An administrator has deployed a VPC for a multi-tier application on Nutanix AHV.

This item is best solved by thinking like an operator in Prism Central: first identify whether the problem is design, control-plane state, or policy logic, then pick the option tied to that layer. The correct response is C, meaning “Configure an external network for the Web tier subnet and leave App and Database tiers private.”. The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. In practice, this falls into virtual network design: VPC structure, subnet type, external network behavior, routing intent, and address exposure are what determine the result. By contrast, A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. The key takeaway is that Flow is intentionally modular. Networking objects determine reachability, security objects determine permission, and lifecycle steps determine supportability. Mixing those layers usually produces the distractor answers. A strong exam habit is to ask which Nutanix construct would have to.