Public-health added Distributed Firewall rules for a new clinic segment, but the VMs still follow the old policy. What GUI action realizes those new rules?
Select an answer to reveal the explanation.
Short Explanation
Writing the new clinic rules in a notebook doesn't lock the doors until you hit Publish. Draft save is not live policy—Publish on the DFW page is.
Full Explanation
Public-health clinic Distributed Firewall changes remain drafts until Publish on the Distributed Firewall page. Saving a draft is not realization; civic operators must explicitly publish so transport nodes receive the new clinic-segment rules and VMs stop following the old realized policy. Restoring last week’s backup under System > Backup & Restore is destructive rollback, not the publish action that realizes the newly authored rules. Power-cycling clinic VMs under Inventory does not load unpublished DFW drafts; realization is a policy publish to the data plane, not a guest reboot ritual. Renaming a segment under Networking does not auto-publish DFW policy. Exam caveat: draft vs published is a frequent VCTA-NV discriminator—UI may show edits while the data plane still enforces the last published revision until Publish succeeds. Operational check: on the DFW page, review the clinic rule set, click Publish, wait for success/realization indicators, verify a clinic VM now matches the new Applied To/rules, and note publish time and publisher in the public-health change ticket. If publish fails, inspect realization errors before rebooting clinic VMs; fix group membership or rule conflicts, republish, and only then validate patient-facing clinic flows in the change window.