A 911 CAD packet log in NSX-T shows dispatcher-to-records traffic hitting only the default drop. Operations confirms that flow is required. What should the security administrator change next?
Select an answer to reveal the explanation.
Short Explanation
Default deny is the firehouse back door — if a needed truck is bouncing off it, cut a labeled key, don't take the lock off the building. Write a specific allow with logging so the exception is proven and the rest of the wall stays up.
Full Explanation
NSX-T distributed firewall evaluates top-down and commonly ends in a default drop. Hit counts and packet logs on that drop identify a missing allow, not a broken overlay or Guest Introspection failure. The repair is a least-privilege rule for the exact source, destination, and service with logging enabled. An any-any replacement, T0 redesign, or GI uninstall expands exposure and does not use the log evidence.