A city permitting allow exists in Distributed Firewall, but a higher Emergency deny matches first and hit counts never increment on the allow. What should the administrator do?
Select an answer to reveal the explanation.
Short Explanation
First match wins, like a security line that stops at the first no. A duplicate allow under a deny never gets a turn. Read hit counts and fix the Emergency rule instead of stacking copies at the bottom.
Full Explanation
When a city permitting allow exists in Distributed Firewall but a higher Emergency deny matches first and hit counts never increment on the allow, read rule order and hit counts, then move or adjust the Emergency deny rather than duplicating the allow at the bottom. First match wins: traffic stopped by a higher Emergency deny never reaches a lower allow, so stacking another allow under the deny cannot help permitting staff. Fix the conflicting Emergency rule to restore civic least-privilege intent. Creating the same allow again at the bottom of the policy fails by concept because a duplicate below a matching deny still never evaluates. Disabling the Distributed Firewall to bypass Emergency fails by concept because turning off DFW removes all micro-segmentation rather than correcting rule order. Converting the allow into a Carbon Black Cloud sensor rule fails by concept because CBC permissions are endpoint prevention, not NSX DFW rule-order remediation. Exam caveat: always read hit counts and section order before cloning allows; Emergency deny above an allow is a classic VCP-SEC trap. Operational check: inspect hit counts on the Emergency deny and the permitting allow, adjust or relocate the deny, retest permitting flows, confirm allow hits increment, and record the rule-order change in the city NSX policy review for municipal governance.