1V0-642 · Question #59
How do virtual networks that are natively isolated from each other provide support for overlapping IP address in a multi-tenant environment?
The correct answer is A. By enabling isolation without using access control lists and firewall rules. Network virtualization eliminates the need for IT to change IP addresses. With virtual networks natively isolated from each other and from the underlying physical hardware, network virtualization supports overlapping IP addresses in a multi-tenant environment. That means the…
Question
How do virtual networks that are natively isolated from each other provide support for overlapping IP address in a multi-tenant environment?
Options
- ABy enabling isolation without using access control lists and firewall rules.
- BBy enabling isolation with the help of Active Directory (AD).
- CBy employing the spanning tree protocol.
- DBy implementing load balancing.
How the community answered
(31 responses)- A84% (26)
- B3% (1)
- C3% (1)
- D10% (3)
Explanation
Network virtualization eliminates the need for IT to change IP addresses. With virtual networks natively isolated from each other and from the underlying physical hardware, network virtualization supports overlapping IP addresses in a multi-tenant environment. That means the same IP addresses can be used in separate enterprise networks that run over the same physical
Topics
Community Discussion
13
Yusuf A.Dec 19, 2025The answer is A. When virtual networks are natively isolated at the network virtualization layer, each tenant gets their own logical network space that is completely separate from others by design, so overlapping IPs like 192.168.1.0/24 in two different tenants never collide without needing ACLs or firewall rules to enforce that separation. My team lead actually drew this out for me on a whiteboard, showing how the overlay encapsulation keeps tenant traffic in separate tunnels end to end, which is what makes the isolation native rather than policy-driven.
Johan G.Dec 21, 2025Solid explanation, and I would add that this tenant boundary isolation is what lets you run overlapping RFC 1918 space across hundreds of namespaces on the same NSX-T fabric without touching a firewall rule, though once you are inside a single tenant's segment you still want NetworkPolicy to govern pod-to-pod east-west, because native isolation only holds at the overlay boundary, not within it.
Brenda K.Dec 1, 2025Quick win on this one, do not overthink it and do not burn clock here. The correct answer is A. Virtual networks that are natively isolated, think NSX logical switches or VXLAN-backed segments, achieve tenant separation at the overlay layer itself. That native isolation is what lets two tenants each run a 192.168.1.0/24 subnet without conflict, because each logical network is its own broadcast domain with no path between them by default. You do not need ACLs or firewall rules to prevent tenant A from talking to tenant B, the isolation is structural, not policy-enforced. B is wrong because Active Directory handles identity and authentication, not network plane separation. C is wrong because spanning tree is a loop-prevention mechanism on layer 2 physical networks, it has nothing to do with multi-tenant IP overlap. D is wrong because load balancing distributes traffic, it does not isolate address spaces. Flag this question if you blanked on it today and give it one more pass tonight, but if you understood it, move on fast.
Johan G.Dec 9, 2025Saw this exact concept come up on my exam and I almost second-guessed myself because the wording felt too simple, but A is the right call. The whole point of overlay virtual networks, think VXLAN segments in NSX, is that each tenant segment lives in its own encapsulation envelope, so 10.0.0.0/24 in tenant A and 10.0.0.0/24 in tenant B never see each other at the data plane level. That isolation is structural, baked into the overlay header and the separate logical routing contexts, not bolted on afterward with ACL rules or firewall policies. ACLs and firewall rules come into play when you want to control traffic that would otherwise cross between segments, but the overlapping IP problem is already solved before you even write a single rule. When I sat the exam I remember pausing on this one because options C and D feel like they belong on a completely different exam, spanning tree is loop prevention and load balancing is traffic distribution, neither touches the IP namespace problem at all, and B mixing in Active Directory is just noise. The native encapsulation of the virtual network is doing the heavy lifting here.
Prof. SaraNov 15, 2025I almost picked B thinking AD handled tenant separation, but native isolation is the whole point: the network boundary itself handles overlapping IPs, no ACLs or firewall rules required.
Imani T.Nov 17, 2025AD integration does help with auth and policy enforcement across tenants, so it is not completely out of the picture, but you are right that the network-level isolation is what eliminates the IP overlap problem without extra rules.
Ola B.Nov 28, 2025That question trips people up because it sounds like it is asking about a network trick, but it is really asking about what native isolation means at a fundamental level, so spin up a quick NSX-T or even a basic overlay lab and try to ping between two tenant segments that share the same 192.168.1.0/24 subnet without touching a firewall rule or ACL. Does the traffic bleed across, or does the isolation hold on its own before you add any of those controls?
Johan G.Nov 30, 2025The isolation holds because each segment gets its own VNI and the tunnel endpoints on the transport nodes never forward frames cross-segment without a router in the path, so you are testing encapsulation scope, not ACL logic.
Imani T.Nov 24, 2025Honestly I looked at this and immediately thought B had something to it because AD came up in some of the identity-related isolation stuff I studied earlier, so I second-guessed myself for a second. What snapped me back was remembering the actual point of native isolation in NSX virtual networks, which is that the overlay handles tenant separation at the network virtualization layer itself, so two tenants can run 192.168.1.0/24 all day long and never touch each other because the logical boundary is baked in, not bolted on with ACLs or firewall rules. C and D are just noise, spanning tree is a layer 2 loop prevention thing and load balancing has nothing to do with address space separation. The word "natively" in the question stem is basically telling you the answer, because native isolation means the mechanism is intrinsic to how the virtual network is built, not dependent on external policy enforcement tools.
Grigory K.Nov 19, 2025A is right. B, C, D are complete noise. Native isolation IS the whole point, no ACLs needed.
Prof. SaraNov 21, 2025Grigory is right that native isolation is the core answer for the blueprint, but worth flagging for exam day that several objectives pair isolation with least-privilege ACLs as a defense-in-depth layer, so if a stem asks what provides isolation natively, A wins, but if it asks for a complete hardening strategy, ACLs re-enter the picture.
Dervla O.Nov 27, 2025Going with B here because multi-tenant isolation in a virtual network environment hinges on directory-level identity separation, and Active Directory is exactly the mechanism that enforces those tenant boundaries so overlapping IP ranges never collide. The stem is pointing you toward an authentication and identity framework, not a protocol or a ruleset, and AD fits that description cleanly.
Johan G.Nov 29, 2025Dervla, the question is asking what provides network-level isolation for those overlapping IP ranges, and that is VLANs, which segment layer-2 broadcast domains to keep tenant traffic separated at the switch fabric before any identity layer even enters the picture. Active Directory handles authentication and policy, but it does not enforce the network boundary that prevents one tenant's traffic from reaching another's.