vDefend – Distributed Firewall is a security capability delivered byNSXwithin VMware Cloud Foundation. Although VCF components such as SDDC Manager, VCF Operations, and VCF Automation rely on licensing frameworks, the enforcement and activation ofNSX features—including Distributed Firewall—occur entirely withinNSX Manager.

To enablevDefend (Distributed Firewall), NSX Manager must detect a valid NSX license that includes security features. Without applying the correct license directly to NSX Manager:

The Distributed Firewall feature remains locked

vDefend cannot be enabled in workload domains

Security rules and micro-segmentation capability remain unavailable

VCF does not apply NSX security licensing at the SDDC Manager, VCF Automation, or VCF Operations layers. Instead, NSX Manager handles all feature entitlement checks internally.

Therefore, the new license must be installeddirectly in NSX Manager, under:

System → Licensing → NSX → Add License

Options A, C, and D are incorrect because none of those components control NSX feature activation.