An administrator is responsible for a VCF Private Cloud. VCF Operations has identified a VM that violated the CIS Security Standards Benchmark. Which three actions will allow the administrator to determine which symptom(s) triggered the compliance alert? (Choose three.)
Correct Answer: A,C,F
The administrator should first locate the relevant VM compliance alert by filtering the VM's alert list using Alert Subtype = Compliance . Compliance benchmark violations are implemented as alert definitions and symptoms, so filtering by compliance subtype narrows the alert list to the correct class of benchmark findings.
After opening the alert, the administrator should inspect the alert evidence and specifically expand Alert Basis
. Broadcom documents that Alert Basis shows the active symptoms or conditions that were met for the alert when Active Only is enabled, which directly identifies the symptom or symptoms that triggered the compliance violation ( TechDocs ). The Potential Evidence view is also part of the alert investigation workflow and exposes supporting evidence around the alert, including the basis used to explain why the alert fired ( TechDocs ). Related Alerts is not the correct place to identify the triggering symptom; it shows other correlated alerts. Object Type = Compliance is invalid because compliance is an alert subtype, not a VM object type. Go to Alert Definition shows the configured definition, but not necessarily which symptoms were active on that VM at trigger time. Reference topic: Objective 4.16 - Compliance Benchmarks / CIS Security Standards / Alert Basis and Triggered Symptoms .
