What makes this a strong certification question is that several answers look technically related, but only one aligns with the exact behavior of Flow networking or Flow security. The correct response is D, meaning
"Create categories for each tier then define an Application Policy allowing specific ports between them.".
Application Policies are the most appropriate way to model legitimate workload communication in a tiered application. They allow administrators to express which sources, destinations, and services are required instead of relying on broad network access. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions.
Notice that A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B sounds plausible, but it does not align with the specific Flow policy object or precedence rule that controls this case. That is the underlying Nutanix principle being validated:
solve the issue at the feature that owns the behavior, not by changing unrelated infrastructure settings that happen to sound network-oriented.