An administrator wants to virtualize the company's web servers, application servers, and database servers. Which of the following should be done to secure the virtual host machines? (Select TWO).

VLANs on the virtual switch segment guest VM network traffic from each other, which is a guest-layer control, not a mechanism that directly secures the host machine itself.

Layer 2 virtual switch security precautions such as ARP inspection protect inter-VM network communication but do not secure the underlying host machine.

Restricting host access to a secure management interface (such as a dedicated out-of-band management VLAN or bastion host) ensures all administrative sessions are authenticated, encrypted, and logged, reducing the attack surface on the hypervisor.

Distributing guests by application role or trust zone is a guest placement best practice for limiting lateral movement, but it does not directly harden the host machine's security posture.

Restricting physical and network access to the host console prevents an attacker with local presence from bypassing OS-level authentication and directly interacting with the hypervisor, which controls all guest VMs.