A 911 CAD packet log in NSX-T shows dispatcher-to-records traffic hitting only the default drop. Operations confirms that flow is required. What should the security administrator change next?
Select an answer to reveal the explanation.
Short Explanation
Default deny is the firehouse back door — if a needed truck is bouncing off it, cut a labeled key, don't take the lock off the building. Write a specific allow with logging so the exception is proven and the rest of the wall stays up.
Full Explanation
When a 911 CAD packet log in NSX-T shows dispatcher-to-records traffic hitting only the default drop and operations confirms that flow is required, add a specific allow for the dispatcher source, records destination, and service, with logging enabled. Default drop is working as designed; life-safety CAD needs an explicit least-privilege allow rather than opening the world. Specific source, destination, and service with logging restores the required civic flow under audit. Replacing the default drop with an any-any allow so CAD never misses a packet fails by concept because any-any destroys micro-segmentation and expands blast radius across 911 systems. Converting the T0 gateway to an overlay routing lab so the flow bypasses the distributed firewall fails by concept because changing routing design to bypass DFW is not a justified security fix for one required flow. Uninstalling Guest Introspection from VMware Tools because default deny is a GI signature miss fails by concept because default drop is DFW policy behavior, not a Guest Introspection signature failure. Exam caveat: required flows get specific allows with logging—never replace default drop with any-any or blame Guest Introspection for DFW default deny. Operational check: publish the specific dispatcher-to-records allow with logging, confirm hit counts and CAD function, keep default drop in place, and file the rule in the 911 firewall change record for municipal public-safety governance.