VCP-DCV Practice Test 30 — 15 Questions

Question 1

During a security audit, it is found that the vCenter Server is using the default self-signed certificate. The administrator is tasked to replace it with a certificate from an enterprise CA. What is the first step after obtaining the CA-signed certificate?

Accepted Answer

Convert the certificate and private key into PEM format and place them in the appropriate directory.. Option A is correct because the certificate must be in a format that vCenter can use; typically, it needs to be combined with the private key. Option B is premature before preparing the certificate. Option C is incorrect because certificate import is done via certificate management tools, not vSphere Web Client. Option D is incorrect because the private key is included in the signed certificate generation process, not imported separately.

Answer

Use the vSphere Web Client to upload the certificate.

Answer

Import the private key into the Windows Certificate Store.

Answer

Restart the VMware Certificate Service.

Question 2

An organization is using vSphere Trust Authority (vTA) to secure ESXi hosts. A newly added ESXi host fails to attest with the Trust Authority. The administrator verifies that the host is connected to the vTA cluster and the trust relationship is configured. What is the most likely cause of the attestation failure?

Accepted Answer

The TPM on the ESXi host is disabled or not properly initialized.. Option D is correct. The host's TPM must be enabled and properly configured for vTA attestation. Option A is incorrect because the host can be in a different cluster as long as it's trusted. Option B is incorrect because vTA uses TPM, not vTPM. Option C is incorrect because the trusted infrastructure hosts do not require special networking beyond connectivity.

Answer

The Trust Authority's network is isolated from the ESXi host's management network.

Answer

The ESXi host is not in the same cluster as the Trust Authority.

Answer

The ESXi host does not have a virtual Trusted Platform Module (vTPM) attached.

Question 3

A vSphere administrator needs to restrict access to a specific cluster so that only the storage team can manage datastores. The storage team members are in a group called 'storage_team' in Active Directory. What is the best practice to achieve this?

Accepted Answer

Create a custom role with required Datastore privileges and assign it to the 'storage_team' group at the cluster level.. Option A is correct because creating a custom role with Datastore privileges and assigning it at the cluster level provides the most granular and least-privileged access. Option B is wrong because global permissions apply to all objects, granting too broad access. Option C is wrong because the Administrator role grants full access, violating the principle of least privilege. Option D is wrong because SSO groups do not define privileges; they must be linked to a role.

Answer

Create an SSO group for the storage team and assign the default 'ReadOnly' role at the cluster level.

Answer

Assign the 'storage_team' group a role with Datastore privileges at the vCenter level using global permissions.

Answer

Add each member of the storage team to the local Administrators group on the vCenter Server.

Question 4

An administrator runs the command shown in the exhibit on a vCenter Server appliance. What is the primary purpose of the Machine ID?

Accepted Answer

To serve as a unique identifier for the vCenter Server instance in SSO. Option D is correct because the Machine ID is a unique identifier for the vCenter Server instance, used for SSO and certificate management. Option A is wrong because the Machine ID is not used for vMotion. Option B is wrong because it is not used for host identification. Option C is wrong because it is not used for DRS.

Answer

To calculate workload distribution in DRS

Answer

To identify an ESXi host to vCenter Server

Answer

To uniquely identify a virtual machine for vMotion

Question 5

An administrator wants to ensure that no user can view or modify VMs in a particular folder except the folder owner. What is the proper method to achieve this?

Accepted Answer

On the folder, assign permissions to the folder owner with the desired role and ensure propagation is set to 'All children'.. Option C is correct by setting a permission for the folder and propagating it to child objects. Option A is incorrect because propagation can be controlled. Option B is incorrect because global roles affect all objects. Option D is incorrect because inheritance can be blocked using No Access permissions.

Answer

Use the No Access permission on the folder for all other users.

Answer

Assign the folder owner with Administrator role on the folder.

Answer

Create a global role that denies access to all VMs except the folder owner.

Question 6

A company uses vSphere with Tanzu to run container workloads. The security team requires that all container traffic between namespaces be encrypted. What is the best approach to achieve this?

Accepted Answer

Deploy NSX-T and enable the Network Encryption feature for East-West traffic.. Option A is correct. NSX-T provides micro-segmentation and encryption for container traffic. Option B is incorrect because vSAN encryption protects data at rest, not in transit. Option C is incorrect because the NSX Container Plugin has been deprecated in favor of NSX-T. Option D is incorrect because Calico is not native and does not offer the same integration with vSphere with Tanzu.

Answer

Use the NSX Container Plugin with IPsec to encrypt traffic.

Answer

Enable vSAN encryption to encrypt data at rest and assume it covers in-transit traffic.

Answer

Install a third-party CNI like Calico with IPsec enabled.

Question 7

A vCenter Server's SSL certificate has expired, causing all ESXi hosts to display a certificate warning and some management tasks to fail. The administrator needs to restore secure communication with minimal disruption. Which action should the administrator take?

Accepted Answer

Replace the vCenter Server certificate and then reconnect each ESXi host to vCenter.. Option B is correct because replacing the vCenter Server certificate and then reconnecting each ESXi host is the standard procedure to restore trust. Option A is wrong because replacing certificates on each host individually is inefficient and does not address the vCenter certificate. Option C is wrong because rebooting vCenter does not replace the expired certificate. Option D is wrong because even if Auto Deploy is used, the vCenter certificate still needs to be replaced.

Answer

Reboot the vCenter Server appliance to regenerate the certificate automatically.

Answer

Replace the SSL certificate on each ESXi host individually using the vSphere Web Client.

Answer

Use vSphere Auto Deploy to push new certificates to all hosts simultaneously.

Question 8

An administrator notices that HTTP connections to the ESXi host are timing out frequently. Based on the exhibit, which configuration change would most likely resolve the issue?

Accepted Answer

Increase maxKeepAliveTimeout to a higher value, such as 180. Option B is correct because the maxKeepAliveTimeout is set to 100 seconds, which is the default but may be too low for environments with long-running connections; increasing it can reduce timeouts. Option A is wrong because enabling a proxy is not needed. Option C is wrong because the keepalive is already enabled by default and disabling it would worsen the issue. Option D is wrong because restarting rhttpproxy without changing the timeout would not help.

Answer

Restart the rhttpproxy service

Answer

Set useProxy to true and specify a proxy server

Answer

Set maxKeepAliveTimeout to 0 to disable keepalive

Question 9

A company uses an external Platform Services Controller (PSC) in a vSphere 6.7 environment. They plan to upgrade to vSphere 7.0. Which security-related consideration is most important?

Accepted Answer

The external PSC is deprecated; it must be converged into the vCenter Server.. Option B is correct because vSphere 7.0 removes the external PSC model; all services are embedded. Option A is incorrect because there is no migration wizard for external PSC to embedded, but does not default to AD. Option C is incorrect because vSphere 7.0 still uses VECS. Option D is incorrect because STS certificates can be managed within the embedded PSC.

Answer

The external PSC will automatically convert to an embedded PSC during upgrade.

Answer

The SSL certificates for the PSC must be reissued from a new CA.

Answer

The STS certificates need to be replaced with custom ones immediately after upgrade.

Question 10

An administrator needs to lock down an ESXi host for FIPS 140-2 compliance. Which step must be taken?

Accepted Answer

Enable lockdown mode on the ESXi host.. Option C is correct. The ESXi host must be placed in lockdown mode to restrict direct access. Option A is incorrect because SSH can still be used even if the shell is disabled; lockdown mode disables both. Option B is incorrect because host profiles help configure but do not enforce lockdown. Option D is incorrect because FIPS mode is a separate configuration.

Answer

Disable the ESXi Shell and SSH services.

Answer

Configure a host profile with a security policy.

Answer

Enable FIPS mode in the host's BIOS.

Question 11

An administrator is configuring vSphere Trust Authority (vTA) to secure ESXi hosts in a sensitive environment. Which TWO components are required for a vTA deployment? (Choose two.)

Accepted Answer

Attestation Service. Options B and C are correct. vTA requires an Attestation Service to verify host trust, and a Key Provider to manage keys. Option A is incorrect because Trusted Host Cluster is not a component but a concept. Option D is incorrect because KMS is for VM encryption, not vTA. Option E is incorrect because a Certificate Authority is not a required component of vTA.

Answer

Trusted Host Cluster

Answer

Certificate Authority (CA)

Answer

Key Management Server (KMS)

Question 12

An administrator configures permissions as shown in the exhibit. Users 'user1' and 'user2' are in the 'Limited' role which only allows 'Read' and 'Console interaction' privileges. User1 reports being unable to open a console to a VM running on host2.domain.com. What is the most likely cause?

Accepted Answer

User1 does not have permissions on host2.domain.com. Option A is correct because user1 has permissions only on host1, not on host2. The 'Limited' role on host1 does not propagate to host2. Option B is wrong because the 'Limited' role does allow console interaction. Option C is wrong because permissions are applied at the host level for the respective hosts. Option D is wrong because admin group membership is not mentioned.

Answer

The 'Limited' role does not include 'Console interaction' privilege

Answer

The permissions are applied at the datacenter level, not the host level

Answer

User1 should be added to the admin group

Question 13

Which TWO of the following are best practices for securing ESXi hosts? (Choose two.)

Accepted Answer

Enable lockdown mode on the host.. Options A and B are correct. Option A: Lockdown mode restricts direct root access. Option B: Active Directory integration allows centralized user management. Option C is incorrect because DCUI should be restricted, not allowed from the network; DCUI is for local console. Option D is incorrect because keeping the firewall enabled is a security best practice. Option E is incorrect because using root directly is not recommended (use delegated admins).

Answer

Grant the root user direct permissions on all hosts.

Answer

Disable the ESXi firewall to simplify management.

Answer

Allow DCUI access from trusted management networks.

Question 14

During a vulnerability scan, an ESXi host is found to have the SSLv3 protocol enabled. The administrator wants to disable SSLv3 and enforce TLS 1.2 for all network services on the host. Which approach is most effective?

Accepted Answer

Set the advanced system option 'SSLv3.Enabled' to false and 'TLSv1.2.Enabled' to true.. Option D is correct. The ESXi host's SSL/TLS configuration can be controlled via the Host Advanced Settings by setting the appropriate option to require TLS 1.2. Option A is incorrect because disabling services does not change the protocol. Option B is incorrect because the vCenter's TLS configuration does not directly affect the host's. Option C is incorrect because there is no direct setting in the DCUI for this.

Answer

Update the TLS configuration in vCenter Server and reboot the host.

Answer

Change the host's security settings in the DCUI to require TLS 1.2.

Answer

Disable all unnecessary services on the host via the DCUI.

Question 15

A company is implementing vSphere with Tanzu for containerized workloads. To secure the workload management plane, which THREE security features should be configured? (Choose three.)

Accepted Answer

Pod Security Policies. Options A, B, and C are correct. Pod Security Policies enforce security standards for pods. vSphere Native Key Provider enables encryption for Kubernetes objects. Network Policies control traffic between pods. Option D is incorrect because vCenter SSO is already in place for authentication, not a new feature. Option E is incorrect because Content Library is for content management, not security.

Answer

vCenter Single Sign-On

Answer

Content Library