During an audit month, courts must prove Environment-category Distr…

Question

During an audit month, courts must prove Environment-category Distributed Firewall denials on case-management VMs without flooding the SIEM for the rest of the year. What operational step should the administrator take?

Accepted Answer

Enable logging on Environment deny rules for the audit window, then disable noisy unused logs after review — Audit month is like turning the courthouse cameras on for a visitor walk-through, not ripping them out and not leaving every hallway mic live forever. Log the Environment denies while the auditors watch, then quiet the chatter that does not help.

Answer

Disable the Distributed Firewall on the courts cluster for the audit month so deny logs stay empty

Answer

Enable packet capture on every Tier-0 uplink and treat routing traces as the only denial evidence

Answer

Replace Environment policy with a vendor-neutral control-family memo instead of NSX-T logs

During an audit month, courts must prove Environment-category Distributed Firewall denials on case-management VMs without flooding the SIEM for the rest of the year. What operational step should the administrator take?

Short Explanation

Full Explanation