A reliable method here is to translate the scenario into Nutanix terms-VPC routing, external connectivity, policy scope, identity mapping, or upgrade readiness-and then choose the answer that directly addresses that domain. The correct response is B, meaning "Use subnet categorization to create a vNIC-specific policy, securing the selected vNIC based on its associated subnet.". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions. By contrast, A sounds plausible, but it does not align with the specific Flow policy object or precedence rule that controls this case. C sounds plausible, but it does not align with the specific Flow policy object or precedence rule that controls this case. For exam preparation, remember that Nutanix usually separates discovery from enforcement, routing from NAT, and access policy from identity mapping. Choosing the layer that truly owns the function is what leads to the right answer. A strong exam habit is to ask which Nutanix construct would have to change for.