When you use independent nonpersistent disks, successful attackers can remove any evidence that the machine was compromised by shutting down or rebooting the system. Without a persistent record of activity on a virtual machine, administrators might be unaware of an attack. Therefore, you should avoid using independent nonpersistent disks.
If remote logging of events and activity is not configured for the guest, scsiX:Y.mode should be one of the following settings:
Not set to independent nonpersistent
When nonpersistent mode is not enabled, you cannot roll a virtual machine back to a known state when you reboot the system.