ABC Corporation uses multiple security zones to protect systems and information, and all of the VM hosts are part of a consolidated VM infrastructure. Each zone has different VM administrators…

Hypervisor-layer firewalling governs network traffic between VMs but has no effect on administrative console access granted through the hypervisor management plane.

Separate virtual switches enforce network segmentation for VM data traffic but do not control which administrator accounts can access VM host management consoles.

Organizing VM hosts into logical containers such as resource pools or folders within a hypervisor management platform, then applying ACLs scoped to those containers, enforces role-based access control at the zone boundary. An administrator granted rights only within their zone's container cannot enumerate or access the console of VM hosts residing in a different zone's container, directly satisfying the cross-zone restriction requirement.

Multi-factor authentication strengthens identity verification at the physical host but does not create zone-based boundaries that prevent one zone's administrator from accessing another zone's VMs.