A Cisco ACI fabric is integrated with VMware VDS. The fabric must apply a security policy to check the integrity of traffic out of the network adapter. Which action must be taken to drop the packet…

'Reject MAC changes' applies to inbound traffic and prevents a VM from changing its effective MAC address, but it does not address forged outbound transmits from the VM.

The 'Reject forged transmits' security policy on a VMware vSphere Distributed Switch (VDS) ensures that the ESXi host drops any outbound packet from a virtual machine if the source MAC address in the packet header does not match the effective MAC address configured for that virtual machine's virtual network adapter. This prevents MAC spoofing by guest operating systems, enhancing network security and integrity.

'Accept MAC changes' would permit a VM to alter its effective MAC address, which contradicts the objective of enforcing MAC address integrity.

'Accept forged transmits' would allow a VM to send packets with a source MAC address different from its own, directly opposing the requirement to drop such packets due to a mismatch.