During an audit month, courts must prove Environment-category Distributed Firewall denials on case-management VMs without flooding the SIEM for the rest of the year. What operational step should the administrator take?
Select an answer to reveal the explanation.
Short Explanation
Audit month is like turning the courthouse cameras on for a visitor walk-through, not ripping them out and not leaving every hallway mic live forever. Log the Environment denies while the auditors watch, then quiet the chatter that does not help.
Full Explanation
During an audit month, courts prove Environment-category Distributed Firewall denials on case-management VMs by enabling logging on those Environment deny rules for the audit window, then disabling noisy unused logs after review. Treat audit logging as turning on courthouse hallway cameras for the inspection month, then dialing them back so the SIEM is not flooded the rest of the year. Disabling Distributed Firewall on the courts cluster so deny logs stay empty fails by concept because empty logs are not evidence of denials and removing DFW abandons east-west enforcement during the audit. Enabling packet capture on every Tier-0 uplink and treating routing traces as the only denial evidence fails because uplink captures show transit packets, not Environment-category Distributed Firewall deny decisions on case-management vNICs. Replacing Environment policy with a vendor-neutral control-family memo instead of NSX-T logs fails because a managerial memo is not product telemetry proving Environment denials fired. Exam caveat: manage DFW logging as an operational toggle for evidence windows; do not disable DFW, substitute T0 captures, or paper memos for deny proof. Operational check: enable logging on Environment deny rules for case-management groups, confirm SIEM receives deny events during the audit window, tune or disable noisy logs afterward, and archive sample evidence with the courts audit package.