VCP-DCV vSphere Security Practice Test 3 — 15 Questions

Question 1

Which THREE security hardening measures should be applied to an ESXi host? (Choose three.)

Accepted Answer

Enable lockdown mode. Options B, D, and E are correct. Enabling lockdown mode restricts direct root access to the ESXi host via the DCUI, enhancing security. Applying a host profile ensures consistent security configurations across hosts. Disabling ESXi Shell and SSH services reduces the attack surface by eliminating remote CLI access. Option A is incorrect because increasing memory resource allocation for management VMs does not directly improve security; it is a resource management practice. Option C is incorrect because although SNMPv3 provides authentication and encryption, enabling SNMP services is not a standard hardening measure and is often disabled to reduce the attack surface.

Answer

Increase memory resource allocation for management VMs

Answer

Enable SNMP v3

Question 2

Which TWO statements about vCenter Single Sign-On (SSO) are true? (Choose two.)

Accepted Answer

It supports multiple identity sources such as Active Directory and LDAP. vCenter Single Sign-On (SSO) allows users to authenticate using multiple identity sources, including Active Directory and LDAP, making option A correct. SSO uses SAML 2.0 tokens for secure authentication between vCenter services, so option E is correct. Option B is incorrect because SSO does not primarily use Kerberos for user authentication to vCenter; it uses SAML tokens. Option C is false as SSO never stores passwords in plaintext; they are hashed. Option D is wrong because SSO can function without a Windows Active Directory domain; it supports multiple identity sources.

Answer

It uses Kerberos to authenticate users to vCenter Server

Answer

It stores user passwords in plaintext for faster authentication

Answer

It requires a Windows Active Directory domain to function

Question 3

An administrator runs the command shown in the exhibit on a vCenter Server appliance. What is the primary purpose of the Machine ID?

Accepted Answer

To serve as a unique identifier for the vCenter Server instance in SSO. The Machine ID serves as a unique identifier for the vCenter Server instance within VMware SSO (Single Sign-On) and is used for certificate management. It is not related to workload distribution in DRS (option A), ESXi host identification (option B), or virtual machine identification for vMotion (option D). Therefore, option C is correct.

Answer

To calculate workload distribution in DRS

Answer

To identify an ESXi host to vCenter Server

Answer

To uniquely identify a virtual machine for vMotion

Question 4

An administrator notices that HTTP connections to the ESXi host are timing out frequently. Based on the exhibit, which configuration change would most likely resolve the issue?

Accepted Answer

Increase maxKeepAliveTimeout to a higher value, such as 180. The maxKeepAliveTimeout default of 100 seconds may be too low for long-lived HTTP connections, causing timeouts. Increasing it to 180 seconds allows the server to keep idle connections open longer, reducing the likelihood of timeouts. Option B is incorrect because restarting the rhttpproxy service does not change the timeout value; it only temporarily resets the service, which would not address the underlying timeout issue. Option C is incorrect because enabling a proxy server is unrelated to HTTP connection timeouts; it would add an intermediary but not resolve the keepalive timeout. Option D is incorrect because setting maxKeepAliveTimeout to 0 disables HTTP keepalive entirely, which would force new connections for every request, likely increasing latency and timeouts rather than resolving them.

Answer

Restart the rhttpproxy service

Answer

Set useProxy to true and specify a proxy server

Answer

Set maxKeepAliveTimeout to 0 to disable keepalive

Question 5

An administrator configures permissions as shown in the exhibit. Users 'user1' and 'user2' are in the 'Limited' role which only allows 'Read' and 'Console interaction' privileges. User1 reports being unable to open a console to a VM running on host2.domain.com. What is the most likely cause?

Accepted Answer

User1 does not have permissions on host2.domain.com. User1 has permissions only on host1, not on host2.domain.com. The 'Limited' role, which includes 'Read' and 'Console interaction' privileges, is assigned at the host level for host1 only, so it does not apply to host2. Therefore, user1 lacks any permissions on host2, preventing console access to VMs running there. Option A is incorrect because the 'Limited' role does include 'Console interaction' privilege as stated. Option C is incorrect because the permissions are applied at the host level (as shown in the exhibit), not at the datacenter level. Option D is incorrect because there is no requirement or indication that user1 needs to be added to the admin group; the issue is simply lack of permissions on the target host.

Answer

The 'Limited' role does not include 'Console interaction' privilege

Answer

The permissions are applied at the datacenter level, not the host level

Answer

User1 should be added to the admin group

Question 6

An administrator wants to prevent direct root access to an ESXi host via SSH and the DCUI. Which two configurations are necessary?

Accepted Answer

Enable lockdown mode and remove root from permissions.. Enabling lockdown mode on an ESXi host disables direct root access via SSH and DCUI. Additionally, removing the root user from the permissions list ensures that root cannot be granted access through exception lists. Option A is wrong because setting lockdown mode with root exception would still allow root access under specific circumstances. Option B is wrong because disabling DCUI and SSH services does not prevent root access via other means (e.g., vCenter) and does not enforce persistent restriction. Option C is wrong because configuring SSO with Smart Card authentication does not affect local root access at the ESXi host level.

Answer

Set the host to lockdown mode with root exception.

Answer

Disable DCUI and SSH services.

Answer

Configure SSO to require Smart Card authentication.

Question 7

A company requires all vMotion traffic to be encrypted. The vSphere administrator enables vMotion encryption at the cluster level. What else must be configured to ensure vMotion operations are encrypted?

Accepted Answer

Ensure all VMs have virtual hardware version 11 or later.. For vMotion encryption to work, the virtual machine must have hardware version 11 or later. This requirement is documented for vSphere 6.5 and later, which support vMotion encryption. Option A is incorrect because there is no requirement to allocate additional memory for vMotion encryption; cryptographic operations for vMotion are handled by the host's CPU. Option B is incorrect because vMotion encryption is supported on ESXi 6.5 and later, not specifically version 7.0 or later. Option C is incorrect because VM Encryption is a separate feature that encrypts the VM's files at rest, not vMotion traffic. Therefore, ensuring VMs have virtual hardware version 11 or later is necessary for encrypted vMotion.

Answer

Allocate at least 4 GB of additional memory for cryptographic operations.

Answer

Upgrade all ESXi hosts to version 7.0 or later.

Answer

Enable VM Encryption also.

Question 8

A vSphere administrator notices that after replacing the vCenter Server machine SSL certificate, all vCenter services start, but from one ESXi host, the vCenter Server appears as disconnected. Other hosts connect fine. What is the most likely cause?

Accepted Answer

The ESXi host does not trust the signing certificate authority of the new vCenter certificate.. When the vCenter Server machine SSL certificate is replaced, each ESXi host must trust the certificate's issuing CA. If one host's trusted root certificate store does not contain the new certificate's CA certificate, TLS verification fails, causing vCenter to appear disconnected from that host. Option A is incorrect because the Common Name is used for server identity, but it does not need to match the host's IP; the issue is trust of the CA, not name mismatch. Option C is incorrect because system time differences would affect all hosts, not just one, and typically cause certificate validity errors, not trust issues. Option D is incorrect because the machine SSL certificate is distinct from SSO certificates; replacing it does not affect SSO if other certificates are unchanged.

Answer

The vCenter certificate's Common Name does not match the host's IP address.

Answer

The ESXi host has a different system time than the vCenter Server.

Answer

The vCenter Server certificate was not imported into the SSO trusted domain.

Question 9

An administrator needs to grant a group of vSphere administrators the ability to create and delete snapshots, and also to power on and off VMs, but not to delete VMs. The administrators should also be able to view the virtual machine console. Which custom role should be created?

Accepted Answer

Snapshot creation/removal, Power operations, VirtualMachine.Interact.ConsoleInteraction. It includes the necessary snapshot creation/removal and power operations, as well as VirtualMachine.Interact.ConsoleInteraction for console access, without including Delete VM or Remove Disk privileges. Option A includes Delete VM, which is not desired. Option C lacks snapshot management. Option D includes Remove Disk, which is not required.

Answer

Snapshot creation/removal, Power operations, Delete VM, ConsoleInteraction

Answer

Power operations, ConsoleInteraction only

Answer

Snapshot creation/removal, Power operations, Remove Disk, ConsoleInteraction

Question 10

An administrator wants to configure the ESXi host firewall to allow connections only from a specific management subnet. How can this be achieved?

Accepted Answer

Use the ESXi firewall settings to define allowed IP addresses for the required services.. The ESXi host firewall can be configured with rule sets that allow traffic only from specific IP addresses or subnets. This is done by editing the firewall rules for the required services and specifying the allowed IP addresses. Option A is incorrect because vSphere HA is a high availability feature that does not manage firewall settings or control management traffic. Option C is incorrect because the DCUI (Direct Console User Interface) is used for local console configuration, not for setting firewall rules. Option D is incorrect because allowing all incoming connections would be insecure and not restrict access to a specific management subnet.

Answer

Enable vSphere HA and set it to control management traffic.

Answer

Configure the DCUI to restrict management access.

Answer

Set the firewall to enabled and allow all incoming connections.

Question 11

A vSphere environment uses vSAN and has VM encryption enabled. The administrator needs to recover a VM after an encrypted disk becomes corrupted. What is required?

Accepted Answer

The key management server (KMS) and the KEK/Rekey.. Recovering a VM from a corrupted encrypted disk in a vSAN environment with VM encryption enabled requires access to the key management server (KMS) and the encryption keys (KEK/Rekey). Without these keys, the encrypted data cannot be decrypted. Option A is incorrect because the vSAN health service monitors vSAN health but does not provide cryptographic keys. Option B is incorrect because a backup of VM files alone is insufficient; the backup would still be encrypted and require the same keys to restore. Option D is incorrect because the VM's storage policy defines properties like encryption, but the policy itself does not contain the actual encryption keys needed for recovery.

Answer

The vSAN health service.

Answer

A recent backup of the VM files.

Answer

The VM’s storage policy.

Question 12

During a security audit, it is found that the vCenter Server is using the default self-signed certificate. The administrator is tasked to replace it with a certificate from an enterprise CA. What is the first step after obtaining the CA-signed certificate?

Accepted Answer

Convert the certificate and private key into PEM format and place them in the appropriate directory.. The certificate must be in a format that vCenter can use; typically, it needs to be combined with the private key. Option B is premature before preparing the certificate. Option C is incorrect because certificate import is done via certificate management tools, not vSphere Web Client. Option D is incorrect because the private key is included in the signed certificate generation process, not imported separately.

Answer

Use the vSphere Web Client to upload the certificate.

Answer

Import the private key into the Windows Certificate Store.

Answer

Restart the VMware Certificate Service.

Question 13

An administrator wants to ensure that no user can view or modify VMs in a particular folder except the folder owner. What is the proper method to achieve this?

Accepted Answer

On the folder, assign permissions to the folder owner with the desired role and ensure propagation is set to 'All children'.. Assigning the folder owner the desired role on the folder with propagation set to 'All children' grants permissions to the folder and all VMs within it, while other users without explicit permissions cannot view or modify the VMs. Option A is incorrect because 'No Access' on the folder for all other users would block their access but does not grant the folder owner access unless also assigned. Option B is incorrect because the Administrator role is too broad and grants full administrative rights beyond the folder. Option C is incorrect because a global role applies across the entire vCenter, not just a specific folder, and cannot be limited to a single folder owner.

Answer

Use the No Access permission on the folder for all other users.

Answer

Assign the folder owner with Administrator role on the folder.

Answer

Create a global role that denies access to all VMs except the folder owner.

Question 14

A company uses an external Platform Services Controller (PSC) in a vSphere 6.7 environment. They plan to upgrade to vSphere 7.0. Which security-related consideration is most important?

Accepted Answer

The external PSC is deprecated; it must be converged into the vCenter Server.. VSphere 7.0 removes the external PSC model; all services are embedded. Option A is incorrect because there is no migration wizard for external PSC to embedded, but does not default to AD. Option C is incorrect because vSphere 7.0 still uses VECS. Option D is incorrect because STS certificates can be managed within the embedded PSC.

Answer

The external PSC will automatically convert to an embedded PSC during upgrade.

Answer

The SSL certificates for the PSC must be reissued from a new CA.

Answer

The STS certificates need to be replaced with custom ones immediately after upgrade.

Question 15

Which TWO of the following are best practices for securing ESXi hosts? (Choose two.)

Accepted Answer

Enable lockdown mode on the host.. Options C and E are correct. Enabling lockdown mode (C) restricts direct root access to the host, requiring administrators to use vCenter Server for management, which is a security best practice. Configuring Active Directory integration (E) allows centralized user management and authentication, avoiding the need for local accounts. Option A is incorrect because granting root user direct permissions on all hosts bypasses security controls. Option B is incorrect because disabling the ESXi firewall exposes the host to network threats. Option D is incorrect because DCUI (Direct Console User Interface) should be accessed only via the local console, not from the network; allowing DCUI access from trusted management networks still poses a security risk.

Answer

Grant the root user direct permissions on all hosts.

Answer

Disable the ESXi firewall to simplify management.

Answer

Allow DCUI access from trusted management networks.