I once took over a decommissioning project of a DMZ set up for a connection to a third party no longer used. Everything documented showed that all connections were no longer active.

Step 1 was to do the ‘scream test’. Some how the enterprise routed the most random traffic through there as we took offline random servers and people’s desktops. Turns out the screaming that happens is at you for making things break instead of a pat on the back for discovering bad networking.