Which of the following is a benefit of combining Distributed IDS/IPS with Gateway IDS/IPS?

Combining Distributed IDS/IPS with Gateway IDS/IPS creates a comprehensive, defense-in-depth security posture. Gateway IDS/IPS is deployed on Tier-0 or Tier-1 gateways to inspect North-South traffic (traffic entering or leaving the NSX environment), protecting the perimeter. Distributed IDS/IPS is deployed at the vNIC level of each workload, inspecting East-West traffic (traffic between workloads within the NSX environment). This dual approach ensures that threats are detected both at the edge and as they attempt to move laterally within the data center, thereby enhancing overall detection coverage.

B. Eliminating the need for intrusion detection on virtual machines: Network IDS/IPS does not replace the need for host-based security, which can detect malicious processes or file changes within the OS.
C. Reducing the reliance on NSX for security enforcement: This strategy fundamentally increases the use and reliance on NSX's advanced security features, rather than reducing it.
D. Allowing NSX-T to function without Service Routers: Gateway IDS/IPS functionality is hosted on the Service Routers (SRs) of NSX Edge nodes, making them essential components for this feature.

1. VMware NSX-T Data Center Security Guide, Version 3.2, "NSX IDS/IPS," page 10. The guide explains, "NSX IDS/IPS monitors North-South traffic that is flowing through Tier-0 and Tier-1 gateways, and East-West traffic between virtual machines."

2. VMware NSX-T Data Center Product Page, "Distributed IDS/IPS". The documentation highlights the benefit: "Gain better protection from threats trying to move laterally across your east-west traffic with distributed IDS/IPS."

3. VMware Tech Zone, "NSX-T IDS/IPS Architecture and Deployment Considerations," Section: Deployment Models. This document explicitly states, "The combination of both Gateway and Distributed IDS/IPS provides the most comprehensive threat detection and prevention coverage."