In a vDefend NDR campaign, "hosts" refers to which of the following?

In the context of a VMware vDefend Network Detection and Response (NDR) campaign, the term "hosts" refers to the workloads (virtual machines or containers) within the data center. A campaign is a visualization of a correlated series of intrusion events that represent a multistage attack. The campaign view maps the attack's progression, showing how threats move between internal workloads and external entities. The focus is on the compromised or targeted application endpoints, which are the workloads, not the underlying hypervisor infrastructure.

A. vSphere hosts: This is incorrect because vSphere hosts are the physical ESXi servers. NDR campaigns track malicious activity targeting the workloads running on these hosts, not the hypervisors themselves as the primary entity.

C. VCF nodes: This is incorrect as VCF nodes are the specific ESXi hosts that form a VMware Cloud Foundation infrastructure. This is a subset of vSphere hosts and is still infrastructure, not the workload.

D. NSX-prepared cluster hosts: This is incorrect. While NSX preparation is required for NDR functionality, this term still refers to the ESXi hypervisor. The campaign's focus remains on the workloads protected by NSX.

1. VMware NSX 4.1 Documentation, Security Guide, "Campaigns" section: "A campaign is a series of intrusion events that are correlated with high confidence to represent a single, multistage attack on one or more workloads in your data center." This source directly defines the entities involved in a campaign as workloads.

Source: VMware NSX 4.1 Documentation, available at docs.vmware.com. Navigate to the Security > NSX Advanced Threat Prevention > Campaigns section.

2. VMware vDefend Solution Brief: The document consistently describes vDefend's purpose as securing east-west traffic and protecting workloads from advanced threats. The campaign visualization is a core feature for understanding threats to these workloads.

Source: VMware vDefend Lateral Security Solution Brief, (e.g., Document ID VMW-SB-VDEFEND-LATERAL-SECURITY-101-A4-EN), Page 2, "Protecting East-West Traffic".

3. VMware NSX Advanced Threat Prevention Datasheet: This document details how the NDR capability analyzes network traffic to and from workloads to detect threats. The campaign feature is presented as a way to visualize the full context of an attack against these workloads.

Source: VMware NSX Advanced Threat Prevention Datasheet, (e.g., Document ID VMW-DS-NSX-ADV-THRT-PRVNTN-101-A4-EN), Page 1, "Key Benefits" section.