2V0-620 · Question #20
An administrator needs to monitor traffic on vSwitches in a vSphere 6.x environment. Which option, if configured, would accomplish this task?
The correct answer is C. Promiscuous Mode. Promiscuous Mode is the vSwitch security policy that allows a port or VM to receive all frames on the network segment, enabling passive traffic monitoring.
Question
An administrator needs to monitor traffic on vSwitches in a vSphere 6.x environment. Which option, if configured, would accomplish this task?
Options
- AForged Transmits
- BMAC Address Changes
- CPromiscuous Mode
- DNotify Switches
How the community answered
(44 responses)- A2% (1)
- B5% (2)
- C91% (40)
- D2% (1)
Why each option
Promiscuous Mode is the vSwitch security policy that allows a port or VM to receive all frames on the network segment, enabling passive traffic monitoring.
Forged Transmits is a security policy that controls whether a VM can send frames with a source MAC address different from its configured MAC - it has no effect on traffic visibility or monitoring.
MAC Address Changes controls whether the guest OS is allowed to change its effective MAC address from the one assigned in the VM configuration - this is a security hardening setting, not a monitoring feature.
When Promiscuous Mode is set to Accept on a vSwitch portgroup, the virtual NIC passes all frames it receives to the guest OS - including traffic not addressed to that VM's MAC address. This behavior mirrors how a physical NIC in promiscuous mode works, making it the mechanism used by network monitoring tools, packet analyzers, and intrusion detection systems to observe all traffic on a vSwitch segment.
Notify Switches is a NIC teaming option that sends RARP packets to physical switches when a failover occurs to update MAC address tables - it is unrelated to traffic capture or monitoring.
Concept tested: vSwitch Promiscuous Mode for traffic monitoring
Source: https://docs.vmware.com/en/VMware-vSphere/6.0/com.vmware.vsphere.security.doc/GUID-92F3AB1F-B4C5-4F67-A1B7-190E109E2DE4.html
Topics
Community Discussion
No community discussion yet for this question.