5

Section: "Service-defined Firewall".