An administrator tries to capture network traffic for a virtual machine, but cannot see the expected traffic in the packet capture tool. Which step can resolve the problem?

Migrating to a Distributed Virtual Switch does not automatically resolve the issue because DVS port groups apply the same default security policy of rejecting promiscuous mode; the policy still must be explicitly enabled.

By default, vSphere virtual switches drop frames not addressed to the VM's MAC address. Enabling Promiscuous Mode on the port group overrides this behavior and passes all frames to the VM's NIC, allowing a packet capture tool such as Wireshark to observe traffic destined for other VMs on the same port group or VLAN.

The MAC Address Changes security setting controls whether a VM is permitted to change its effective MAC address, which affects inbound filtering but does not grant visibility into traffic addressed to other MAC addresses.

Forged Transmits controls whether a VM can send packets with a source MAC address different from its configured address; it affects outbound traffic and does not allow the capture of inbound traffic destined for other VMs.