When should you enable log indexing on a Standalone Deployment?

The correct answer is D. Official R82 Logging and Monitoring documentation states that in a standalone deployment, log indexing is disabled by default and should be enabled only if the standalone server CPU has 4 or more cores. Option A is false because standalone is the explicit exception to default-enabled log indexing. Option B is too strict; the official threshold is four cores, not eight. Option C is wrong because Bridge mode is not the deployment category for this log-indexing default. Log indexing improves log query speed, but it consumes CPU and disk resources. In a standalone deployment, the same machine acts as management/log server and Security Gateway, so enabling indexing without adequate resources can hurt gateway performance. The practical exam takeaway is direct: distributed management/logging normally supports indexing by default; standalone requires a resource check before enabling indexing. Reference topics: Log Indexing, Standalone deployment, log query performance, CPU requirements.