How can this be done without consuming more VLANs?

A development team must provide layer 2 network isolation between virtual machines that are in the same VLAN. The solutions architect must provide additional security between the virtual machines on the same subnet.

How can this be done without consuming more VLANs?
A . Use Virtual Switch Tagging
B . Use Private VLANs.
C . Use Virtual Guest Tagging.
D . Use External Switch Tagging.

Answer: B