350-401 Virtualization Practice Question
A company is consolidating branch servers onto a single physical host running a hypervisor. The administrator needs each virtual machine to have its own virtual NIC with an independent MAC address and to be isolated at Layer 2 from other virtual machines unless explicitly connected to the same virtual switch. Which component provides this function?
⚠ Common exam trap
The trap here is assuming the physical switch enforces isolation between virtual machines that live on the same hypervisor host.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The virtual switch inside the hypervisor
The virtual switch is the hypervisor component that gives each virtual machine a virtual NIC and forwards frames between them, enforcing isolation between port groups unless they are connected. The physical switch and trunk only carry traffic once it leaves the host, and the virtual machine monitor handles resource scheduling rather than Layer 2 forwarding.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The hypervisor's virtual machine monitor alone
Why it's wrong here
The virtual machine monitor schedules CPU, memory and device access for virtual machines. While it creates and manages virtual hardware, the Layer 2 forwarding and isolation between vNICs is performed by the virtual switch component, not by the scheduler itself.
- ✗
The physical top-of-rack switch
Why it's wrong here
The physical switch forwards frames between physical ports and uplinks. It has no visibility into virtual machine vNICs inside the hypervisor, so it cannot provide the per-VM Layer 2 isolation described. Traffic between VMs on the same host may never reach it at all.
- ✓
The virtual switch inside the hypervisor
Why this is correct
A virtual switch connects virtual NICs within the hypervisor and forwards frames between them based on MAC addresses, giving each virtual machine its own vNIC and MAC. Virtual machines placed on different virtual switches or port groups remain isolated unless an uplink or explicit connection joins them, matching the requirement.
- ✗
A VLAN trunk configured on the physical NIC
Why it's wrong here
A trunk carries multiple VLANs between the host and the physical switch, but it does not by itself create per-VM vNICs or decide which virtual machines may exchange frames. That internal forwarding and isolation decision belongs to the virtual switch inside the hypervisor.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Key term
Virtual Switch
A virtual switch is a software-based network switch that connects virtual machines within a hypervisor and forwards traffic between them and the physical network.
Key term
Virtual Machine Networking
Virtual machine networking is how virtual computers on a physical server connect to each other, to the internet, and to the rest of a network.
About these practice questions
This 350-401 question is part of Courseiva's 1,923-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.