An administrator recently deployed a new set of virtual machines... 3-tier web application... restricted as follows: Only application VMs can talk to…

The most efficient and logical method is to create a single Application Security Policy centered on the application tier. This policy secures the Application VMs by defining specific inbound and outbound rules based on categories.

1. Secured Group: The Application VMs are defined as the application to be secured.

2. Inbound Rule: An inbound rule allows traffic from the Frontend VMs category on TCP port 8080.

3. Outbound Rule: An outbound rule allows traffic to the Database VMs category on TCP port 3306.

This single policy enforces the required communication paths while adhering to the principle of least privilege, as all other traffic is implicitly denied.

Using multiple policies: Creates unnecessary complexity and management overhead compared to a single, consolidated application policy for the entire application.

Using an Isolation Policy: This policy type is incorrect as it would block all traffic to and from the specified VMs, preventing the required inter-tier communication.

Incorrectly defining rules: Placing all rules as only inbound or only outbound would fail to model the complete 3-tier traffic flow correctly and violate the requirements.

1. Nutanix Flow Networking Guide (v6.8): In the "Application Security Policy" section, it states, "An application policy secures a group of VMs. You can define rules to control inbound and outbound traffic for the secured group of VMs." This directly supports creating a policy with both inbound and outbound rules for the central application tier. (Reference: Flow Networking Guide, Chapter: "Security Policies", Section: "Application Security Policy").

2. Nutanix University - Nutanix Hybrid Cloud Fundamentals Course: The module on Flow Networking and Microsegmentation explains that the best practice for multi-tier applications is to create a single application policy. This policy defines the application at its core and then specifies the allowed communication paths to and from other tiers using inbound and outbound rules. (Reference: Nutanix Hybrid Cloud Fundamentals, Module: "Flow Networking and Microsegmentation").