The VCF 9.0 Logging and Auditing Guide explains that audit information-including user logins, configuration changes, and API requests-is collected and made searchable through VCF Operations for Logs. The extract states:
"VCF Operations for Logs provides centralized log aggregation and auditing for all VCF services, including audit trails of logins and configuration changes." Option A (audit logs per instance) is unnecessary because auditing is centralized. Option C (Enable Audit Events) is not a standalone step; it is a capability surfaced through Logs. Option D (Event logs in vCenter) covers only vCenter, not fleet-wide audit trails. Therefore, the correct step is to integrate VCF Operations for Logs.