CompTIA Server+ SK0-005 Practice Question
An ESXi host that uses only a standard vSwitch is hosting two production VMs that appear to be exchanging suspicious traffic. A security administrator deploys a new virtual appliance named Sniffer-VM and installs Wireshark on it. The goal is to capture every Ethernet frame that traverses the virtual switch-even frames that are not addressed to Sniffer-VM's own MAC address-so the packets can be analyzed for signs of lateral movement. No physical taps, distributed switches or additional agents are available.
Which single vSwitch or port-group setting must the administrator change to make this packet capture possible?
Enable jumbo frames (MTU 9000) on the vSwitch and on Sniffer-VM.
Move Sniffer-VM's vNIC to a VMkernel port that is configured for iSCSI storage traffic.
Set the port group that contains Sniffer-VM to Accept promiscuous mode and attach the appliance's vNIC to that group.
Configure LACP on the physical uplinks and make Sniffer-VM's vNIC an active link.