Refer to Exhibit:An administrator is reviewing an enforced security policy "Secure 3-VM Inventory App", as...

From a Nutanix exam perspective, this question is really testing whether the administrator understands the control point that actually governs the behavior shown in the scenario. The correct response is C, meaning “The AppTier: Database category is being blocked from initiating a connection to the Inventory App VM.”. The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. From a troubleshooting standpoint, the validation path is policy scope first, then categories or identity mapping, then hitlog evidence, service definition, and finally policy precedence. By contrast, A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. For exam preparation, remember that Nutanix usually separates discovery from enforcement, routing from NAT, and access policy from identity mapping. Choosing the layer that truly owns the function is what leads to the right answer. A strong exam habit is to ask which Nutanix construct would have to change for.