A library security administrator needs the actual path of a catalog-search VM to a payment VM, including Distributed Firewall drops. Which approach identifies the flow?
Select an answer to reveal the explanation.
Short Explanation
The closet diagram shows cables, not policy. Traceflow and NSX Intelligence actually walk the packet—including DFW drops—so the library can see the real path.
Full Explanation
A library security administrator who needs the actual path of a catalog-search VM to a payment VM, including Distributed Firewall drops, should use NSX Traceflow or NSX Intelligence flow visualization rather than a closet diagram. Those tools walk the logical packet through overlay switching, routing, and Distributed Firewall decisions so the real civic path—and any drop—is visible. Guessing from a wiring-closet patch-panel diagram fails by concept because physical cabling shows underlay ports, not NSX-T policy outcomes, Traceflow hops, or Distributed Firewall drops on overlay conversations. Disabling Distributed Firewall globally to see whether the catalog page loads fails because turning off the control to debug it destroys evidence, widens blast radius across the library estate, and never identifies which rule or hop dropped the flow. Replacing NSX-T with a CISSP data-flow diagram workshop fails because a workshop whiteboard is not an operational path trace of the live fabric and cannot prove where packets die. Exam caveat: path and drop identification for NSX-T uses Traceflow and Intelligence (or equivalent live visualization), not physical diagrams, global firewall disable, or abstract GRC workshops. Operational check: run Traceflow from catalog-search to payment with the current Distributed Firewall policy, note any drop rule and hop, cross-check with NSX Intelligence flow views if licensed, leave Distributed Firewall enabled during troubleshooting, and attach the trace output to the library incident ticket.