911 computer-aided dispatch uses a shared NSX-T service object named civic-https that many Distributed Firewall rules reference. A technician edits the object to add TCP 8443. What must the administrator consider before publishing?
Select an answer to reveal the explanation.
Short Explanation
That civic-https object is a master key, not a sticky note on one door. Twist the key and every lock that uses it turns—so walk the blast radius before anyone publishes 8443.
Full Explanation
When 911 computer-aided dispatch uses a shared NSX-T service object named civic-https that many Distributed Firewall rules reference, and a technician edits it to add TCP 8443, the administrator must consider that the edit changes every rule that references civic-https, so the blast radius must be reviewed first. Treat civic-https as the shared civic door-label used on many floors: changing the label changes every door that cites it. Believing service object edits apply only to the rule currently highlighted in the UI fails by concept because services are shared objects; the UI highlight does not scope the edit. Believing shared services never affect Emergency-category rules so no review is required fails because Emergency rules that reference civic-https also inherit the port change. Believing changing a service object updates only Tier-0 BGP communities, not Distributed Firewall, fails because service objects feed firewall rules, not BGP communities. Exam caveat: shared NSX services and groups have estate-wide blast radius; inventory referencing rules before publishing port changes. Operational check: search all Distributed Firewall rules referencing civic-https, assess whether TCP 8443 is intended everywhere, prefer a new service for CAD-only ports if not, publish only after peer review, and document the shared-object change in the 911 change ticket.