VCP-DCV vSphere Security Practice Test 4 — 15 Questions

Question 1

An administrator runs the above command on an ESXi host. Which of the following is true about this host?

Accepted Answer

Root user can still access the DCUI or SSH using the allowed exception commands.. Option B is correct because the command shows lockdown mode is enabled, root is an exception user, and the exception commands allow terminal access and vimsh. Option A is incorrect because root is in exception list. Option C is incorrect because the host is in normal lockdown, not strict. Option D is incorrect because the commands allowed are terminal and vimsh, not all commands.

Answer

Lockdown mode is not enabled.

Answer

The exception user can run any command via the DCUI.

Answer

The host is in strict lockdown mode.

Question 2

A security administrator notices that a virtual machine (VM) running a legacy application is experiencing network connectivity issues after enabling Network I/O Control (NIOC) on the distributed switch. The VM is in a high-priority traffic class for management traffic. What is the most likely cause of the issue?

Accepted Answer

The VM is assigned to the management traffic class, but its traffic should be in a different class, causing bandwidth throttling.. Option B is correct. NIOC traffic classes limit bandwidth per class; if the VM is in the wrong class (management instead of the correct class for its traffic), it may be throttled. Option A is incorrect because NIOC does not require jumbo frames. Option C is incorrect because NIOC does not affect MAC learning. Option D is incorrect because NIOC does not block promiscuous mode; that's a security policy.

Answer

NIOC is blocking the VM's MAC address due to a security policy.

Answer

The VM is using jumbo frames, which are not supported with NIOC.

Answer

The virtual switch has promiscuous mode enabled, which conflicts with NIOC.

Question 3

During a security audit, it is discovered that a vCenter Server instance is using the default self-signed certificate. The company policy requires all certificates to be signed by an internal enterprise CA. An administrator has imported the CA chain into the VMware Endpoint Certificate Store (VECS) and generated a Certificate Signing Request (CSR). After receiving the signed certificate from the CA, which additional step is required to complete the certificate replacement?

Accepted Answer

Import the signed certificate into the appropriate VECS store and run the certificate-manager utility to update the services.. Option D is correct. After importing the signed certificate into VECS, the administrator must update vCenter services to use the new certificate. Option A is incorrect because restarting the Management Agent is not the proper step. Option B is incorrect because certool is used for creating self-signed certificates, not for importing signed ones. Option C is incorrect because it reverses the process.

Answer

Replace the default certificate in the VECS store with the CA-signed certificate and then generate a new CSR.

Answer

Restart the vCenter Management Agent (vma) service.

Answer

Run the certificate manager tool (certool) to generate a new self-signed certificate.

Question 4

A vSphere administrator wants to prevent users in a custom role from powering off virtual machines that have Fault Tolerance enabled. Which privilege must be removed from the custom role?

Accepted Answer

VirtualMachine.Interrupt.PowerOff. Option A is correct. The 'Power Off' privilege directly controls the ability to power off a VM. Option B is incorrect because 'Power On' is a separate action. Option C is incorrect; 'Reset' also powers off but is not the primary control. Option D is incorrect because 'Suspend' is not powering off.

Answer

VirtualMachine.State.Suspend

Answer

VirtualMachine.Interrupt.Reset

Answer

VirtualMachine.Interrupt.PowerOn

Question 5

An organization is using vSphere Trust Authority (vTA) to secure ESXi hosts. A newly added ESXi host fails to attest with the Trust Authority. The administrator verifies that the host is connected to the vTA cluster and the trust relationship is configured. What is the most likely cause of the attestation failure?

Accepted Answer

The TPM on the ESXi host is disabled or not properly initialized.. Option D is correct. The host's TPM must be enabled and properly configured for vTA attestation. Option A is incorrect because the host can be in a different cluster as long as it's trusted. Option B is incorrect because vTA uses TPM, not vTPM. Option C is incorrect because the trusted infrastructure hosts do not require special networking beyond connectivity.

Answer

The Trust Authority's network is isolated from the ESXi host's management network.

Answer

The ESXi host is not in the same cluster as the Trust Authority.

Answer

The ESXi host does not have a virtual Trusted Platform Module (vTPM) attached.

Question 6

A company uses vSphere with Tanzu to run container workloads. The security team requires that all container traffic between namespaces be encrypted. What is the best approach to achieve this?

Accepted Answer

Deploy NSX-T and enable the Network Encryption feature for East-West traffic.. Option A is correct. NSX-T provides micro-segmentation and encryption for container traffic. Option B is incorrect because vSAN encryption protects data at rest, not in transit. Option C is incorrect because the NSX Container Plugin has been deprecated in favor of NSX-T. Option D is incorrect because Calico is not native and does not offer the same integration with vSphere with Tanzu.

Answer

Use the NSX Container Plugin with IPsec to encrypt traffic.

Answer

Enable vSAN encryption to encrypt data at rest and assume it covers in-transit traffic.

Answer

Install a third-party CNI like Calico with IPsec enabled.

Question 7

An administrator needs to lock down an ESXi host for FIPS 140-2 compliance. Which step must be taken?

Accepted Answer

Enable lockdown mode on the ESXi host.. Option C is correct. The ESXi host must be placed in lockdown mode to restrict direct access. Option A is incorrect because SSH can still be used even if the shell is disabled; lockdown mode disables both. Option B is incorrect because host profiles help configure but do not enforce lockdown. Option D is incorrect because FIPS mode is a separate configuration.

Answer

Disable the ESXi Shell and SSH services.

Answer

Configure a host profile with a security policy.

Answer

Enable FIPS mode in the host's BIOS.

Question 8

During a vulnerability scan, an ESXi host is found to have the SSLv3 protocol enabled. The administrator wants to disable SSLv3 and enforce TLS 1.2 for all network services on the host. Which approach is most effective?

Accepted Answer

Set the advanced system option 'SSLv3.Enabled' to false and 'TLSv1.2.Enabled' to true.. Option D is correct. The ESXi host's SSL/TLS configuration can be controlled via the Host Advanced Settings by setting the appropriate option to require TLS 1.2. Option A is incorrect because disabling services does not change the protocol. Option B is incorrect because the vCenter's TLS configuration does not directly affect the host's. Option C is incorrect because there is no direct setting in the DCUI for this.

Answer

Update the TLS configuration in vCenter Server and reboot the host.

Answer

Change the host's security settings in the DCUI to require TLS 1.2.

Answer

Disable all unnecessary services on the host via the DCUI.

Question 9

A vSphere administrator is preparing for a PCI DSS audit. The auditor requires that all virtual machine disks be encrypted at rest. The environment uses vSAN with storage policies. Which storage policy-based management (SPBM) rule should be applied to ensure encryption?

Accepted Answer

Set the rule 'VSAN.encryption' to 'Yes'.. Option A is correct. vSAN storage policies include a rule for encryption; setting it to 'Yes' ensures all VMs using that policy are encrypted. Option B is incorrect because 'SPBM.Encryption' is not a valid rule. Option C is incorrect because 'EncryptionEnabled' is not a standard rule. Option D is incorrect because the rule must be set to 'Yes' to enable encryption.

Answer

Set the rule 'EncryptionEnabled' to 'True'.

Answer

Set the rule 'SPBM.Encryption' to 'Enabled'.

Answer

Set the rule 'VSAN.encryption' to 'Required'.

Question 10

An administrator needs to ensure that a service account used for vCenter Server backups has the minimum required privileges. The account should only be able to perform backup and restore operations. Which role should be assigned?

Accepted Answer

BackupOperator. Option D is correct. The 'BackupOperator' role (or 'VR Backup Operator' in some contexts) provides the necessary permissions for backup/restore. Option A is incorrect because 'Administrator' has full access. Option B is incorrect because 'ReadOnly' cannot perform backups. Option C is incorrect because 'NoAccess' denies all permissions.

Answer

ReadOnly

Answer

Administrator

Answer

NoAccess

Question 11

Which TWO of the following are valid methods to restrict access to the ESXi host's Direct Console User Interface (DCUI) to authorized administrators only?

Accepted Answer

Enable lockdown mode and add only authorized administrators to the Exception Users list.. Options A and D are correct. Lockdown mode disables DCUI access if not in Exception Users list; configuring DCUI.Access advanced option restricts which users can access the DCUI. Option B is incorrect because root user cannot be removed from the DCUI. Option C is incorrect because Active Directory integration does not restrict DCUI. Option E is incorrect because SSH access is separate from DCUI.

Answer

Disable SSH access on the host to prevent remote DCUI access.

Answer

Remove the root user from the DCUI local users list.

Answer

Configure Active Directory integration and use group policy to disable DCUI.

Question 12

Which THREE of the following are required components for setting up a vSphere Trust Authority (vTA) cluster?

Accepted Answer

A dedicated Trust Authority cluster with at least one host.. Options A, C, and D are correct. vTA requires at least one trusted ESXi host, a Trust Authority cluster, and an attestation service. Option B is incorrect because a Key Provider is part of vSphere Trusted Infrastructure (vTPM) but not vTA. Option E is incorrect because NSX is not required for vTA.

Answer

A Key Provider, such as VMware Key Provider or an external KMS.

Answer

NSX-T Data Center deployed for network segmentation.

Question 13

Which TWO of the following are best practices for securing a vSphere environment against ransomware attacks?

Accepted Answer

Implement a backup solution with immutable snapshots and offsite storage.. Options A and C are correct. Enabling vSAN encryption protects data at rest; using backup software with immutable backups prevents deletion. Option B is incorrect because egress filtering is not default. Option D is incorrect because snapshots are not backups and can be deleted. Option E is incorrect because vMotion is for migration, not security.

Answer

Enable vMotion encryption for all migrations.

Answer

Use VM snapshots as primary backup method.

Answer

Configure the distributed firewall to allow all outbound traffic by default.

Question 14

A company runs a critical e-commerce platform on a vSphere 7 cluster with ESXi hosts connected to a vSAN datastore. The environment uses vSphere Trust Authority (vTA) and VM encryption with an external KMS. Recently, after a successful vTA attestation, one of the VMs (WebServer-01) failed to power on with the error: 'Unable to decrypt the encrypted virtual machine upon re-registration. Reason: The KMS server is unreachable.' The administrator verifies that other encrypted VMs on the same host power on successfully. The KMS cluster consists of two servers: KMS-01 and KMS-02, both accessible from the management network. The administrator checks the VM's configuration and finds that it uses a custom storage policy with encryption. What is the most likely cause of this specific VM's failure?

Accepted Answer

The VM's encryption key was retrieved from a different KMS server that is now unavailable, and the key ID in the VM's metadata points to that KMS server.. Option B is correct. The VM's encryption key is cached on the host only if it was previously powered on; if the host was rebooted or the cache cleared, it must fetch the key from KMS. The error indicates the KMS is unreachable for this VM, but other VMs work, suggesting the host can reach KMS. However, if the VM's encryption key is associated with an older KMS key ID that is no longer present or the KMS server specified in the VM's configuration is different (e.g., from a previous KMS setup), the host may try to contact a different KMS server. Option A is incorrect because vTA attestation is separate. Option C is incorrect because the storage policy is in use. Option D is incorrect because vCenter SSO is not involved in decryption.

Answer

The vCenter Server's KMS cluster configuration has been deleted, affecting all VMs but not this one.

Answer

The storage policy used by the VM has been modified and no longer includes encryption.

Answer

The vTA attestation process failed for the VM's host, but the error message is misleading.

Question 15

A vSphere administrator needs to restrict access to a specific cluster so that only the storage team can manage datastores. The storage team members are in a group called 'storage_team' in Active Directory. What is the best practice to achieve this?

Accepted Answer

Create a custom role with required Datastore privileges and assign it to the 'storage_team' group at the cluster level.. Option A is correct because creating a custom role with Datastore privileges and assigning it at the cluster level provides the most granular and least-privileged access. Option B is wrong because global permissions apply to all objects, granting too broad access. Option C is wrong because the Administrator role grants full access, violating the principle of least privilege. Option D is wrong because SSO groups do not define privileges; they must be linked to a role.

Answer

Create an SSO group for the storage team and assign the default 'ReadOnly' role at the cluster level.

Answer

Assign the 'storage_team' group a role with Datastore privileges at the vCenter level using global permissions.

Answer

Add each member of the storage team to the local Administrators group on the vCenter Server.

VCP-DCV vSphere Security Practice Test 4 — 15 Questions

Exhibit

VCP-DCV vSphere Security Practice Test 4 — 15 Questions

Exhibit