Public-health clinic staff save a new Distributed Firewall section for immunization VMs, but realized rules on the transport nodes still match the previous policy. What publish discipline should the administrator follow?
Select an answer to reveal the explanation.
Short Explanation
A saved draft is a sticky note on the clinic fridge, not the posted visiting-hours sign. Peer-review it, then publish so the hosts actually enforce the new immunization rules.
Full Explanation
When public-health clinic staff save a new Distributed Firewall section for immunization VMs but realized rules on transport nodes still match the previous policy, the administrator must peer-review the saved draft, then publish so the policy is realized on the transport nodes. Treat save as drafting the clinic memo and publish as posting it on the ward board—transport nodes only enforce what is published and realized. Rebooting every ESXi host so unpublished drafts auto-realize on boot fails by concept because drafts do not auto-realize on reboot; publish is the required realization step. Exporting the unpublished draft into a GRC register and skipping NSX-T publish fails because a paper or GRC copy never updates transport-node enforcement. Converting the draft to a Tier-1 static route so realization is unnecessary fails because routing next-hops are not Distributed Firewall sections and do not realize micro-segmentation. Exam caveat: operational DFW management is review-then-publish for realization; host reboot, GRC export alone, and T1 routes do not publish policy. Operational check: peer-review the immunization section draft, publish in NSX, confirm realization status on transport nodes, Traceflow to verify new rules hit, and document the publish checklist in the public-health change procedure.