An administrator needs to configure a security policy that controls VM-to-VM communication within a category defined as secured entity. Which…

The question specifically asks to restrict "intra-tier" communication. In Nutanix Flow Network Security, the concept of "tiers" (e.g., Web, App, DB) is exclusive to Application Security Policies. While an Isolation Policy also blocks communication between VMs in a group, it does not use the "tier" construct. Therefore, the question's terminology points directly to an Application Policy. By default, an Application Policy allows all traffic within the same tier. To meet the requirement, the administrator must create an Application Policy, place the VMs into a single tier, and then explicitly add a rule to block traffic from that tier to itself.

Isolation Policy: This policy type does block intra-group communication by default, but it does not use the concept of "tiers," making it a less precise answer for the specific terminology used.

Quarantine Policy: This is used for the temporary and immediate isolation of a specific VM that is suspected of being compromised, not for defining permanent application segmentation rules.

VDI Policy: This is a specialized policy designed specifically for securing Virtual Desktop Infrastructure (VDI) environments and is not the correct tool for general-purpose VM segmentation.

1. Nutanix Flow Network Security Guide v6.8, Chapter: Security Policy Management, Section: Application Security Policy

"An application security policy secures an application by limiting the inbound and outbound traffic of the application... By default, all traffic is allowed between VMs in the same tier. To block traffic between VMs in the same tier, you must create a rule that denies traffic from the tier to itself." This confirms that an Application Policy is used to manage intra-tier traffic and requires a specific rule to block it.

2. Nutanix Flow Network Security Guide v6.8, Chapter: Security Policy Management, Section: Isolation Security Policy

"An isolation policy separates a group of VMs from the rest of the network... The VMs in the isolated group cannot communicate with each other." This highlights that while the outcome is similar, the terminology and construct (group vs. tier) are different from what the question specifies.