VCP-DCV vSphere Security — 25 Questions

Question 1

Which TWO actions are required to enable encrypted vSphere vMotion for all virtual machines in a cluster?

Accepted Answer

Set the vMotion encryption policy to 'Encrypt all data' in the cluster settings.. Setting the vMotion encryption policy to 'Encrypt all data' enforces encryption for all vMotion migrations in the cluster, using TLS 1.2 and host-based certificates. Option D is incorrect because Active Directory domain membership is not required; vMotion encryption works with the default host certificates as long as the hosts trust each other's certificates, which is achieved by default in a cluster. A KMS (Option B) is not needed for vMotion encryption, only for VM-level encryption. Storage DRS (Option C) is unrelated. Option E, 'Encrypt when supported', does not enforce encryption for all VMs; it only encrypts when both source and target hosts support it, which may not apply to all migrations.

Answer

Configure a Key Management Server (KMS) for the cluster.

Answer

Enable Storage DRS on the cluster.

Answer

Ensure all ESXi hosts in the cluster are joined to the same Active Directory domain.

Answer

Set the vMotion encryption policy to 'Encrypt when supported' in the cluster settings.

Question 2

An organization is implementing vSphere Trust Authority for sensitive workloads. The administrator must configure the trusted ESXi hosts to attest to vCenter Server. Which component is responsible for performing attestation?

Accepted Answer

A separate vCenter Server instance acting as the Trust Authority. VSphere Trust Authority uses a dedicated vCenter Server instance (Trust Authority vCenter) to perform attestation of ESXi hosts. Option A is incorrect because the administrator's workstation is not part of the trust chain and does not perform attestation. Option C is incorrect because the Key Provider (KMS) server is used for encryption key management, not for host attestation. Option D is incorrect because the trusted ESXi hosts themselves are the subjects of attestation; they do not perform attestation.

Answer

The administrator's workstation

Answer

The Key Provider (KMS) server

Answer

The trusted ESXi hosts themselves

Question 3

An organization is using vSphere Trust Authority (vTA) to secure ESXi hosts. A newly added ESXi host fails to attest with the Trust Authority. The administrator verifies that the host is connected to the vTA cluster and the trust relationship is configured. What is the most likely cause of the attestation failure?

Accepted Answer

The TPM on the ESXi host is disabled or not properly initialized.. VTA attestation requires the ESXi host's TPM to be enabled and properly initialized. Option A is incorrect because the administrator verified that the host is connected to the vTA cluster, so network isolation is unlikely. Option B is incorrect because the ESXi host does not need to be in the same cluster as the Trust Authority; trust is configured separately. Option C is incorrect because vTA relies on the host's physical TPM, not a virtual TPM (vTPM).

Answer

The Trust Authority's network is isolated from the ESXi host's management network.

Answer

The ESXi host is not in the same cluster as the Trust Authority.

Answer

The ESXi host does not have a virtual Trusted Platform Module (vTPM) attached.

Question 4

An organization wants to secure management traffic between vCenter Server and ESXi hosts. The security policy mandates disabling all versions of TLS below 1.2. After the administrator configures vCenter to use only TLS 1.2, several ESXi hosts (all version 6.0) lose connectivity to vCenter. The hosts remain operational but show as disconnected in the vSphere Web Client. The administrator needs to restore management while maintaining the security requirement. Which action should the administrator take?

Accepted Answer

Upgrade the legacy ESXi hosts to version 6.5 or later.. ESXi 6.0 only supports TLS 1.0; to use TLS 1.2, hosts must be upgraded to ESXi 6.5 or later. Option B is wrong because disabling certificate verification does not address the TLS version issue and weakens security. Option C is wrong because SSH is not used for vCenter-to-ESXi management communication. Option D is wrong because re-enabling TLS 1.0 would violate the security policy.

Answer

Disable certificate verification on the vCenter Server.

Answer

Use SSH to connect vCenter to the ESXi hosts for management.

Answer

Re-enable TLS 1.0 on the vCenter Server as a temporary workaround.

Question 5

An administrator is troubleshooting a situation where a virtual machine cannot be powered on. The error message indicates insufficient permissions. The VM is in a folder named 'Production' and the administrator has been assigned a custom role with 'Virtual machine > Power On' permission at the folder level. However, the VM is also in a resource pool. What additional permission is most likely missing?

Accepted Answer

Resource > Assign virtual machine to resource pool permission on the resource pool. To power on a virtual machine that resides in a resource pool, the user must have the 'Resource > Assign virtual machine to resource pool' permission on that resource pool. Even though the user has 'Virtual machine > Power On' at the folder level, the VM's association with the resource pool introduces an additional authorization check. Without this resource pool permission, the power-on operation fails with an insufficient permissions error.

Answer

Network > Assign network permission on the network

Answer

Datastore > Allocate space permission on the datastore

Answer

Virtual machine > Configuration permission on the VM

Question 6

A security audit reveals that an ESXi host has been compromised due to an attacker gaining root access via the DCUI. The host is configured with a default DCUI password. Which security best practice should have been implemented to prevent this?

Accepted Answer

Configure the DCUI lockdown mode to 'Normal'. DCUI Lockdown Mode 'Normal' disables direct root access via the Direct Console User Interface (DCUI) by requiring authentication through vCenter Single Sign-On (SSO). This prevents an attacker from using the default or weak DCUI password to gain root access, as the root account is no longer accepted for DCUI login. The mode still allows authorized vCenter administrators to access the host via the DCUI using their SSO credentials, maintaining manageability while eliminating the root password attack vector.

Answer

Disable the DCUI service

Answer

Set a strong password for the root account

Answer

Disable SSH access

Question 7

A vSphere administrator needs to ensure that all HTTPS traffic to ESXi hosts is encrypted using TLS 1.2. Where should the administrator configure the minimum TLS version?

Accepted Answer

Host Advanced Settings (Config.HostAgent.plugins.vimsvc.auth.minTLSVersion). The minimum TLS version for ESXi host HTTPS traffic is configured via the host advanced setting `Config.HostAgent.plugins.vimsvc.auth.minTLSVersion`. This setting directly controls the TLS protocol version used by the ESXi host's HTTP services, including the vSphere Client and API endpoints, ensuring only TLS 1.2 or higher is accepted.

Answer

Security Profile in the vSphere Client

Answer

vCenter Server Appliance (VAMI) web interface

Answer

ESXi Firewall rules

Question 8

An administrator is configuring a distributed switch and needs to ensure that all virtual machine traffic on a specific VLAN is isolated. The administrator creates a port group with VLAN ID 100. However, a security scanner reports that packets from this VLAN are appearing on other VLANs. Which security policy setting on the distributed switch should the administrator verify?

Accepted Answer

VLAN trunking. The VLAN trunking policy on a distributed switch controls whether a port group can pass multiple VLAN IDs (trunk mode) or is restricted to a single VLAN (access mode). When VLAN trunking is enabled, the port group may forward traffic from VLAN 100 onto other VLANs if the virtual switch is configured to allow it, breaking isolation. The administrator should verify that VLAN trunking is disabled (set to 'Reject') to ensure strict VLAN isolation.

Answer

MAC address changes

Answer

Forged transmits

Answer

Promiscuous mode

Question 9

A vSphere environment uses Active Directory for authentication. The administrator notices that users from a specific AD group cannot log in to the vCenter Server, although other AD users can. The group is added to vCenter Server with the correct permissions. What is the most likely cause?

Accepted Answer

The domain of the group is not configured as an identity source in vCenter Single Sign-On. The most likely cause is that the domain of the group is not configured as an identity source in vCenter Single Sign-On. Even if the group is added with correct permissions in vCenter Server, vCenter SSO must be able to authenticate users against the domain. Without the domain listed as an identity source, vCenter cannot validate the credentials of users from that group, causing authentication failures for all users in that domain.

Answer

The users are not members of the vCenter Single Sign-On domain

Answer

The user accounts have expired passwords

Answer

The group is nested within another group

Question 10

Which TWO actions are recommended to secure the vCenter Server Appliance (VCSA)?

Accepted Answer

Change the default 'root' password. Changing the default 'root' password is a fundamental security best practice for the VCSA. The default password is well-known and documented, leaving the appliance vulnerable to unauthorized access if not changed immediately after deployment. This action directly mitigates the risk of brute-force or credential-based attacks against the root account.

Answer

Enable the auto-lock feature for the admin account

Answer

Configure the password policy for local accounts

Answer

Enable FIPS 140-2 compliance mode

Question 11

Which THREE security features are available in vSphere Trust Authority (vTA)?

Accepted Answer

Attestation of ESXi hosts. VSphere Trust Authority (vTA) uses attestation to verify the integrity of ESXi hosts before allowing them to interact with trusted infrastructure. This attestation process confirms that the host is running genuine, untampered VMware code, which is a core security feature of vTA.

Answer

Integration with Active Directory for authentication

Answer

Encryption of vMotion traffic

Question 12

A multinational corporation runs a vSphere environment with 100 ESXi hosts managed by a single vCenter Server. The security team mandates that all virtual machine disks (VMDKs) must be encrypted at rest. The administrator enables vSphere Virtual Machine Encryption and creates a Key Management Server (KMS) cluster. After encrypting a test VM, the VM powers on successfully, but the administrator notices that the VM's configuration files (VMX, NVRAM) are not encrypted. The security policy requires that all VM files, including configuration files, be encrypted. The administrator checks the VM storage policy and sees that the policy is set to 'VM Encryption Policy' with 'Disk Encryption' enabled. What should the administrator do to ensure the entire VM is encrypted?

Accepted Answer

Modify the VM storage policy to include encryption of VM home files. The VM storage policy 'VM Encryption Policy' with only 'Disk Encryption' enabled encrypts VMDK files but not the VM configuration files (VMX, NVRAM, logs, etc.). To encrypt all VM files, the storage policy must include the 'Encrypt VM home files' option, which applies encryption to the entire VM home directory on the datastore. This ensures compliance with the security mandate for full VM encryption at rest.

Answer

Enable encryption on the datastore where the VM resides

Answer

Add a second KMS cluster for redundancy

Answer

Enable vSphere Host Encryption on each ESXi host

Question 13

A vSphere administrator needs to ensure that all virtual machine disks are encrypted at rest. The environment uses a KMS cluster with multiple KMIP-compliant servers. The administrator has already configured a storage policy with encryption enabled. However, newly created VMs on a particular datastore still show unencrypted disks. What is the most likely cause?

Accepted Answer

The storage policy with encryption is not assigned to the VMs or their home namespace.. Even when a storage policy with encryption is configured, it must be explicitly assigned to the VMs or their home namespace (the VM's configuration and swap files). If the policy is not assigned, the VM will be created using the default datastore policy, which typically does not include encryption, resulting in unencrypted disks. The administrator must ensure the encryption-enabled policy is applied to the VM during creation or via a storage policy-based management (SPBM) assignment.

Answer

The datastore is a vSAN datastore, which does not support VM-level encryption.

Answer

The KMS cluster must have at least two KMS servers to function correctly.

Answer

The datastore is formatted with VMFS6, which does not support encryption.

Question 14

A security audit reveals that a vCenter Server has weak TLS configuration. The administrator needs to enforce strong ciphers and disable SSLv3. Which two steps should the administrator take? (Choose two.)

Accepted Answer

Edit the registry on the vCenter Server to disable SSLv3.. To enforce strong ciphers and disable SSLv3 on a vCenter Server, the administrator should modify the Tomcat server.xml file to restrict allowed protocols and ciphers (Option E). Additionally, if the vCenter Server is running on Windows, editing the registry to disable SSLv3 is also required (Option B). Option A is incorrect because the Certificate Manager replaces certificates but does not configure cipher suites. Option C is wrong because disabling TLS 1.2 and enabling only TLS 1.3 may break compatibility and is not the standard method. Option D is incorrect as there is no such setting in the vSphere Web Client under Administration > Security.

Answer

Use the vSphere Certificate Manager utility to replace the machine SSL certificate with a new one that uses strong ciphers.

Answer

Disable TLS 1.2 and enable only TLS 1.3 on all ESXi hosts.

Answer

Configure the TLS settings in the vSphere Web Client under Administration > Security.

Question 15

An administrator is troubleshooting a failed attempt to add an ESXi host to a vCenter Server domain. The error message states: 'The host's certificate has been tampered with or is invalid.' What is the most likely cause?

Accepted Answer

The ESXi host's certificate thumbprint does not match the thumbprint stored in vCenter Server.. The error 'The host's certificate has been tampered with or is invalid' occurs when the ESXi host presents a certificate whose thumbprint does not match the thumbprint that vCenter Server has stored for that host. This mismatch can happen if the host's certificate was replaced (e.g., due to a reinstall or manual rotation) without updating the vCenter Server's trusted store. vCenter Server verifies the host's identity by comparing the SHA-1 or SHA-256 thumbprint of the presented certificate against its stored record; a mismatch triggers this specific error.

Answer

The vCenter Server's account lockout policy has been triggered.

Answer

The ESXi host's SSH keys have been rotated.

Answer

The ESXi host's certificate has expired.

Question 16

A company has a vSphere environment with 20 ESXi hosts and 500 VMs. The security team mandates that all administrative access to vCenter Server must be through a single, highly restricted account with multi-factor authentication (MFA). The account must be used for both the vSphere Client and API integrations. Which step should the administrator take?

Accepted Answer

Integrate vCenter Server with an external identity provider (e.g., ADFS, Okta) that supports MFA, and use a service account with MFA for API access.. Integrating vCenter Server with an external identity provider (IdP) such as ADFS or Okta allows the use of a single service account that supports multi-factor authentication (MFA) for both the vSphere Client and API integrations. This approach meets the security mandate by centralizing authentication through an IdP that enforces MFA, while also supporting OAuth 2.0 token-based API access, which is required for modern vSphere API integrations. The built-in administrator account cannot be directly configured with MFA in a way that satisfies both interactive and API access requirements without external integration.

Answer

Configure the built-in administrator account to require smart card authentication.

Answer

Create a new local account and configure it as a member of the Administrators group, then enforce MFA via a third-party tool on the vCenter Server OS.

Answer

Disable the built-in administrator account and create a new local account with the same privileges.

Question 17

A large financial institution runs a vSphere 7.0 environment with 100 ESXi hosts and 2,000 VMs. The security team has identified that several VMs are vulnerable to a critical side-channel attack that requires disabling hyperthreading on the ESXi hosts. The administrator needs to implement a solution that minimizes performance impact while ensuring compliance. The environment uses DRS clusters with varying workloads: some VMs are CPU-intensive (financial modeling) and others are memory-bound (database servers). The administrator cannot afford to take hosts offline for maintenance during business hours. The change must be implemented within 48 hours. Which course of action should the administrator take?

Accepted Answer

Place each host in maintenance mode individually, disable hyperthreading in the host BIOS, reboot the host, and then move to the next host. Rebalance VMs after all hosts are updated.. Disabling hyperthreading to mitigate side-channel attacks (e.g., L1TF or MDS) requires a host BIOS change, which necessitates a reboot. The only supported method in vSphere 7.0 is to place each host into maintenance mode, change the BIOS setting, reboot, and then repeat for all hosts. This approach minimizes performance impact by allowing VMs to be migrated via vMotion and avoids simultaneous downtime, meeting the 48-hour requirement without taking all hosts offline during business hours.

Answer

Use a vSphere DRS rule to disable hyperthreading for all VMs in the cluster, avoiding the need to modify host BIOS.

Answer

Delay the change and schedule a maintenance window for the next month when business impact is lower.

Answer

Disable hyperthreading on all hosts simultaneously using a vSphere Cluster feature, then reboot all hosts at once during off-peak hours.

Question 18

A company is implementing vSphere 7.0 and wants to encrypt all vMotion traffic between ESXi hosts in a cluster. The cluster is not using any other encryption features. What is the minimum requirement to enable vMotion encryption?

Accepted Answer

The ESXi hosts must have a host profile applied with encryption enabled.. In vSphere 7.0, enabling vMotion encryption does not require Active Directory, a Key Management Server, Enhanced vMotion Compatibility (EVC), or host profiles. The minimum requirement is simply to configure the vMotion encryption policy on each ESXi host (set to 'Required' or 'Opportunistic'). No additional infrastructure or profiles are needed.

Answer

A VM Encryption Key Management Server must be configured.

Answer

The ESXi hosts must be joined to an Active Directory domain.

Answer

The cluster must be configured with Enhanced vMotion Compatibility (EVC).

Question 19

Refer to the exhibit. An administrator runs the vmkfstools command on an ESXi host and views the output. Which conclusion can be drawn from the output?

Accepted Answer

The datastore has approximately 50% free space.. The vmkfstools command output shows the capacity and free space values for the datastore. In this case, the free space is approximately half of the total capacity, indicating roughly 50% free space. This is a direct calculation from the displayed numbers, not an inference about provisioning or encryption.

Answer

The VMDK file is thin provisioned.

Answer

The datastore has a block size of 1 MB, which is the maximum for VMFS-6.

Answer

The virtual machine's disk is encrypted.

Question 20

Order the steps to take a snapshot of a virtual machine.

Accepted Answer

Initiate snapshot, name it, choose memory and quiesce options, then confirm.. The correct order for taking a snapshot in VMware vSphere is to first initiate the snapshot by right-clicking the VM and selecting 'Snapshot > Take Snapshot', then in the dialog provide a name and optional description, select whether to snapshot the virtual machine's memory and whether to quiesce the file system, and finally confirm by clicking OK. This sequence ensures that all necessary parameters are set before the snapshot is created.

Answer

Initiate snapshot, choose memory and quiesce options, name it, then confirm.

Answer

Name the snapshot, initiate snapshot, choose memory and quiesce options, then confirm.

Answer

Initiate snapshot, confirm, then name it and choose memory and quiesce options.