Transit fare-collection VMs handle cardholder-like data. Auditors want assurance that east-west isolation on those segments is actually enforced. What should the administrator monitor?
Select an answer to reveal the explanation.
Short Explanation
PCI-like fare data is a locked turnstile, and the deny log is the clicker that proves nobody hopped it. Watch Distributed Firewall hits and denies on those fare groups, not BGP uptime.
Full Explanation
Transit fare-collection VMs that handle cardholder-like data need assurance that east-west isolation is actually enforced by monitoring NSX-T Distributed Firewall hit and deny logs for the fare-data security groups. Treat those DFW logs as the fare-hall cameras that show whether the isolation doors actually closed on the conversation. Tier-0 BGP neighbor uptime as cardholder-isolation evidence fails by concept because BGP adjacency proves routing neighbors, not Distributed Firewall micro-segmentation hits on fare-data groups. Carbon Black Cloud sensor version only, with Distributed Firewall logging left off, fails because sensor version shows agent currency, not whether east-west DFW denies fired on the overlay. Horizon instant-clone counts on the fare VLAN fail because clone inventory is VDI capacity, not firewall isolation evidence. Exam caveat: regulation monitoring for east-west isolation is DFW hit and deny logs on the relevant security groups; BGP, sensor version alone, and Horizon counts do not prove isolation enforcement. Operational check: enable logging on fare-data Distributed Firewall rules, confirm deny and allow hits in NSX and the civic SIEM, review logs during the audit window, and document the fare-data group logging standard in the transit PCI-style assurance runbook.