VCP-DCV vSphere Security Practice Test 2 — 15 Questions

Question 1

An organization is deploying vCenter Server in a DMZ. Which security best practice should the administrator implement to protect the vCenter Server appliance?

Accepted Answer

Enable FIPS 140-2 mode on the vCenter Server appliance. Enabling FIPS 140-2 mode on the vCenter Server appliance ensures that cryptographic modules used for encryption and authentication meet strict federal security standards, enhancing protection in a DMZ. This is a security best practice for vCenter in untrusted networks.

Answer

Join the vCenter Server to the corporate Active Directory domain

Answer

Enable SSH for remote administration

Answer

Delete the root user account

Question 2

An administrator is configuring vSphere Native Key Provider (NKP) in a cluster. After enabling NKP, the administrator adds a VM and attempts to encrypt it, but receives an error that the key provider is not available. The cluster consists of three ESXi hosts. What is the most likely cause?

Accepted Answer

Only one ESXi host in the cluster is available; the other two are offline. VSphere Native Key Provider (NKP) requires a majority of ESXi hosts in the cluster to be available to form a quorum for key management. With three hosts, at least two must be online. If only one host is available, the key provider becomes unavailable because the remaining hosts cannot achieve quorum. Option A is incorrect because NKP supports all storage types including NFS. Option B is incorrect because vCenter Server connectivity is not required for NKP after initial setup. Option C is incorrect because network segmentation does not directly affect NKP availability.

Answer

The VM is stored on NFS storage which is not supported with NKP

Answer

The vCenter Server is disconnected from the cluster

Answer

The ESXi hosts are on different network segments

Question 3

An administrator configures permissions as shown in the exhibit. Users 'user1' and 'user2' are in the 'Limited' role which only allows 'Read' and 'Console interaction' privileges. User1 reports being unable to open a console to a VM running on host2.domain.com. What is the most likely cause?

Accepted Answer

User1 does not have permissions on host2.domain.com. In vSphere, permissions are assigned on inventory objects (datacenter, cluster, host, VM, folder) and are inherited down the hierarchy, but a user must have at least Read permission on every object in the path to the target — including the host. If user1 has the 'Limited' role assigned at the datacenter or cluster level but no permission on host2.domain.com specifically (or the host is in a different, unpermitted branch), the console access to VMs on that host is denied. The most likely cause is missing permissions on host2.domain.com.

Answer

The 'Limited' role does not include 'Console interaction' privilege

Answer

The permissions are applied at the datacenter level, not the host level

Answer

User1 should be added to the admin group

Question 4

An administrator wants to prevent direct root access to an ESXi host via SSH and the DCUI. Which two configurations are necessary?

Accepted Answer

Enable lockdown mode and remove root from permissions.. Enabling lockdown mode restricts direct access to the ESXi host for all users except those with the DCUI.Access permission, and removing the root user from the host's permissions eliminates root's ability to log in directly via SSH or the DCUI. Together, these two configurations prevent direct root access while still allowing authorized administrative access through vCenter. Option A is insufficient because a root exception in lockdown mode explicitly preserves root's direct access, which is the opposite of the goal. Option B does not prevent root access, since disabling services is not the same as removing root's permissions, and root could still authenticate if services are re-enabled. Option C addresses authentication strength via SSO and smart cards but does not remove root's direct local access to the host.

Answer

Set the host to lockdown mode with root exception.

Answer

Disable DCUI and SSH services.

Answer

Configure SSO to require Smart Card authentication.

Question 5

A vSphere administrator notices that after replacing the vCenter Server machine SSL certificate, all vCenter services start, but from one ESXi host, the vCenter Server appears as disconnected. Other hosts connect fine. What is the most likely cause?

Accepted Answer

The ESXi host does not trust the signing certificate authority of the new vCenter certificate.. When the vCenter Server machine SSL certificate is replaced, each ESXi host must trust the certificate's issuing CA. If one host's trusted root certificate store does not contain the new certificate's CA certificate, TLS verification fails, causing vCenter to appear disconnected from that host. Option A is incorrect because the Common Name is used for server identity, but it does not need to match the host's IP; the issue is trust of the CA, not name mismatch. Option C is incorrect because system time differences would affect all hosts, not just one, and typically cause certificate validity errors, not trust issues. Option D is incorrect because the machine SSL certificate is distinct from SSO certificates; replacing it does not affect SSO if other certificates are unchanged.

Answer

The vCenter certificate's Common Name does not match the host's IP address.

Answer

The ESXi host has a different system time than the vCenter Server.

Answer

The vCenter Server certificate was not imported into the SSO trusted domain.

Question 6

An administrator needs to grant a group of vSphere administrators the ability to create and delete snapshots, and also to power on and off VMs, but not to delete VMs. The administrators should also be able to view the virtual machine console. Which custom role should be created?

Accepted Answer

Snapshot creation/removal, Power operations, VirtualMachine.Interact.ConsoleInteraction. The required privileges are snapshot creation/removal, power operations, and console interaction, but explicitly NOT VM deletion. Option B lists exactly those three privilege sets (Snapshot creation/removal, Power operations, VirtualMachine.Interact.ConsoleInteraction) without including Delete VM, matching the least-privilege requirement.

Answer

Snapshot creation/removal, Power operations, Delete VM, ConsoleInteraction

Answer

Power operations, ConsoleInteraction only

Answer

Snapshot creation/removal, Power operations, Remove Disk, ConsoleInteraction

Question 7

A vSphere environment uses vSAN and has VM encryption enabled. The administrator needs to recover a VM after an encrypted disk becomes corrupted. What is required?

Accepted Answer

The key management server (KMS) and the KEK/Rekey.. With VM encryption in vSphere, the virtual machine's files (including disks) are encrypted using a data encryption key (DEK) that is itself wrapped by a key encryption key (KEK) stored in an external Key Management Server (KMS). To recover an encrypted VM after disk corruption, the administrator must have access to the KMS and the correct KEK/DEK material; without the keys, the encrypted disk is unrecoverable ciphertext. Backups alone are insufficient if the backup is also encrypted and the keys are lost.

Answer

The vSAN health service.

Answer

A recent backup of the VM files.

Answer

The VM’s storage policy.

Question 8

Which TWO of the following are best practices for securing ESXi hosts? (Choose two.)

Accepted Answer

Enable lockdown mode on the host.. Option C is correct because enabling lockdown mode on an ESXi host restricts direct root access through the DCUI, ESXi Shell, and SSH, forcing all administrative actions through vCenter Server or an authorized privileged account, which enforces centralized authentication and auditing. Option E is correct because integrating ESXi hosts with Active Directory lets administrators authenticate with named domain accounts and assign roles via vSphere permissions, eliminating shared local root credentials and enabling accountability and centralized account lifecycle management. The unmarked options are not best practices: granting the root user direct permissions on all hosts (A) violates least privilege and removes accountability, disabling the ESXi firewall (B) exposes management and service ports to unnecessary risk, and allowing DCUI access from trusted management networks (D) is weaker than disabling or tightly restricting DCUI access, since lockdown mode is the preferred control.

Answer

Grant the root user direct permissions on all hosts.

Answer

Disable the ESXi firewall to simplify management.

Answer

Allow DCUI access from trusted management networks.

Question 9

Which TWO of the following are required to configure vMotion encryption for a VM? (Choose two.)

Accepted Answer

The source and destination ESXi hosts must be version 6.5 or later.. Option B is correct because encrypted vMotion requires both the source and destination ESXi hosts to run ESXi 6.5 or later, since the encrypted vMotion capability was introduced in vSphere 6.5 and both endpoints must support the encryption handshake. Option D is correct because the VM must be at virtual hardware version 11 or later, which is the minimum hardware version that supports encrypted vMotion features in vSphere 6.5. Option A is incorrect because vMotion encryption does not require hosts from the same vendor; interoperability is governed by supported ESXi versions and vMotion compatibility, not vendor matching. Option C is incorrect because a KMS is required for VM encryption (encrypted VMDKs), not for encrypted vMotion, which uses a one-time session key rather than stored keys. Option E is incorrect because VM-level encryption is not a prerequisite for encrypted vMotion; encrypted vMotion can be used independently of whether the VM's disks are encrypted.

Answer

The source and destination hosts must be from the same vendor.

Answer

A Key Management Server (KMS) must be configured in vCenter.

Answer

The VM must have encryption enabled at the VM level.

Question 10

Which THREE of the following are prerequisites for configuring vSAN encryption? (Choose three.)

Accepted Answer

vSphere Enterprise Plus license.. Options A, D, and E are correct prerequisites for vSAN encryption. Option A: vSAN encryption requires a vSphere Enterprise Plus license (or equivalent, such as VMware Cloud Foundation). Option D: A Key Management Server (KMS) supporting the KMIP protocol is necessary to manage encryption keys. Option E: TPM 2.0 chip on each ESXi host provides a hardware root of trust for key storage. Option B (Intel SGX) is not required for vSAN encryption. Option C (all-flash disk group) is incorrect because vSAN encryption supports both all-flash and hybrid configurations.

Answer

Intel Software Guard Extensions (SGX) on ESXi hosts.

Answer

All-flash disk group configuration.

Question 11

An administrator runs the above command on an ESXi host. Which of the following is true about this host?

Accepted Answer

Root user can still access the DCUI or SSH using the allowed exception commands.. The command shown is 'esxcli system lockdownmode get' (or similar) which returns 'Lockdown Mode: Enabled (Normal)' or 'Strict'. When lockdown mode is enabled in Normal mode, the root user can still access the DCUI or SSH if they are listed as an exception user. The option states that root can still access the DCUI or SSH using the allowed exception commands, which is true for Normal lockdown mode. In Strict mode, root cannot access unless explicitly added as an exception user. The question implies the host is in Normal lockdown mode, so root retains access via exception commands.

Answer

Lockdown mode is not enabled.

Answer

The exception user can run any command via the DCUI.

Answer

The host is in strict lockdown mode.

Question 12

During a security audit, it is discovered that a vCenter Server instance is using the default self-signed certificate. The company policy requires all certificates to be signed by an internal enterprise CA. An administrator has imported the CA chain into the VMware Endpoint Certificate Store (VECS) and generated a Certificate Signing Request (CSR). After receiving the signed certificate from the CA, which additional step is required to complete the certificate replacement?

Accepted Answer

Import the signed certificate into the appropriate VECS store and run the certificate-manager utility to update the services.. After the signed certificate is received from the CA, it must be imported into the appropriate VECS store (e.g., the machine SSL certificate store). Then, the certificate-manager utility (located at /usr/lib/vmware-vmca/bin/certificate-manager) must be run to update all vCenter services to use the new certificate. Option A is incorrect because generating a new CSR after replacement is unnecessary. Option B is incorrect because restarting the vCenter Management Agent only affects that single service, not all services that need the new certificate. Option D is incorrect because the certificate-manager utility is used for CA-signed certificates, not certool (which is for self-signed certificates).

Answer

Replace the default certificate in the VECS store with the CA-signed certificate and then generate a new CSR.

Answer

Restart the vCenter Management Agent (vma) service.

Answer

Run the certificate manager tool (certool) to generate a new self-signed certificate.

Question 13

A company uses vSphere with Tanzu to run container workloads. The security team requires that all container traffic between namespaces be encrypted. What is the best approach to achieve this?

Accepted Answer

Deploy NSX-T and enable the Network Encryption feature for East-West traffic.. NSX-T provides the Network Encryption feature that can encrypt East-West traffic between namespaces in vSphere with Tanzu. Enabling NSX-T network encryption ensures that all container traffic between namespaces is encrypted in transit, meeting the security team's requirement. This is the native, supported approach within the VMware ecosystem.

Answer

Use the NSX Container Plugin with IPsec to encrypt traffic.

Answer

Enable vSAN encryption to encrypt data at rest and assume it covers in-transit traffic.

Answer

Install a third-party CNI like Calico with IPsec enabled.

Question 14

An administrator needs to lock down an ESXi host for FIPS 140-2 compliance. Which step must be taken?

Accepted Answer

Enable lockdown mode on the ESXi host.. For FIPS 140-2 compliance, the ESXi host must be placed in lockdown mode to restrict direct root access and ensure only authorized users via vCenter can manage the host. Option A is incorrect because disabling the ESXi Shell and SSH services alone does not achieve FIPS compliance; lockdown mode is the required step. Option C is incorrect because host profiles can apply security settings but do not enforce lockdown mode for FIPS. Option D is incorrect because FIPS mode is not configured in the host's BIOS; it is a software-level cryptographic compliance enforced by ESXi lockdown and other settings.

Answer

Disable the ESXi Shell and SSH services.

Answer

Configure a host profile with a security policy.

Answer

Enable FIPS mode in the host's BIOS.

Question 15

During a vulnerability scan, an ESXi host is found to have the SSLv3 protocol enabled. The administrator wants to disable SSLv3 and enforce TLS 1.2 for all network services on the host. Which approach is most effective?

Accepted Answer

Set the advanced system option 'SSLv3.Enabled' to false and 'TLSv1.2.Enabled' to true.. The most effective approach is to set the advanced system option 'SSLv3.Enabled' to false and 'TLSv1.2.Enabled' to true. This directly modifies the ESXi host's SSL/TLS configuration. Option A is incorrect because vCenter Server's TLS settings do not override the host's own configuration. Option B is incorrect because the DCUI does not have a direct setting to enforce TLS 1.2; it only allows basic security settings. Option C is incorrect because disabling services does not change the protocol version used by remaining services.

Answer

Update the TLS configuration in vCenter Server and reboot the host.

Answer

Change the host's security settings in the DCUI to require TLS 1.2.

Answer

Disable all unnecessary services on the host via the DCUI.