nerdexam
Broadcom-VMware

2V0-621 · Question #148

An administrator tries to capture network traffic for a virtual machine, but cannot see the expected traffic in the packet capture tool. Which step can resolve the problem?

The correct answer is B. Enable Promiscous Mode on the relevant port group. Promiscuous mode must be enabled on the port group so the packet capture VM can receive all frames traversing the virtual switch segment, not just those addressed to its own MAC.

Section 1 – Configure and Administer vSphere 6.x Security

Question

An administrator tries to capture network traffic for a virtual machine, but cannot see the expected traffic in the packet capture tool. Which step can resolve the problem?

Options

  • AMigrate the virtual machine to a Distributed Virtual Switch.
  • BEnable Promiscous Mode on the relevant port group.
  • CModify the default value of MAC Address changes.
  • DEnable Forged Transmits on the virtual machine.

How the community answered

(45 responses)
  • A
    2% (1)
  • B
    78% (35)
  • C
    13% (6)
  • D
    7% (3)

Why each option

Promiscuous mode must be enabled on the port group so the packet capture VM can receive all frames traversing the virtual switch segment, not just those addressed to its own MAC.

AMigrate the virtual machine to a Distributed Virtual Switch.

Migrating to a Distributed Virtual Switch changes the switch type but does not by itself enable promiscuous access; the security policy must still be changed to allow the capture VM to see all traffic.

BEnable Promiscous Mode on the relevant port group.Correct

By default, a virtual switch drops frames not destined for the vNIC's MAC address; enabling Promiscuous Mode on the port group overrides this behavior and allows the network adapter to pass all traffic to the guest OS, which is required for a packet capture tool to observe traffic from other virtual machines on the same segment.

CModify the default value of MAC Address changes.

MAC Address Changes controls whether the guest can alter its own MAC address; it does not affect whether the vNIC receives frames destined for other MAC addresses.

DEnable Forged Transmits on the virtual machine.

Forged Transmits controls whether frames sent with a MAC different from the vNIC's configured address are allowed to leave the port; it does not enable reception of traffic addressed to other machines.

Concept tested: vSwitch promiscuous mode for packet capture

Source: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-92F3AB1F-B4C5-4F25-A010-8820D7250350.html

Topics

#promiscuous mode#packet capture#portgroup security policy#network monitoring

Community Discussion

No community discussion yet for this question.

Full 2V0-621 Practice