A police evidence VM needs connectivity to the evidence network through the host. Which component provides that Layer 2 switching function for the VM's vNIC?

A police evidence VM reaches its evidence network through a virtual NIC that must attach to a switching function on the host. That Layer 2 switching function is provided by a virtual switch on the hypervisor, which bridges VM vNICs to host uplinks and network segments. The vSwitch (or equivalent virtual networking construct) is what plugs the guest's vNIC into the evidence VLAN, port group, or segment so frames can leave the host toward the civic evidence network. Without that host-side bridge, the vNIC has no path into the intended Layer 2 domain even if the guest OS shows a link-up state locally.

A physical-only STP instance that cannot attach virtual NICs denies the attachment model hypervisors actually use and confuses loop-prevention topology with virtual machine connectivity. An adjacency table on the VM that replaces all Ethernet switching misapplies CEF adjacency concepts inside the guest and does not provide host bridging for vNICs. A Type 2 requirement that forbids virtual switches on Type 1 hosts invents a false restriction; virtual switches are used across hypervisor types as part of connecting vNICs to uplinks.

Exam caveat: vNIC connectivity questions almost always point to the hypervisor virtual switch bridging guests to host uplinks and segments—not to STP databases, CEF adjacency inside the VM, or Type 1 versus Type 2 bans on vSwitches.

Operational check: map the evidence VM vNIC to the correct virtual switch port group or network, confirm the uplink assignment toward the evidence segment, verify MAC learning on the vSwitch/port group, and test Layer 2 reachability from the guest to evidence resources before declaring the VM network-ready.