VCP-DCV Practice Test 29 — 15 Questions

Question 1

A vSphere environment uses VMCA for certificate management. An administrator needs to replace the certificate for vCenter Server with a custom CA-signed certificate. The custom CA root certificate must be trusted by all ESXi hosts. Which method should the administrator use to distribute the custom CA root certificate to ESXi hosts?

Accepted Answer

Create a host profile containing the custom CA root certificate and apply it to the ESXi hosts. Option C is correct because using a host profile to apply the certificate ensures consistency and is policy-driven. Option A is wrong because manually copying to each host is not scalable. Option B is wrong because vCenter does not automatically push root CAs to hosts; it only replaces the machine SSL certificate. Option D is wrong because the rhttpproxy service is for proxying, not for certificate distribution.

Answer

Restart the rhttpproxy service on each ESXi host with a new configuration

Answer

Import the root CA certificate into vCenter Server and it will automatically push to hosts

Answer

Manually upload the root CA certificate to each ESXi host via SCP

Question 2

An administrator has created a custom role named 'VM Power User' with permissions to power on and off virtual machines. The role is assigned to a group of users at the datacenter level. A user from that group reports they cannot power on a VM in a particular cluster. What is the most likely reason?

Accepted Answer

The cluster has a permission that blocks inheritance from the datacenter. Option B is correct because permissions are not inherited by default if a child object has explicit permissions set that block propagation. Option A is wrong because the group is assigned the role; individual membership suffices. Option C is wrong because the role does not require resource assignment. Option D is wrong because the user is part of the group; no separate assignment needed.

Answer

The user must be assigned the role individually at the VM level

Answer

The role is not assigned to a resource pool containing the VM

Answer

The user is not a member of the group assigned to the role

Question 3

An administrator is configuring vSphere Native Key Provider (NKP) in a cluster. After enabling NKP, the administrator adds a VM and attempts to encrypt it, but receives an error that the key provider is not available. The cluster consists of three ESXi hosts. What is the most likely cause?

Accepted Answer

Only one ESXi host in the cluster is available; the other two are offline. Option A is correct because NKP requires a majority of hosts (at least 2) to be active and reachable to form a quorum. If one host is offline, the key provider may be unavailable if the remaining hosts cannot achieve quorum. Option B is wrong because NKP works with any storage type. Option C is wrong because vCenter Server availability is not required for NKP after initial setup. Option D is wrong because the network is separate from key provider availability.

Answer

The VM is stored on NFS storage which is not supported with NKP

Answer

The vCenter Server is disconnected from the cluster

Answer

The ESXi hosts are on different network segments

Question 4

Which TWO actions are required to enable vSphere VM encryption? (Choose two.)

Accepted Answer

Configure a Key Management Server (KMS) or native key provider. Options B and D are correct. A key provider (KMS) must be configured and associated with the vCenter Server, and then encryption must be enabled on the VM (via storage policy or directly). Option A is wrong because encryption does not require disabling vMotion. Option C is wrong because SSH access is not required. Option E is wrong because host lockdown mode is unrelated.

Answer

Enable SSH on each ESXi host to manage encryption keys

Answer

Disable vMotion on the cluster

Answer

Place the ESXi hosts in lockdown mode

Question 5

An administrator needs to grant a group of vSphere administrators the ability to create and delete snapshots, and also to power on and off VMs, but not to delete VMs. The administrators should also be able to view the virtual machine console. Which custom role should be created?

Accepted Answer

Snapshot creation/removal, Power operations, VirtualMachine.Interact.ConsoleInteraction. Option A is correct because the combination of privileges for snapshot operations, power operations, and console access is exactly what is needed. Option B includes Delete VM permission, which is not desired. Option C includes Remove Disk which is not requested. Option D is too restrictive and does not include snapshot management.

Answer

Snapshot creation/removal, Power operations, Delete VM, ConsoleInteraction

Answer

Power operations, ConsoleInteraction only

Answer

Snapshot creation/removal, Power operations, Remove Disk, ConsoleInteraction

Question 6

An administrator wants to configure the ESXi host firewall to allow connections only from a specific management subnet. How can this be achieved?

Accepted Answer

Use the ESXi firewall settings to define allowed IP addresses for the required services.. Option B is correct because the ESXi firewall can be configured with rule sets that allow traffic only from specific IP addresses or subnets. Option A is incorrect because disabling all firewall rules would be too permissive. Option C is incorrect because the DCUI is for direct console access, not firewall rules. Option D is incorrect because vSphere HA is not related to firewall configuration.

Answer

Enable vSphere HA and set it to control management traffic.

Answer

Configure the DCUI to restrict management access.

Answer

Set the firewall to enabled and allow all incoming connections.

Question 7

A security administrator notices that a virtual machine (VM) running a legacy application is experiencing network connectivity issues after enabling Network I/O Control (NIOC) on the distributed switch. The VM is in a high-priority traffic class for management traffic. What is the most likely cause of the issue?

Accepted Answer

The VM is assigned to the management traffic class, but its traffic should be in a different class, causing bandwidth throttling.. Option B is correct. NIOC traffic classes limit bandwidth per class; if the VM is in the wrong class (management instead of the correct class for its traffic), it may be throttled. Option A is incorrect because NIOC does not require jumbo frames. Option C is incorrect because NIOC does not affect MAC learning. Option D is incorrect because NIOC does not block promiscuous mode; that's a security policy.

Answer

NIOC is blocking the VM's MAC address due to a security policy.

Answer

The VM is using jumbo frames, which are not supported with NIOC.

Answer

The virtual switch has promiscuous mode enabled, which conflicts with NIOC.

Question 8

During a security audit, it is discovered that a vCenter Server instance is using the default self-signed certificate. The company policy requires all certificates to be signed by an internal enterprise CA. An administrator has imported the CA chain into the VMware Endpoint Certificate Store (VECS) and generated a Certificate Signing Request (CSR). After receiving the signed certificate from the CA, which additional step is required to complete the certificate replacement?

Accepted Answer

Import the signed certificate into the appropriate VECS store and run the certificate-manager utility to update the services.. Option D is correct. After importing the signed certificate into VECS, the administrator must update vCenter services to use the new certificate. Option A is incorrect because restarting the Management Agent is not the proper step. Option B is incorrect because certool is used for creating self-signed certificates, not for importing signed ones. Option C is incorrect because it reverses the process.

Answer

Replace the default certificate in the VECS store with the CA-signed certificate and then generate a new CSR.

Answer

Restart the vCenter Management Agent (vma) service.

Answer

Run the certificate manager tool (certool) to generate a new self-signed certificate.

Question 9

Which THREE of the following are required components for setting up a vSphere Trust Authority (vTA) cluster?

Accepted Answer

A dedicated Trust Authority cluster with at least one host.. Options A, C, and D are correct. vTA requires at least one trusted ESXi host, a Trust Authority cluster, and an attestation service. Option B is incorrect because a Key Provider is part of vSphere Trusted Infrastructure (vTPM) but not vTA. Option E is incorrect because NSX is not required for vTA.

Answer

A Key Provider, such as VMware Key Provider or an external KMS.

Answer

NSX-T Data Center deployed for network segmentation.

Question 10

Which TWO of the following are best practices for securing a vSphere environment against ransomware attacks?

Accepted Answer

Implement a backup solution with immutable snapshots and offsite storage.. Options A and C are correct. Enabling vSAN encryption protects data at rest; using backup software with immutable backups prevents deletion. Option B is incorrect because egress filtering is not default. Option D is incorrect because snapshots are not backups and can be deleted. Option E is incorrect because vMotion is for migration, not security.

Answer

Enable vMotion encryption for all migrations.

Answer

Use VM snapshots as primary backup method.

Answer

Configure the distributed firewall to allow all outbound traffic by default.

Question 11

Which THREE security hardening measures should be applied to an ESXi host? (Choose three.)

Accepted Answer

Enable lockdown mode. Options A, B, and D are correct. Enabling lockdown mode restricts direct access, disabling shell/SSH reduces attack surface, and a host profile ensures consistent security settings. Option C is wrong because SNMP is a management protocol that does not primarily provide security. Option E is wrong because increasing memory workload does not improve security.

Answer

Increase memory resource allocation for management VMs

Answer

Enable SNMP v3

Question 12

A vSphere environment uses vSAN and has VM encryption enabled. The administrator needs to recover a VM after an encrypted disk becomes corrupted. What is required?

Accepted Answer

The key management server (KMS) and the KEK/Rekey.. Option D is correct because for encrypted VMs, the key server (KMIP) and the associated encryption keys are essential for decryption. Option A is incorrect because the encryption policies are stored in vCenter, but the actual keys are external. Option B is incorrect because vSAN has repair mechanics but cannot decrypt without keys. Option C is incorrect because file-based backup does not guarantee recoverability without keys.

Answer

The vSAN health service.

Answer

A recent backup of the VM files.

Answer

The VM’s storage policy.

Question 13

A vSphere administrator wants to prevent users in a custom role from powering off virtual machines that have Fault Tolerance enabled. Which privilege must be removed from the custom role?

Accepted Answer

VirtualMachine.Interrupt.PowerOff. Option A is correct. The 'Power Off' privilege directly controls the ability to power off a VM. Option B is incorrect because 'Power On' is a separate action. Option C is incorrect; 'Reset' also powers off but is not the primary control. Option D is incorrect because 'Suspend' is not powering off.

Answer

VirtualMachine.State.Suspend

Answer

VirtualMachine.Interrupt.Reset

Answer

VirtualMachine.Interrupt.PowerOn

Question 14

A company runs a critical e-commerce platform on a vSphere 7 cluster with ESXi hosts connected to a vSAN datastore. The environment uses vSphere Trust Authority (vTA) and VM encryption with an external KMS. Recently, after a successful vTA attestation, one of the VMs (WebServer-01) failed to power on with the error: 'Unable to decrypt the encrypted virtual machine upon re-registration. Reason: The KMS server is unreachable.' The administrator verifies that other encrypted VMs on the same host power on successfully. The KMS cluster consists of two servers: KMS-01 and KMS-02, both accessible from the management network. The administrator checks the VM's configuration and finds that it uses a custom storage policy with encryption. What is the most likely cause of this specific VM's failure?

Accepted Answer

The VM's encryption key was retrieved from a different KMS server that is now unavailable, and the key ID in the VM's metadata points to that KMS server.. Option B is correct. The VM's encryption key is cached on the host only if it was previously powered on; if the host was rebooted or the cache cleared, it must fetch the key from KMS. The error indicates the KMS is unreachable for this VM, but other VMs work, suggesting the host can reach KMS. However, if the VM's encryption key is associated with an older KMS key ID that is no longer present or the KMS server specified in the VM's configuration is different (e.g., from a previous KMS setup), the host may try to contact a different KMS server. Option A is incorrect because vTA attestation is separate. Option C is incorrect because the storage policy is in use. Option D is incorrect because vCenter SSO is not involved in decryption.

Answer

The vCenter Server's KMS cluster configuration has been deleted, affecting all VMs but not this one.

Answer

The storage policy used by the VM has been modified and no longer includes encryption.

Answer

The vTA attestation process failed for the VM's host, but the error message is misleading.

Question 15

Which TWO statements about vCenter Single Sign-On (SSO) are true? (Choose two.)

Accepted Answer

It supports multiple identity sources such as Active Directory and LDAP. Options B and D are correct. SSO supports multiple identity sources (e.g., AD, LDAP) and uses SAML tokens for authentication. Option A is wrong because passwords are stored hashed, not in plaintext. Option C is wrong because SSO can work without a Windows Active Directory. Option E is wrong because SSO uses SAML, not Kerberos, for token exchange.

Answer

It uses Kerberos to authenticate users to vCenter Server

Answer

It stores user passwords in plaintext for faster authentication

Answer

It requires a Windows Active Directory domain to function