An organization plans to apply security controls based on user group membership in Active Directory.

What makes this a strong certification question is that several answers look technically related, but only one aligns with the exact behavior of Flow networking or Flow security. The correct response is D, meaning “Configure category values mapped to AD groups.”. Identity-based controls in Flow depend on accurate mapping between Active Directory information and the categories or groups referenced by policy. If that mapping is wrong, the policy logic can be correct and access will still fail. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions. A strong exam habit is to ask which Nutanix construct would have to change for the symptom or requirement to change. That mental shortcut usually separates the real answer from distractors that mention generic networking steps, disruptive resets, or unrelated configuration objects. Notice that A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. For.