VCP-DCV vSphere Security Practice Test 2 — 15 Questions

Question 1

Refer to the exhibit. An administrator runs the vmkfstools command on an ESXi host and views the output. Which conclusion can be drawn from the output?

Accepted Answer

The datastore has approximately 50% free space.. The vmkfstools command output shows the capacity and free space values for the datastore. In this case, the free space is approximately half of the total capacity, indicating roughly 50% free space. This is a direct calculation from the displayed numbers, not an inference about provisioning or encryption.

Answer

The VMDK file is thin provisioned.

Answer

The datastore has a block size of 1 MB, which is the maximum for VMFS-6.

Answer

The virtual machine's disk is encrypted.

Question 2

Order the steps to take a snapshot of a virtual machine.

Question 3

Match each vSphere networking component to its description.

Question 4

A company wants to integrate vCenter Server with an external identity source to allow users to authenticate using their corporate credentials. The administrator must ensure that authentication traffic is encrypted. Which solution should the administrator implement?

Accepted Answer

Active Directory over LDAPS. Option B is correct because Active Directory over LDAPS encrypts authentication traffic with SSL/TLS. Option A is wrong because standard LDAP transmits credentials in plaintext. Option C is wrong because NTLM authentication is not supported as a direct identity source for vCenter Single Sign-On. Option D is wrong because local OS authentication does not use corporate credentials.

Answer

Local OS authentication on vCenter Server

Answer

Active Directory over NTLM

Answer

Active Directory over LDAP

Question 5

An administrator is troubleshooting a failed VM encryption operation. The key provider status shows as 'Not Responding' in the vSphere Web Client. The administrator has verified network connectivity between the ESXi hosts and the key provider. What is the most likely cause of the failure?

Accepted Answer

The key provider certificate is expired or invalid. Option C is correct because the key provider certificate may be expired or invalid, causing the hosts to reject the connection even if network is reachable. Option A is wrong because ESXi hosts do not need an internet connection for on-premises KMS. Option B is wrong because vCenter Server does not manage key provider certificates directly. Option D is wrong because a firewall rule blocking the correct port would typically show as 'Unreachable' rather than 'Not Responding'.

Answer

The vCenter Server certificate has expired

Answer

The firewall on the key provider is blocking port 443

Answer

The ESXi hosts cannot reach the internet

Question 6

An organization is implementing vSphere Trust Authority for sensitive workloads. The administrator must configure the trusted ESXi hosts to attest to vCenter Server. Which component is responsible for performing attestation?

Accepted Answer

A separate vCenter Server instance acting as the Trust Authority. Option B is correct because vSphere Trust Authority uses a dedicated vCenter Server (Trust Authority vCenter) to perform attestation of ESXi hosts. Option A is wrong because the workstation is not part of the trust chain. Option C is wrong because the trusted ESXi hosts themselves do not perform attestation; they are attested. Option D is wrong because the Key Provider is used for encryption keys, not attestation.

Answer

The administrator's workstation

Answer

The Key Provider (KMS) server

Answer

The trusted ESXi hosts themselves

Question 7

A vSphere administrator wants to restrict direct console access to an ESXi host to authorized administrators only, without interrupting running virtual machines. Which feature should the administrator enable?

Accepted Answer

Lockdown mode. Option A is correct because lockdown mode restricts direct access to the ESXi host via DCUI and SSH, but allows access through vCenter Server while VMs continue to run. Option B is wrong because disabling SSH alone does not restrict DCUI. Option C is wrong because host profiles configure settings but do not enforce access restriction. Option D is wrong because DRS is for load balancing, not security.

Answer

Enable DRS

Answer

Configure a host profile

Answer

Disable SSH service

Question 8

An administrator needs to allow HTTP traffic from a specific management workstation to an ESXi host while blocking all other inbound traffic. The ESXi firewall uses the default ruleset. What should the administrator do?

Accepted Answer

Use esxcli network firewall ruleset set to create an allowed IP list for the HTTP ruleset. Option D is correct because the ESXi firewall allows creating allow rules for specific IP addresses via esxcli, which overrides the default deny. Option A is wrong because opening all ports is insecure. Option B is wrong because service console firewall is not used in modern ESXi. Option C is wrong because disabling firewall is insecure.

Answer

Open all firewall ports for the management subnet

Answer

Disable the ESXi firewall and use a network firewall

Answer

Modify the service console firewall rules

Question 9

A vSphere environment uses VMCA for certificate management. An administrator needs to replace the certificate for vCenter Server with a custom CA-signed certificate. The custom CA root certificate must be trusted by all ESXi hosts. Which method should the administrator use to distribute the custom CA root certificate to ESXi hosts?

Accepted Answer

Create a host profile containing the custom CA root certificate and apply it to the ESXi hosts. Option C is correct because using a host profile to apply the certificate ensures consistency and is policy-driven. Option A is wrong because manually copying to each host is not scalable. Option B is wrong because vCenter does not automatically push root CAs to hosts; it only replaces the machine SSL certificate. Option D is wrong because the rhttpproxy service is for proxying, not for certificate distribution.

Answer

Restart the rhttpproxy service on each ESXi host with a new configuration

Answer

Import the root CA certificate into vCenter Server and it will automatically push to hosts

Answer

Manually upload the root CA certificate to each ESXi host via SCP

Question 10

An administrator has created a custom role named 'VM Power User' with permissions to power on and off virtual machines. The role is assigned to a group of users at the datacenter level. A user from that group reports they cannot power on a VM in a particular cluster. What is the most likely reason?

Accepted Answer

The cluster has a permission that blocks inheritance from the datacenter. Option B is correct because permissions are not inherited by default if a child object has explicit permissions set that block propagation. Option A is wrong because the group is assigned the role; individual membership suffices. Option C is wrong because the role does not require resource assignment. Option D is wrong because the user is part of the group; no separate assignment needed.

Answer

The user must be assigned the role individually at the VM level

Answer

The role is not assigned to a resource pool containing the VM

Answer

The user is not a member of the group assigned to the role

Question 11

An organization is deploying vCenter Server in a DMZ. Which security best practice should the administrator implement to protect the vCenter Server appliance?

Accepted Answer

Enable FIPS 140-2 mode on the vCenter Server appliance. Option D is correct because enabling FIPS mode on the appliance ensures cryptographic compliance and strengthens security. Option A is wrong because joining Active Directory may introduce attack surface. Option B is wrong because vCenter does not use SSH by default for management. Option C is wrong because vCenter does not use root account in the same way; the appliance uses the 'root' user but best practice is to limit its use, not delete.

Answer

Join the vCenter Server to the corporate Active Directory domain

Answer

Enable SSH for remote administration

Answer

Delete the root user account

Question 12

An administrator is configuring vSphere Native Key Provider (NKP) in a cluster. After enabling NKP, the administrator adds a VM and attempts to encrypt it, but receives an error that the key provider is not available. The cluster consists of three ESXi hosts. What is the most likely cause?

Accepted Answer

Only one ESXi host in the cluster is available; the other two are offline. Option A is correct because NKP requires a majority of hosts (at least 2) to be active and reachable to form a quorum. If one host is offline, the key provider may be unavailable if the remaining hosts cannot achieve quorum. Option B is wrong because NKP works with any storage type. Option C is wrong because vCenter Server availability is not required for NKP after initial setup. Option D is wrong because the network is separate from key provider availability.

Answer

The VM is stored on NFS storage which is not supported with NKP

Answer

The vCenter Server is disconnected from the cluster

Answer

The ESXi hosts are on different network segments

Question 13

Which TWO actions are required to enable vSphere VM encryption? (Choose two.)

Accepted Answer

Configure a Key Management Server (KMS) or native key provider. Options B and D are correct. A key provider (KMS) must be configured and associated with the vCenter Server, and then encryption must be enabled on the VM (via storage policy or directly). Option A is wrong because encryption does not require disabling vMotion. Option C is wrong because SSH access is not required. Option E is wrong because host lockdown mode is unrelated.

Answer

Enable SSH on each ESXi host to manage encryption keys

Answer

Disable vMotion on the cluster

Answer

Place the ESXi hosts in lockdown mode

Question 14

Which THREE security hardening measures should be applied to an ESXi host? (Choose three.)

Accepted Answer

Enable lockdown mode. Options A, B, and D are correct. Enabling lockdown mode restricts direct access, disabling shell/SSH reduces attack surface, and a host profile ensures consistent security settings. Option C is wrong because SNMP is a management protocol that does not primarily provide security. Option E is wrong because increasing memory workload does not improve security.

Answer

Increase memory resource allocation for management VMs

Answer

Enable SNMP v3

Question 15

Which TWO statements about vCenter Single Sign-On (SSO) are true? (Choose two.)

Accepted Answer

It supports multiple identity sources such as Active Directory and LDAP. Options B and D are correct. SSO supports multiple identity sources (e.g., AD, LDAP) and uses SAML tokens for authentication. Option A is wrong because passwords are stored hashed, not in plaintext. Option C is wrong because SSO can work without a Windows Active Directory. Option E is wrong because SSO uses SAML, not Kerberos, for token exchange.

Answer

It uses Kerberos to authenticate users to vCenter Server

Answer

It stores user passwords in plaintext for faster authentication

Answer

It requires a Windows Active Directory domain to function

VCP-DCV vSphere Security Practice Test 2 — 15 Questions

Exhibit

VCP-DCV vSphere Security Practice Test 2 — 15 Questions

Exhibit