VCP-DCV vSphere Security Practice Test 2 — 15 Questions

Question 1

A company has a vSphere environment with 20 ESXi hosts and 500 VMs. The security team mandates that all administrative access to vCenter Server must be through a single, highly restricted account with multi-factor authentication (MFA). The account must be used for both the vSphere Client and API integrations. Which step should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Integrate vCenter Server with an external identity provider (e.g., ADFS, Okta) that supports MFA, and use a service account with MFA for API access.. Integrating vCenter Server with an external identity provider (IdP) such as ADFS or Okta allows the use of a single service account that supports multi-factor authentication (MFA) for both the vSphere Client and API integrations. This approach meets the security mandate by centralizing authentication through an IdP that enforces MFA, while also supporting OAuth 2.0 token-based API access, which is required for modern vSphere API integrations. The built-in administrator account cannot be directly configured with MFA in a way that satisfies both interactive and API access requirements without external integration.

Answer

Configure the built-in administrator account to require smart card authentication.

Answer

Create a new local account and configure it as a member of the Administrators group, then enforce MFA via a third-party tool on the vCenter Server OS.

Answer

Disable the built-in administrator account and create a new local account with the same privileges.

Question 2

A large financial institution runs a vSphere 7.0 environment with 100 ESXi hosts and 2,000 VMs. The security team has identified that several VMs are vulnerable to a critical side-channel attack that requires disabling hyperthreading on the ESXi hosts. The administrator needs to implement a solution that minimizes performance impact while ensuring compliance. The environment uses DRS clusters with varying workloads: some VMs are CPU-intensive (financial modeling) and others are memory-bound (database servers). The administrator cannot afford to take hosts offline for maintenance during business hours. The change must be implemented within 48 hours. Which course of action should the administrator take?

Accepted Answer

Place each host in maintenance mode individually, disable hyperthreading in the host BIOS, reboot the host, and then move to the next host. Rebalance VMs after all hosts are updated.. Disabling hyperthreading to mitigate side-channel attacks (e.g., L1TF or MDS) requires a host BIOS change, which necessitates a reboot. The only supported method in vSphere 7.0 is to place each host into maintenance mode, change the BIOS setting, reboot, and then repeat for all hosts. This approach minimizes performance impact by allowing VMs to be migrated via vMotion and avoids simultaneous downtime, meeting the 48-hour requirement without taking all hosts offline during business hours.

Answer

Use a vSphere DRS rule to disable hyperthreading for all VMs in the cluster, avoiding the need to modify host BIOS.

Answer

Delay the change and schedule a maintenance window for the next month when business impact is lower.

Answer

Disable hyperthreading on all hosts simultaneously using a vSphere Cluster feature, then reboot all hosts at once during off-peak hours.

Question 3

A company is implementing vSphere 7.0 and wants to encrypt all vMotion traffic between ESXi hosts in a cluster. The cluster is not using any other encryption features. What is the minimum requirement to enable vMotion encryption?

Accepted Answer

The ESXi hosts must have a host profile applied with encryption enabled.. In vSphere 7.0, enabling vMotion encryption does not require Active Directory, a Key Management Server, Enhanced vMotion Compatibility (EVC), or host profiles. The minimum requirement is simply to configure the vMotion encryption policy on each ESXi host (set to 'Required' or 'Opportunistic'). No additional infrastructure or profiles are needed.

Answer

A VM Encryption Key Management Server must be configured.

Answer

The ESXi hosts must be joined to an Active Directory domain.

Answer

The cluster must be configured with Enhanced vMotion Compatibility (EVC).

Question 4

Refer to the exhibit. An administrator runs the vmkfstools command on an ESXi host and views the output. Which conclusion can be drawn from the output?

Accepted Answer

The datastore has approximately 50% free space.. The vmkfstools command output shows the capacity and free space values for the datastore. In this case, the free space is approximately half of the total capacity, indicating roughly 50% free space. This is a direct calculation from the displayed numbers, not an inference about provisioning or encryption.

Answer

The VMDK file is thin provisioned.

Answer

The datastore has a block size of 1 MB, which is the maximum for VMFS-6.

Answer

The virtual machine's disk is encrypted.

Question 5

Order the steps to take a snapshot of a virtual machine.

Accepted Answer

Initiate snapshot, name it, choose memory and quiesce options, then confirm.. The correct order for taking a snapshot in VMware vSphere is to first initiate the snapshot by right-clicking the VM and selecting 'Snapshot > Take Snapshot', then in the dialog provide a name and optional description, select whether to snapshot the virtual machine's memory and whether to quiesce the file system, and finally confirm by clicking OK. This sequence ensures that all necessary parameters are set before the snapshot is created.

Answer

Initiate snapshot, choose memory and quiesce options, name it, then confirm.

Answer

Name the snapshot, initiate snapshot, choose memory and quiesce options, then confirm.

Answer

Initiate snapshot, confirm, then name it and choose memory and quiesce options.

Question 6

Match each vSphere networking component to its description.

Accepted Answer

vSphere Distributed Switch: A centralized virtual switch that spans multiple ESXi hosts and provides consistent networking configuration.. Key vSphere networking components: Distributed Switch (centralized, multi-host), Standard Switch (per-host), Port Group (logical grouping). Common confusion is mixing the switch types.

Answer

vSphere Distributed Switch: A host-level virtual switch that does not support centralized management.

Answer

vSphere Standard Switch: A virtual switch that spans multiple hosts and provides consistent configuration across a cluster.

Answer

Port Group: A physical network interface that connects a host to the physical network.

Question 7

A company wants to integrate vCenter Server with an external identity source to allow users to authenticate using their corporate credentials. The administrator must ensure that authentication traffic is encrypted. Which solution should the administrator implement?

Accepted Answer

Active Directory over LDAPS. Active Directory over LDAPS (Option C) is the correct solution because it encrypts authentication traffic using SSL/TLS, ensuring confidentiality. Option A is incorrect because local OS authentication does not use corporate credentials. Option B is incorrect because NTLM authentication is not supported as a direct identity source for vCenter Single Sign-On. Option D is incorrect because standard LDAP transmits credentials in plaintext, without encryption.

Answer

Local OS authentication on vCenter Server

Answer

Active Directory over NTLM

Answer

Active Directory over LDAP

Question 8

An administrator is troubleshooting a failed VM encryption operation. The key provider status shows as 'Not Responding' in the vSphere Web Client. The administrator has verified network connectivity between the ESXi hosts and the key provider. What is the most likely cause of the failure?

Accepted Answer

The key provider certificate is expired or invalid. When the key provider's certificate is expired or invalid, the ESXi hosts may be able to reach the key provider over the network, but the SSL/TLS handshake fails, resulting in a 'Not Responding' status. Option A is wrong because an expired vCenter certificate would affect vCenter operations but not the ESXi hosts' direct communication with the key provider. Option B is wrong: Port 443 is commonly used for HTTPS, but if firewall blocked port 443, the status would typically show as 'Unreachable' or 'Connection Refused', not 'Not Responding'. Option C is wrong: ESXi hosts do not need internet access for an on-premises key provider; they only need local network connectivity.

Answer

The vCenter Server certificate has expired

Answer

The firewall on the key provider is blocking port 443

Answer

The ESXi hosts cannot reach the internet

Question 9

A vSphere administrator wants to restrict direct console access to an ESXi host to authorized administrators only, without interrupting running virtual machines. Which feature should the administrator enable?

Accepted Answer

Lockdown mode. Lockdown mode restricts direct access to the ESXi host via DCUI and SSH, but allows access through vCenter Server while VMs continue to run. Option B (Enable DRS) is wrong because DRS is for load balancing, not security. Option C (Configure a host profile) is wrong because host profiles configure settings but do not enforce access restriction. Option D (Disable SSH service) is wrong because disabling SSH alone does not restrict DCUI.

Answer

Enable DRS

Answer

Configure a host profile

Answer

Disable SSH service

Question 10

An administrator needs to allow HTTP traffic from a specific management workstation to an ESXi host while blocking all other inbound traffic. The ESXi firewall uses the default ruleset. What should the administrator do?

Accepted Answer

Use esxcli network firewall ruleset set to create an allowed IP list for the HTTP ruleset. The ESXi firewall allows restricting a specific ruleset (such as HTTP) to a list of allowed IP addresses using the esxcli network firewall ruleset set command. Option A is wrong because opening all firewall ports for the management subnet is overly permissive and allows more than just HTTP traffic. Option B is wrong because disabling the ESXi firewall removes all host-level protection and is not recommended. Option C is wrong because the service console firewall is deprecated in modern ESXi; the correct method is to use the ESXi firewall with esxcli.

Answer

Open all firewall ports for the management subnet

Answer

Disable the ESXi firewall and use a network firewall

Answer

Modify the service console firewall rules

Question 11

A vSphere environment uses VMCA for certificate management. An administrator needs to replace the certificate for vCenter Server with a custom CA-signed certificate. The custom CA root certificate must be trusted by all ESXi hosts. Which method should the administrator use to distribute the custom CA root certificate to ESXi hosts?

Accepted Answer

Create a host profile containing the custom CA root certificate and apply it to the ESXi hosts. Using a host profile to apply the custom CA root certificate ensures consistent, policy-driven deployment across all ESXi hosts, leveraging vCenter's host profile functionality. Option A is incorrect: restarting the rhttpproxy service with a new configuration does not distribute certificates; it only restarts the proxy service. Option B is incorrect: while vCenter can manage machine SSL certificates, it does not automatically push root CA certificates to ESXi hosts; the administrator must explicitly import the root CA into the ESXi trust store, which is not done automatically by vCenter. Option C is incorrect: manually uploading via SCP is not scalable and is not the recommended method for managing certificate trust across multiple hosts; host profiles provide a centralized, automated approach.

Answer

Restart the rhttpproxy service on each ESXi host with a new configuration

Answer

Import the root CA certificate into vCenter Server and it will automatically push to hosts

Answer

Manually upload the root CA certificate to each ESXi host via SCP

Question 12

An administrator has created a custom role named 'VM Power User' with permissions to power on and off virtual machines. The role is assigned to a group of users at the datacenter level. A user from that group reports they cannot power on a VM in a particular cluster. What is the most likely reason?

Accepted Answer

The cluster has a permission that blocks inheritance from the datacenter. Permissions are not inherited by default if a child object has explicit permissions set that block propagation. Option A is wrong because the group is assigned the role; individual membership suffices. Option C is wrong because the role does not require resource assignment. Option D is wrong because the user is part of the group; no separate assignment needed.

Answer

The user must be assigned the role individually at the VM level

Answer

The role is not assigned to a resource pool containing the VM

Answer

The user is not a member of the group assigned to the role

Question 13

An organization is deploying vCenter Server in a DMZ. Which security best practice should the administrator implement to protect the vCenter Server appliance?

Accepted Answer

Enable FIPS 140-2 mode on the vCenter Server appliance. Enable FIPS 140-2 mode on the vCenter Server appliance. When deploying vCenter Server in a DMZ, enabling FIPS 140-2 mode ensures that the appliance uses only FIPS-approved cryptographic algorithms, enhancing security and compliance. Option A is incorrect because joining the vCenter Server to the corporate Active Directory domain exposes it to domain-related attacks and increases the attack surface in the DMZ. Option B is incorrect because enabling SSH for remote administration is a security risk; SSH should be disabled unless absolutely necessary, and even then, it should be tightly controlled. Option D is incorrect because deleting the root user account is not a best practice; the root account is essential for system recovery and maintenance, and the recommended approach is to limit its use and enforce strong passwords.

Answer

Join the vCenter Server to the corporate Active Directory domain

Answer

Enable SSH for remote administration

Answer

Delete the root user account

Question 14

An administrator is configuring vSphere Native Key Provider (NKP) in a cluster. After enabling NKP, the administrator adds a VM and attempts to encrypt it, but receives an error that the key provider is not available. The cluster consists of three ESXi hosts. What is the most likely cause?

Accepted Answer

Only one ESXi host in the cluster is available; the other two are offline. VSphere Native Key Provider (NKP) requires a majority of ESXi hosts in the cluster to be available to form a quorum for key management. With three hosts, at least two must be online. If only one host is available, the key provider becomes unavailable because the remaining hosts cannot achieve quorum. Option A is incorrect because NKP supports all storage types including NFS. Option B is incorrect because vCenter Server connectivity is not required for NKP after initial setup. Option C is incorrect because network segmentation does not directly affect NKP availability.

Answer

The VM is stored on NFS storage which is not supported with NKP

Answer

The vCenter Server is disconnected from the cluster

Answer

The ESXi hosts are on different network segments

Question 15

Which TWO actions are required to enable vSphere VM encryption? (Choose two.)

Accepted Answer

Configure a Key Management Server (KMS) or native key provider. Options A and D are correct. A key provider (KMS or native key provider) must be configured and associated with the vCenter Server, and then encryption must be enabled on the VM (via storage policy or directly). Option B is wrong because SSH access is not required for encryption. Option C is wrong because encryption does not require disabling vMotion. Option E is wrong because host lockdown mode is unrelated.

Answer

Enable SSH on each ESXi host to manage encryption keys

Answer

Disable vMotion on the cluster

Answer

Place the ESXi hosts in lockdown mode