An administrator observes a Network Controller Unreachable alert in Prism Central for a specific AHV cluster. All other management tasks for the cluster from Prism Central are succeeding and the cluster itself reports a healthy status.
Which step is the most appropriate to investigate the cause of this specific alert?

• A. Unregister and then re-register the affected cluster in Prism Central to force a full synchronization of the network controller state.
• B. Check for and restart any unhealthy Flow Virtual Networking microservices within the Prism Central scale-out architecture.
• C. Verify physical network connectivity and MTU settings between Prism Central and the affected AHV hosts.
• D. On the affected Prism Element cluster, verify that the Network Controller service is enabled and healthy on all CVMs.

Which policy mode blocks all traffic that is not explicitly allowed by the policy?

• A. Monitor Mode
• B. Save Mode
• C. Enforce Mode
• D. Block Mode

An administrator needs to delegate the management of security policies to a dedicated SecOps team. To enforce the principle of least privilege, the administrator assigns the predefined Flow Policy Author role to a user on the team.
The user confirms they can create, monitor, and enforce security policies. However, when attempting to build a new application security policy for a set of newly deployed VMs, the user reports they are unable to create a new category to group these VMs. The option is not available in the Prism Central UI.
Which statement explains this behavior?

• A. The Flow Policy Author role can only apply policies to existing categories by design.
• B. The Flow Policy Author role must be cloned into a custom role before it can be used.
• C. The user's role must be assigned with a scope for the specific projects they manage.
• D. The user is missing the Flow Admin role, which is required for category management.

An administrator is designing a Transit VPC to provide shared corporate services (e.g., DNS) for two tenant VPCs:
VPC-A requires WAN access using NAT.
VPC-B requires WAN access without NAT.
Both VPCs connect to the Transit VPC for shared services hosted on the corporate network.
Shared services residing in the Transit VPC use routed IP addressing for WAN connectivity.
Which two configuration elements should the administrator implement on the Transit VPC? (Choose two.)

• A. Associate both a NAT and a No-NAT external VLAN to the Transit VPC to support separate egress paths.
• B. Use one Overlay external subnet in the Transit VPC to which both VPCs will connect.
• C. Create two Overlay external subnets in the Transit VPC: one for VPC-A and one for VPC-
• D. Associate one No-NAT external VLAN to the Transit VPC router for underlay connectivity.

A junior network operator is assigned two predefined roles in Prism Central...
Role A: Prism Viewer
Role B: VPC Admin
The operator reports being able to successfully create, update, and delete Virtual Private Clouds (VPCs). However, the operator is unable to create a VM into the VPC.
How does Prism Central determine the operator's effective permissions?

• A. The Prism Viewer role's permissions take precedence, preventing any write operations from the VPC Admin role.
• B. The system applies the principle of "most privilege," granting the highest level of access from any assigned role.
• C. The permissions of the VPC Admin role override the more restrictive Prism Viewer role.
• D. The permissions are the union of both roles, granting VPC management rights and global read-only access.