VCP-DCV vSphere Security Practice Test 3 — 15 Questions

Question 1

A vSphere administrator is preparing for a PCI DSS audit. The auditor requires that all virtual machine disks be encrypted at rest. The environment uses vSAN with storage policies. Which storage policy-based management (SPBM) rule should be applied to ensure encryption?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the rule 'VSAN.encryption' to 'Yes'.. For vSAN encryption at rest, the storage policy rule is 'VSAN.encryption' and must be set to 'Yes' to enable encryption. Option A is incorrect because 'EncryptionEnabled' is not a valid vSAN SPBM rule. Option B is incorrect because 'SPBM.Encryption' is not a recognized rule name. Option C is incorrect because while the rule name 'VSAN.encryption' is correct, the value should be 'Yes' rather than 'Required' to enable encryption.

Answer

Set the rule 'EncryptionEnabled' to 'True'.

Answer

Set the rule 'SPBM.Encryption' to 'Enabled'.

Answer

Set the rule 'VSAN.encryption' to 'Required'.

Question 2

An administrator needs to ensure that a service account used for vCenter Server backups has the minimum required privileges. The account should only be able to perform backup and restore operations. Which role should be assigned?

Accepted Answer

BackupOperator. (BackupOperator) is correct. The BackupOperator role in vCenter Server provides the minimum required privileges to perform backup and restore operations without granting full administrative access. Option A (ReadOnly) is incorrect because it only allows read access and cannot perform backup/restore actions. Option B (Administrator) is incorrect because it grants full administrative privileges, exceeding the minimum required. Option D (NoAccess) is incorrect because it denies all permissions, preventing any backup operations.

Answer

ReadOnly

Answer

Administrator

Answer

NoAccess

Question 3

Which THREE of the following are required components for setting up a vSphere Trust Authority (vTA) cluster?

Accepted Answer

A dedicated Trust Authority cluster with at least one host.. Option B is correct because a vSphere Trust Authority deployment requires a dedicated Trust Authority cluster containing at least one ESXi host that acts as the trusted attester, separate from the workload/trusted clusters it will attest. Option D is correct because each trusted host must have a physical TPM (version 2.0) so the Attestation Service can verify host integrity via remote attestation; TPM is a hard prerequisite for vTA. Option E is correct because the Trust Authority cluster runs the Attestation Service and Key Cache services, which perform attestation of trusted hosts and broker encryption keys from the key provider to those hosts. Option A is not required as a vTA component itself: a key provider/KMS is needed for vSphere Encryption and the Key Provider Service, but it is not one of the components that constitute the Trust Authority cluster setup. Option C is not required because NSX-T is not a prerequisite for vTA; network segmentation can be achieved with standard vSphere networking and does not have to involve NSX-T Data Center.

Answer

A Key Provider, such as VMware Key Provider or an external KMS.

Answer

NSX-T Data Center deployed for network segmentation.

Question 4

Which TWO of the following are best practices for securing a vSphere environment against ransomware attacks?

Accepted Answer

Implement a backup solution with immutable snapshots and offsite storage.. The correct answers are A and D. Implement a backup solution with immutable snapshots and offsite storage (A) ensures backups cannot be deleted or encrypted by ransomware, enabling recovery. Enabling vSAN encryption (D) protects data at rest, preventing unauthorized access if storage is compromised. Option B is wrong because vMotion encryption protects data in transit during migration, not against ransomware. Option C is wrong because VM snapshots are not backups; they can be deleted by ransomware and do not provide long-term recovery. Option E is wrong because allowing all outbound traffic by default violates the principle of least privilege and increases attack surface.

Answer

Enable vMotion encryption for all migrations.

Answer

Use VM snapshots as primary backup method.

Answer

Configure the distributed firewall to allow all outbound traffic by default.

Question 5

A vSphere administrator needs to restrict access to a specific cluster so that only the storage team can manage datastores. The storage team members are in a group called 'storage_team' in Active Directory. What is the best practice to achieve this?

Accepted Answer

Create a custom role with required Datastore privileges and assign it to the 'storage_team' group at the cluster level.. Creating a custom role with the required Datastore privileges and assigning it at the cluster level provides the most granular, least-privileged access to manage only that cluster. Option B is incorrect because the ReadOnly role does not include Datastore management privileges; it only allows viewing objects. Option C is incorrect because global permissions apply to all objects in vCenter, granting access to all clusters and datastores, which violates the principle of least privilege. Option D is incorrect because adding users to the local Administrators group grants full administrative access to vCenter, far exceeding the needed permissions for datastore management.

Answer

Create an SSO group for the storage team and assign the default 'ReadOnly' role at the cluster level.

Answer

Assign the 'storage_team' group a role with Datastore privileges at the vCenter level using global permissions.

Answer

Add each member of the storage team to the local Administrators group on the vCenter Server.

Question 6

A vCenter Server's SSL certificate has expired, causing all ESXi hosts to display a certificate warning and some management tasks to fail. The administrator needs to restore secure communication with minimal disruption. Which action should the administrator take?

Accepted Answer

Replace the vCenter Server certificate and then reconnect each ESXi host to vCenter.. Replacing the vCenter Server certificate and then reconnecting each ESXi host restores trust and secure communication. Option A is wrong because rebooting the vCenter Server appliance does not regenerate the SSL certificate automatically; the certificate remains expired. Option C is wrong because replacing certificates on each ESXi host individually does not address the expired vCenter certificate and is inefficient. Option D is wrong because vSphere Auto Deploy is used for provisioning hosts, not for replacing vCenter certificates.

Answer

Reboot the vCenter Server appliance to regenerate the certificate automatically.

Answer

Replace the SSL certificate on each ESXi host individually using the vSphere Web Client.

Answer

Use vSphere Auto Deploy to push new certificates to all hosts simultaneously.

Question 7

An administrator is configuring vSphere Trust Authority (vTA) to secure ESXi hosts in a sensitive environment. Which TWO components are required for a vTA deployment? (Choose two.)

Accepted Answer

Attestation Service. In a vSphere Trust Authority deployment, the Attestation Service (option C) is a required component because it performs remote attestation of the ESXi hosts in the trusted cluster, verifying their integrity by validating evidence such as TPM quotes against the desired state before they are trusted. The Key Provider (option E) is also required, as it supplies the encryption keys that the Trust Authority components use to protect the trust domain and provision keys to attested hosts. Together these two services form the core of the vTA architecture, alongside the Trust Authority Cluster itself. Option A is incorrect because the correct term is a Trust Authority Cluster, not a 'Trusted Host Cluster'; the trusted cluster is the set of hosts being attested, not a vTA deployment component. Option B is incorrect because a Certificate Authority is not a distinct required vTA component; vTA uses internal certificates managed by the Trust Authority, not a separate CA. Option D is incorrect because a Key Management Server is an external key server used with vSphere encryption (VM encryption or vSAN encryption), not a required component of the vTA deployment itself.

Answer

Trusted Host Cluster

Answer

Certificate Authority (CA)

Answer

Key Management Server (KMS)

Question 8

A company is implementing vSphere with Tanzu for containerized workloads. To secure the workload management plane, which THREE security features should be configured? (Choose three.)

Accepted Answer

Pod Security Policies. The correct answers are A, D, and E. Pod Security Policies (A) enforce security standards for pods in Kubernetes clusters. vSphere Native Key Provider (D) enables encryption for Kubernetes objects, securing data at rest. Network Policies (E) control traffic between pods, providing network segmentation. Option B (vCenter Single Sign-On) is not a new security feature specific to vSphere with Tanzu; it is already part of vCenter authentication. Option C (Content Library) is used for content management, not security.

Answer

vCenter Single Sign-On

Answer

Content Library

Question 9

A financial institution operates a vSphere 7 environment with 1,000 VMs, many of which process sensitive data. The security team mandates VM encryption at rest using a Key Management Server (KMS) cluster. The administrator has configured the KMS cluster as a key provider in vCenter and enabled encryption on a test VM, which works correctly. However, after adding a new ESXi host to the cluster and attempting to power on a previously encrypted VM, the VM fails to start with the error: 'Key provider unavailable for host <hostname>.' The new host is correctly licensed for encryption and has network connectivity to the KMS. The administrator verifies that the KMS cluster is operational and that other hosts can power on encrypted VMs. What is the most likely cause of this issue?

Accepted Answer

The ESXi host has not been added to the Key Provider's trust list or KMS configuration.. The error 'Key provider unavailable for host <hostname>' indicates that the new ESXi host is not registered with the Key Management Server (KMS) cluster. In vSphere, each ESXi host must be added as a trusted host in the KMS, or the KMS must be configured to allow the host to request keys. Even if the KMS is operational and other hosts work, the new host needs to be explicitly trusted by the KMS.

Answer

The ESXi host's firewall is blocking outbound connections to the KMS cluster.

Answer

The ESXi host does not have the required encryption feature license.

Answer

The VM's encryption policy is set to 'vSphere Native Key Provider' instead of 'KMS'.

Question 10

A vSphere administrator is troubleshooting a permissions issue. A user named 'backup_admin' is a member of the AD group 'Backup Operators'. The group has been assigned a custom role at the datacenter level with the following privileges: Virtual machine > Provisioning > Create snapshot, Virtual machine > State > Create, Revert, Remove snapshot. The user can see all VMs in the 'Production' folder but cannot see VMs in the 'Development' folder, even though both folders are under the same datacenter. The administrator confirms that no other permissions exist for this user or group, and propagation is enabled. What is the most likely reason the user cannot see the Development VMs?

Accepted Answer

The user's group lacks the 'System > View' privilege on the Development folder.. In vSphere, the 'System > View' privilege is required for a user to see an object in the inventory at all. Even if a role grants VM-level privileges like snapshot creation, without the System > View privilege on the folder (or inherited from a parent), the user cannot see the VMs in that folder. Since the group has the role at the datacenter level with propagation enabled, the Development folder should inherit it — but the role itself must include System > View for visibility, which is the most likely missing piece.

Answer

The user's permissions are inherited from a different group that denies access.

Answer

The user's role does not include the 'Folder > Create' privilege.

Answer

The user's group has been assigned 'No Access' on the Development folder.

Question 11

An organization wants to secure management traffic between vCenter Server and ESXi hosts. The security policy mandates disabling all versions of TLS below 1.2. After the administrator configures vCenter to use only TLS 1.2, several ESXi hosts (all version 6.0) lose connectivity to vCenter. The hosts remain operational but show as disconnected in the vSphere Web Client. The administrator needs to restore management while maintaining the security requirement. Which action should the administrator take?

Accepted Answer

Upgrade the legacy ESXi hosts to version 6.5 or later.. ESXi 6.0 only supports TLS 1.0; to use TLS 1.2, hosts must be upgraded to ESXi 6.5 or later. Option B is wrong because disabling certificate verification does not address the TLS version issue and weakens security. Option C is wrong because SSH is not used for vCenter-to-ESXi management communication. Option D is wrong because re-enabling TLS 1.0 would violate the security policy.

Answer

Disable certificate verification on the vCenter Server.

Answer

Use SSH to connect vCenter to the ESXi hosts for management.

Answer

Re-enable TLS 1.0 on the vCenter Server as a temporary workaround.

Question 12

A vSphere administrator is implementing Lockdown Mode on an ESXi host that hosts critical VMs for a healthcare application. After enabling Normal Lockdown Mode, the administrator tests that vCenter can still manage the host, but the local DCUI root account is disabled. Later, a network outage occurs, causing vCenter to become unreachable. The administrator needs to access the host directly via DCUI to perform emergency troubleshooting. The host's DCUI is still running, but the local root account is disabled due to Lockdown Mode. What should the administrator have configured to ensure DCUI access during such an outage?

Accepted Answer

Configure the DCUI access list with specific users or groups before enabling Lockdown Mode.. Normal Lockdown Mode disables the local root account for DCUI access, but it allows you to pre-configure a DCUI access list with specific users or groups (local or AD) who can still log in via DCUI. By adding a user to this list before enabling Lockdown Mode, the administrator could have gained DCUI access during the outage. Option A is incorrect because the vSphere Web Client does not have an option to add host exceptions for DCUI; the DCUI access list must be configured directly on the host or via host profile. Option C is incorrect because Strict Lockdown Mode disables all local accounts, including the DCUI access list, making DCUI entirely unavailable. Option D is incorrect because disabling Lockdown Mode requires vCenter Server access, which is unavailable during the outage.

Answer

Use the vSphere Web Client to add the host as an exception before the outage.

Answer

Enable Strict Lockdown Mode to allow vCenter access exclusively.

Answer

Disable Lockdown Mode only during the maintenance window.

Question 13

Which two actions can be performed to restrict access to the ESXi host Direct Console User Interface (DCUI)? (Choose two.)

Accepted Answer

Enable lockdown mode. Lockdown mode restricts access to the ESXi host's Direct Console User Interface (DCUI) by requiring authentication through vCenter Server and preventing direct local or SSH logins. Enabling lockdown mode (Option B) is a primary method to enforce this restriction, ensuring only authorized users via vCenter can manage the host. Setting DCUI access to 'Strict' (Option E) further tightens security by disabling the DCUI entirely for all users, including those in the exception list, except for root during initial setup.

Answer

Disable the DCUI service

Answer

Add users to the DCUI exception list

Answer

Remove the root user from the local password store

Question 14

A security team requires that all ESXi hosts in a cluster use a hardened configuration. An administrator wants to enforce a security baseline that checks for specific firewall rules, password policies, and service configurations, and automatically remediates any drift. The environment is managed by a single vCenter Server 7.0. Which vSphere feature should the administrator use to meet these requirements?

Accepted Answer

Host Profiles with a security baseline from vSphere Security Configuration Guide. Host Profiles allow you to create a standardized configuration for ESXi hosts, including security settings from the vSphere Security Configuration Guide. By attaching a host profile to a cluster, you can check compliance and automatically remediate drift. This meets the requirement for enforcing a hardened configuration with specific firewall rules, password policies, and service settings, and for auto-remediation.

Answer

vSphere Configuration Profiles

Answer

vSphere Trust Authority

Answer

vSphere Lifecycle Manager with a custom image

Question 15

An administrator is configuring role-based access control in vCenter Server 7.0. A user must be able to create and manage alarms but should not be able to modify virtual machine configurations or change permissions. The administrator creates a custom role and assigns it to the user at the datacenter level. Which privilege set must be included in the custom role to meet these requirements?

Accepted Answer

Alarms: Create alarm, Alarms: Modify alarm, Alarms: Acknowledge alarm. The custom role must include only the alarm management privileges to allow the user to create and manage alarms. Including privileges for VM configuration changes or permission modifications would grant excessive rights. The correct set is Alarms: Create alarm, Alarms: Modify alarm, and Alarms: Acknowledge alarm, which are the minimum required for alarm management.

Answer

Alarms: Create alarm, Alarms: Modify alarm, Global: Settings

Answer

Alarms: Create alarm, Virtual machine: Configuration: Modify device settings

Answer

Alarms: Create alarm, Alarms: Modify alarm, Permissions: Modify permissions