You want to implement distributed firewall policies that micro-segment VM-to-VM traffic, including within the VLAN and same host. The VMs should be able to send traffic on permitted TCP ports, but…

Question

Options

• ASVI 10 on the switch has IP local ARP proxy enabled on it
• BThe VMware host is configured to implement a local firewall
• CVLAN 10 is converted to a PVLAN on the switch only. The VMs are placed in an isolated VLAN
• DVLAN 10 is converted to a PVLAN on the switch and VMware hosts. The VMs are placed in an

• A
  48% (29)
• B
  35% (21)
• C
  17% (10)

Explanation

Implementing a Private VLAN (PVLAN) on both the physical switch and the VMware hosts (option D) is essential because VMs on the same ESXi host communicate through the virtual switch - if PVLAN isolation is only on the physical switch, same-host VM traffic bypasses it entirely. Option A is required because isolated PVLAN ports cannot ARP for other hosts in the same subnet; enabling Local Proxy ARP on the SVI allows the Layer 3 gateway to answer ARP requests on their behalf, steering permitted TCP traffic through the gateway where policies are enforced rather than silently dropping it.

Why the distractors are wrong:

• B is wrong because a "local firewall" on the VMware host (ESXi host firewall) is a host-level construct, not a distributed firewall; it does not provide per-VM micro-segmentation at the vNIC level.
• C is wrong because configuring PVLAN only on the physical switch leaves a gap - VMs on the same host still communicate freely through the virtual switch, breaking isolation for intra-host traffic.

Memory tip: Think "Both sides + Glue." PVLAN must cover both the physical and virtual switch layers (D), and Local Proxy ARP is the glue that lets isolated hosts still reach permitted destinations through the gateway (A). If either piece is missing, micro-segmentation is incomplete.

No community discussion yet for this question.