An administrator must prevent a new VPC from exporting any of its prefixes to the datacenter while still receiving a default route. Where should the routing policy be applied?

The Transit Gateway (TGW) is the component that provides connectivity between a Virtual Private Cloud (VPC) and external networks, such as a physical datacenter. It establishes BGP peering with the datacenter routers to exchange routing information. To control which routes are advertised from the VPC, a routing policy (typically a route map with a prefix list) must be applied to the BGP session on the TGW. This policy can be configured to filter outgoing (export) advertisements to prevent the VPC's prefixes from being sent to the datacenter, while still allowing the TGW to learn incoming routes, such as the required default route.

A. On the VPC default route advertiser: This is incorrect because the policy needs to be applied at the point where VPC routes are exported, which is the VPC's TGW, not necessarily the external device advertising the default route to the VPC.
C. On the providers' BGP peer template: Applying a policy to a template would likely affect all BGP peers configured from that template, not just the specific new VPC as required by the scenario. The TGW provides the necessary granular control.
D. On the VPC Gateway Firewall: The Gateway Firewall is responsible for enforcing stateful security policies on traffic flow (L4-L7). It does not control the advertisement of network prefixes via the BGP routing protocol.

1. VMware NSX-T Data Center Administration Guide (NSX 3.2): In the "BGP" chapter, section "Configure BGP Route Filtering," it states, "You can apply a route map to a BGP neighbor to filter the routes that are received from and advertised to the neighbor." The BGP neighbor configuration for a VPC is on its Transit Gateway (which is a dedicated Tier-0 Gateway). Applying an "out" filter here achieves the desired outcome. (Reference: VMware NSX-T Data Center 3.2 Administration Guide, Chapter: BGP, Section: Configure BGP Route Filtering).

2. VMware NSX Design Guide (NSX 4.1): The guide explains the architecture of NSX VPC, stating, "Each VPC is connected to a transit gateway for north-south connectivity... The transit gateway is a dedicated Tier-0 gateway that is instantiated when the first VPC is created." This establishes the TGW as the routing boundary where policies for external connectivity are applied. (Reference: VMware NSX 4.1 Design Guide, Chapter 10: NSX for vSphere with Tanzu, Section: NSX VPC).

3. VMware NSX-T Data Center Product Documentation (NSX 4.x): The documentation on "Add a Route Map" for BGP configuration on a Tier-0 Gateway explicitly shows the option to set the direction to "Out". This directly supports applying a policy on the TGW to control exported prefixes. (Reference: VMware NSX 4.1 Administration Guide, Section: Add a Route Map).