Logging is critical for security operations and compliance, but it must be managed carefully. In vDefend, logging is exceptionally granular: it is enabled on a strict per-rule basis.

Why Option D is true and Option A is false: If an administrator enabled logging globally for every single rule (including high-volume infrastructure traffic like DNS or basic allowed web traffic), the ESXi hosts would generate a massive flood of syslog traffic. This causes significant CPU overhead, network congestion, and fills up log server storage rapidly. Best practice is to only enable logging on 'Drop/Deny' rules, or on specific 'Allow' rules governing highly critical applications.

(Option B is false because standard syslog protocols are used, supporting third-party tools like Splunk or QRadar. Option C is false because the ESXi host sends syslogs directly to the logging server; hair-pinning logs through the Management Plane would cause an architecture bottleneck).