In FusionCompute, which of the following descriptions about security groups is wrong?

Question

Options

• AA network card of a virtual machine can only be added to one security group
• BThe security group supports virtual machine NICs in SRIOV pass-through mode
• CThe security group does not support virtual machine NICs in user mode
• DThe security group supports virtual machine NICs in normal kernel mode

• A
  5% (2)
• B
  83% (33)
• C
  10% (4)
• D
  3% (1)

Explanation

Option B is incorrect because SR-IOV (Single Root I/O Virtualization) pass-through mode bypasses the virtual switch entirely, routing traffic directly between the physical NIC and the VM. Since FusionCompute security groups enforce rules at the virtual switch layer, they have no visibility into pass-through traffic and therefore cannot support SR-IOV NICs.

Options A, C, and D are all accurate statements and thus not the answer: A is correct because each virtual NIC is bound to exactly one security group (one-to-one mapping); C correctly notes that user-mode NICs (which operate in userspace network stacks) are also unsupported by security groups; D correctly identifies normal kernel mode as the supported NIC type, since kernel-mode virtual NICs do pass through the virtual switch where rules are applied.

Memory tip: Think "bypass = blind spot." SR-IOV bypasses the virtual switch → security groups are blind to it. Any NIC mode that skips the virtual switch (SR-IOV, user-mode) is unsupported; only standard kernel-mode NICs that flow through the virtual switch can have security group rules enforced.

No community discussion yet for this question.