On a private cloud virtualization cluster, host management, storage replication, live migration and tenant VM traffic all share one virtual network interface and a single network. What design change best reduces the risk this creates?
Select an answer to reveal the explanation.
Short Explanation
Putting the admin console, the storage pipe and the tenants on one wire is like running the vault's back corridor through the public lobby. Give each kind of traffic its own lane, its own interface and network, so a tenant can't see or touch the others. You can't fix an isolation problem with performance tweaks.
Full Explanation
Separating traffic types onto dedicated virtual network interfaces and isolated networks is a core virtual network security configuration for hosts. Management traffic carries administrative commands and credentials; storage traffic carries raw disk data; live migration traffic carries the full memory contents of running VMs, which can include keys, and is often unencrypted by default. Placing these on networks that tenant VMs cannot reach limits exposure if a tenant workload is compromised and allows each network to have its own access controls, monitoring and bandwidth. Jumbo frames improve throughput for large transfers, but faster transmission does not make sensitive traffic less visible to anyone sharing the network. Quality of service controls the order and share of bandwidth; it prioritizes management packets but does not stop tenants from observing or interfering with them. Encrypting tenant traffic inside guests protects tenant data, yet the most sensitive host-level flows, management and migration, stay on the shared, reachable network. Exam caveat: this is the host-side counterpart of segmentation; on the exam, separating management from tenant networks is the expected answer whenever both share a path. Operational check: confirm that each host has distinct interfaces mapped to separate VLANs or physical networks for management, storage, migration and tenant traffic, and that a tenant VM cannot reach any management or migration address.