Pass Your Cisco 350-401 Exam Easy!

That diagnosis is supported by a different symptom: The migrated VM lands on a host with no matching port group and loses network connectivity. Here the recorded observation is: two guests in separate isolated virtual networks cannot ARP for one another despite using the same physical host. The applicable cause is: their virtual NICs attach to different isolated virtual switches or port groups.

That diagnosis is supported by a different symptom: A compromised VM forges another tenant's MAC and sends frames through its vNIC unrestricted. Here the recorded observation is: two guests in separate isolated virtual networks cannot ARP for one another despite using the same physical host. The applicable cause is: their virtual NICs attach to different isolated virtual switches or port groups.

That diagnosis is supported by a different symptom: VMs on VLAN 120 communicate internally but cannot reach external devices on VLAN 120. Here the recorded observation is: two guests in separate isolated virtual networks cannot ARP for one another despite using the same physical host. The applicable cause is: their virtual NICs attach to different isolated virtual switches or port groups.

Physical uplink VLAN trunks do not establish local switching between two virtual NICs on the same host.

That control reduces a separate risk: Virtual networking is not consistently provisioned across destination hosts. For the described design, the recurring risk arises from: their virtual NICs attach to different isolated virtual switches or port groups. The specific required safeguard is: verify virtual-switch port-group membership and VLAN isolation after VM migrations.

Virtual port security can restrict guest behavior, but it does not connect both NICs to the host switch and port group.

Attaching the vNICs to an appropriate virtual switch/port group on the host would not align virtual port-group VLAN tagging and physical uplink 802.1Q trunk permitted VLANs.

Enabling supported virtual-switch port security or forged-transmit rejection for the guest port group would not align virtual port-group VLAN tagging and physical uplink 802.1Q trunk permitted VLANs.

Using consistent distributed virtual-switch port-group definitions or equivalent supported host networking would not align virtual port-group VLAN tagging and physical uplink 802.1Q trunk permitted VLANs.

This test measures a different behavior: Capture east-west frames on the virtual switch and verify no physical-uplink transit is required for local guests. It does not establish the target outcome. For the documented fault, the direct acceptance test is: verify tagged VLAN traffic across virtual and physical switch boundaries.

This test measures a different behavior: Inspect inner guest startup and exposed CPU virtualization features in the parent VM. It does not establish the target outcome. For the documented fault, the direct acceptance test is: verify tagged VLAN traffic across virtual and physical switch boundaries.

This test measures a different behavior: Validate guest connectivity and port-group assignment after a test live migration. It does not establish the target outcome. For the documented fault, the direct acceptance test is: verify tagged VLAN traffic across virtual and physical switch boundaries.

That diagnosis is supported by a different symptom: Second-level virtual routers report hardware-assisted virtualization unavailable. Here the recorded observation is: vMs on VLAN 120 communicate internally but cannot reach external devices on VLAN 120. The applicable cause is: the physical uplink trunk or virtual port-group VLAN mapping excludes VLAN 120.

That diagnosis is supported by a different symptom: The migrated VM lands on a host with no matching port group and loses network connectivity. Here the recorded observation is: vMs on VLAN 120 communicate internally but cannot reach external devices on VLAN 120. The applicable cause is: the physical uplink trunk or virtual port-group VLAN mapping excludes VLAN 120.

That diagnosis is supported by a different symptom: Two guests in separate isolated virtual networks cannot ARP for one another despite using the same physical host. Here the recorded observation is: vMs on VLAN 120 communicate internally but cannot reach external devices on VLAN 120. The applicable cause is: the physical uplink trunk or virtual port-group VLAN mapping excludes VLAN 120.

The needed correction is to align virtual port-group VLAN tagging and physical uplink 802.1Q trunk permitted VLANs.

That control reduces a separate risk: The virtual-switch security policy permits forged source-MAC transmissions. For the described design, the recurring risk arises from: the physical uplink trunk or virtual port-group VLAN mapping excludes VLAN 120. The specific required safeguard is: validate virtual/physical VLAN mapping together before adding tenant networks.

This test measures a different behavior: Validate guest connectivity and port-group assignment after a test live migration. It does not establish the target outcome. For the documented fault, the direct acceptance test is: verify tagged VLAN traffic across virtual and physical switch boundaries.

Using consistent distributed virtual-switch port-group definitions or equivalent supported host networking would not enable supported virtual-switch port security or forged-transmit rejection for the guest port group.

Creating separate guest VMs with allocated vCPUs, memory and virtual NICs managed by the hypervisor would not enable supported virtual-switch port security or forged-transmit rejection for the guest port group.

Attaching the vNICs to an appropriate virtual switch/port group on the host would not enable supported virtual-switch port security or forged-transmit rejection for the guest port group.

This test measures a different behavior: Validate guest connectivity and port-group assignment after a test live migration. It does not establish the target outcome. For the documented fault, the direct acceptance test is: transmit a controlled spoofed-source frame and confirm the virtual switch rejects it while legitimate frames pass.

This test measures a different behavior: Capture east-west frames on the virtual switch and verify no physical-uplink transit is required for local guests. It does not establish the target outcome. For the documented fault, the direct acceptance test is: transmit a controlled spoofed-source frame and confirm the virtual switch rejects it while legitimate frames pass.

This test measures a different behavior: Inspect guest inventory and confirm two separate VM OS instances with independent virtual resources. It does not establish the target outcome. For the documented fault, the direct acceptance test is: transmit a controlled spoofed-source frame and confirm the virtual switch rejects it while legitimate frames pass.

That diagnosis is supported by a different symptom: Changes to one guest kernel unexpectedly take the other lab workload down because both tests run in one OS. Here the recorded observation is: a compromised VM forges another tenant's MAC and sends frames through its vNIC unrestricted. The applicable cause is: the virtual-switch security policy permits forged source-MAC transmissions.

That diagnosis is supported by a different symptom: The migrated VM lands on a host with no matching port group and loses network connectivity. Here the recorded observation is: a compromised VM forges another tenant's MAC and sends frames through its vNIC unrestricted. The applicable cause is: the virtual-switch security policy permits forged source-MAC transmissions.

That diagnosis is supported by a different symptom: Two guests in separate isolated virtual networks cannot ARP for one another despite using the same physical host. Here the recorded observation is: a compromised VM forges another tenant's MAC and sends frames through its vNIC unrestricted. The applicable cause is: the virtual-switch security policy permits forged source-MAC transmissions.

That control reduces a separate risk: The physical uplink trunk or virtual port-group VLAN mapping excludes VLAN 120. For the described design, the recurring risk arises from: the virtual-switch security policy permits forged source-MAC transmissions. The specific required safeguard is: recheck port-group anti-spoof policies during migration and vNIC replacement.

That control reduces a separate risk: Virtual networking is not consistently provisioned across destination hosts. For the described design, the recurring risk arises from: the virtual-switch security policy permits forged source-MAC transmissions. The specific required safeguard is: recheck port-group anti-spoof policies during migration and vNIC replacement.

That control reduces a separate risk: Their virtual NICs attach to different isolated virtual switches or port groups. For the described design, the recurring risk arises from: the virtual-switch security policy permits forged source-MAC transmissions. The specific required safeguard is: recheck port-group anti-spoof policies during migration and vNIC replacement.

Reserve or allocate appropriate VM memory and host capacity would not meet the need for consistent distributed virtual-switch port-group definitions or equivalent supported host networking.

Enabling supported virtual-switch port security or forged-transmit rejection for the guest port group would not meet the need for consistent distributed virtual-switch port-group definitions or equivalent supported host networking.

Aligning virtual port-group VLAN tagging and physical uplink 802.1Q trunk permitted VLANs would not meet the need for consistent distributed virtual-switch port-group definitions or equivalent supported host networking.