VCP-DCV vSphere Security Practice Test 4 — 15 Questions

Question 1

Which TWO of the following are required to configure vMotion encryption for a VM? (Choose two.)

Accepted Answer

The source and destination ESXi hosts must be version 6.5 or later.. Options B and D are correct. vMotion encryption requires that both source and destination ESXi hosts run version 6.5 or later (B), and the virtual machine must have virtual hardware version 11 or later (D). Option A is incorrect because vMotion encryption does not require hosts from the same vendor. Option C is incorrect because a Key Management Server (KMS) is not required for vMotion encryption; it is only required for VM-level encryption. Option E is incorrect because the VM does not need encryption enabled at the VM level for vMotion encryption; vMotion encryption is configured at the cluster or host level.

Answer

The source and destination hosts must be from the same vendor.

Answer

A Key Management Server (KMS) must be configured in vCenter.

Answer

The VM must have encryption enabled at the VM level.

Question 2

Which THREE of the following are prerequisites for configuring vSAN encryption? (Choose three.)

Accepted Answer

vSphere Enterprise Plus license.. Options A, D, and E are correct prerequisites for vSAN encryption. Option A: vSAN encryption requires a vSphere Enterprise Plus license (or equivalent, such as VMware Cloud Foundation). Option D: A Key Management Server (KMS) supporting the KMIP protocol is necessary to manage encryption keys. Option E: TPM 2.0 chip on each ESXi host provides a hardware root of trust for key storage. Option B (Intel SGX) is not required for vSAN encryption. Option C (all-flash disk group) is incorrect because vSAN encryption supports both all-flash and hybrid configurations.

Answer

Intel Software Guard Extensions (SGX) on ESXi hosts.

Answer

All-flash disk group configuration.

Question 3

An administrator runs the above command on an ESXi host. Which of the following is true about this host?

Accepted Answer

Root user can still access the DCUI or SSH using the allowed exception commands.. The command output shows that lockdown mode is enabled, root is listed as an exception user, and the allowed exception commands are 'terminal' and 'vimsh'. In normal lockdown mode (not strict), exception users retain access to the DCUI and SSH using only the permitted commands. Therefore, root can still access the DCUI or SSH via the allowed commands, making option A correct. Option B is incorrect because lockdown mode is indeed enabled. Option C is incorrect because the exception user can only run the specified commands, not any command. Option D is incorrect because the presence of exception commands indicates normal lockdown mode, not strict lockdown.

Answer

Lockdown mode is not enabled.

Answer

The exception user can run any command via the DCUI.

Answer

The host is in strict lockdown mode.

Question 4

A security administrator notices that a virtual machine (VM) running a legacy application is experiencing network connectivity issues after enabling Network I/O Control (NIOC) on the distributed switch. The VM is in a high-priority traffic class for management traffic. What is the most likely cause of the issue?

Accepted Answer

The VM is assigned to the management traffic class, but its traffic should be in a different class, causing bandwidth throttling.. NIOC traffic classes assign bandwidth shares and limits per class. If the VM's traffic (legacy application) is placed in the management traffic class, it will be subject to the bandwidth constraints of that class, which may cause connectivity issues if the application requires more bandwidth or different QoS. Option A is incorrect because NIOC does not block MAC addresses; MAC address blocking is a security policy on the distributed switch port group. Option C is incorrect because NIOC supports jumbo frames; jumbo frames are configured at the VM or vSwitch level and do not conflict with NIOC. Option D is incorrect because promiscuous mode is a port group security setting unrelated to NIOC; NIOC manages bandwidth allocation and does not interfere with promiscuous mode.

Answer

NIOC is blocking the VM's MAC address due to a security policy.

Answer

The VM is using jumbo frames, which are not supported with NIOC.

Answer

The virtual switch has promiscuous mode enabled, which conflicts with NIOC.

Question 5

During a security audit, it is discovered that a vCenter Server instance is using the default self-signed certificate. The company policy requires all certificates to be signed by an internal enterprise CA. An administrator has imported the CA chain into the VMware Endpoint Certificate Store (VECS) and generated a Certificate Signing Request (CSR). After receiving the signed certificate from the CA, which additional step is required to complete the certificate replacement?

Accepted Answer

Import the signed certificate into the appropriate VECS store and run the certificate-manager utility to update the services.. After the signed certificate is received from the CA, it must be imported into the appropriate VECS store (e.g., the machine SSL certificate store). Then, the certificate-manager utility (located at /usr/lib/vmware-vmca/bin/certificate-manager) must be run to update all vCenter services to use the new certificate. Option A is incorrect because generating a new CSR after replacement is unnecessary. Option B is incorrect because restarting the vCenter Management Agent only affects that single service, not all services that need the new certificate. Option D is incorrect because the certificate-manager utility is used for CA-signed certificates, not certool (which is for self-signed certificates).

Answer

Replace the default certificate in the VECS store with the CA-signed certificate and then generate a new CSR.

Answer

Restart the vCenter Management Agent (vma) service.

Answer

Run the certificate manager tool (certool) to generate a new self-signed certificate.

Question 6

A vSphere administrator wants to prevent users in a custom role from powering off virtual machines that have Fault Tolerance enabled. Which privilege must be removed from the custom role?

Accepted Answer

VirtualMachine.Interrupt.PowerOff. VirtualMachine.Interrupt.PowerOff. This privilege directly controls the ability to power off a virtual machine. To prevent users from powering off VMs with Fault Tolerance enabled, you must remove this privilege. Option A (Suspend) pauses the VM, option C (Reset) reboots it, and option D (PowerOn) starts it; none of these directly prevent power-off.

Answer

VirtualMachine.State.Suspend

Answer

VirtualMachine.Interrupt.Reset

Answer

VirtualMachine.Interrupt.PowerOn

Question 7

A company uses vSphere with Tanzu to run container workloads. The security team requires that all container traffic between namespaces be encrypted. What is the best approach to achieve this?

Accepted Answer

Deploy NSX-T and enable the Network Encryption feature for East-West traffic.. NSX-T's Network Encryption feature provides encryption for East-West traffic between namespaces, meeting the security requirement. Option A is incorrect because the NSX Container Plugin has been deprecated and is not the best approach. Option B is incorrect as vSAN encryption only protects data at rest, not in transit. Option D is incorrect because while Calico can encrypt traffic, it lacks the native integration and centralized management that NSX-T offers with vSphere with Tanzu.

Answer

Use the NSX Container Plugin with IPsec to encrypt traffic.

Answer

Enable vSAN encryption to encrypt data at rest and assume it covers in-transit traffic.

Answer

Install a third-party CNI like Calico with IPsec enabled.

Question 8

An administrator needs to lock down an ESXi host for FIPS 140-2 compliance. Which step must be taken?

Accepted Answer

Enable lockdown mode on the ESXi host.. For FIPS 140-2 compliance, the ESXi host must be placed in lockdown mode to restrict direct root access and ensure only authorized users via vCenter can manage the host. Option A is incorrect because disabling the ESXi Shell and SSH services alone does not achieve FIPS compliance; lockdown mode is the required step. Option C is incorrect because host profiles can apply security settings but do not enforce lockdown mode for FIPS. Option D is incorrect because FIPS mode is not configured in the host's BIOS; it is a software-level cryptographic compliance enforced by ESXi lockdown and other settings.

Answer

Disable the ESXi Shell and SSH services.

Answer

Configure a host profile with a security policy.

Answer

Enable FIPS mode in the host's BIOS.

Question 9

During a vulnerability scan, an ESXi host is found to have the SSLv3 protocol enabled. The administrator wants to disable SSLv3 and enforce TLS 1.2 for all network services on the host. Which approach is most effective?

Accepted Answer

Set the advanced system option 'SSLv3.Enabled' to false and 'TLSv1.2.Enabled' to true.. The most effective approach is to set the advanced system option 'SSLv3.Enabled' to false and 'TLSv1.2.Enabled' to true. This directly modifies the ESXi host's SSL/TLS configuration. Option A is incorrect because vCenter Server's TLS settings do not override the host's own configuration. Option B is incorrect because the DCUI does not have a direct setting to enforce TLS 1.2; it only allows basic security settings. Option C is incorrect because disabling services does not change the protocol version used by remaining services.

Answer

Update the TLS configuration in vCenter Server and reboot the host.

Answer

Change the host's security settings in the DCUI to require TLS 1.2.

Answer

Disable all unnecessary services on the host via the DCUI.

Question 10

A vSphere administrator is preparing for a PCI DSS audit. The auditor requires that all virtual machine disks be encrypted at rest. The environment uses vSAN with storage policies. Which storage policy-based management (SPBM) rule should be applied to ensure encryption?

Accepted Answer

Set the rule 'VSAN.encryption' to 'Yes'.. For vSAN encryption at rest, the storage policy rule is 'VSAN.encryption' and must be set to 'Yes' to enable encryption. Option A is incorrect because 'EncryptionEnabled' is not a valid vSAN SPBM rule. Option B is incorrect because 'SPBM.Encryption' is not a recognized rule name. Option C is incorrect because while the rule name 'VSAN.encryption' is correct, the value should be 'Yes' rather than 'Required' to enable encryption.

Answer

Set the rule 'EncryptionEnabled' to 'True'.

Answer

Set the rule 'SPBM.Encryption' to 'Enabled'.

Answer

Set the rule 'VSAN.encryption' to 'Required'.

Question 11

An administrator needs to ensure that a service account used for vCenter Server backups has the minimum required privileges. The account should only be able to perform backup and restore operations. Which role should be assigned?

Accepted Answer

BackupOperator. (BackupOperator) is correct. The BackupOperator role in vCenter Server provides the minimum required privileges to perform backup and restore operations without granting full administrative access. Option A (ReadOnly) is incorrect because it only allows read access and cannot perform backup/restore actions. Option B (Administrator) is incorrect because it grants full administrative privileges, exceeding the minimum required. Option D (NoAccess) is incorrect because it denies all permissions, preventing any backup operations.

Answer

ReadOnly

Answer

Administrator

Answer

NoAccess

Question 12

Which TWO of the following are valid methods to restrict access to the ESXi host's Direct Console User Interface (DCUI) to authorized administrators only?

Accepted Answer

Enable lockdown mode and add only authorized administrators to the Exception Users list.. Options B and D are correct. Enabling lockdown mode and adding only authorized administrators to the Exception Users list restricts DCUI access to those users. Setting the advanced option 'DCUI.Access' to a list of authorized users also restricts DCUI access. Option A is incorrect because disabling SSH does not affect DCUI access; DCUI is accessed directly from the console, not via SSH. Option C is incorrect because the root user cannot be removed from the DCUI local users list. Option E is incorrect because Active Directory integration does not restrict DCUI access.

Answer

Disable SSH access on the host to prevent remote DCUI access.

Answer

Remove the root user from the DCUI local users list.

Answer

Configure Active Directory integration and use group policy to disable DCUI.

Question 13

Which THREE of the following are required components for setting up a vSphere Trust Authority (vTA) cluster?

Accepted Answer

A dedicated Trust Authority cluster with at least one host.. Options B, D, and E are correct. A vTA deployment requires a dedicated Trust Authority cluster (B), a physical TPM on each trusted host (D), and the Attestation Service and Key Cache services (E). Option A is incorrect because a Key Provider is part of vSphere Trusted Infrastructure (vTPM) but not vTA. Option C is incorrect because NSX-T is not required for vTA.

Answer

A Key Provider, such as VMware Key Provider or an external KMS.

Answer

NSX-T Data Center deployed for network segmentation.

Question 14

Which TWO of the following are best practices for securing a vSphere environment against ransomware attacks?

Accepted Answer

Implement a backup solution with immutable snapshots and offsite storage.. The correct answers are A and D. Implement a backup solution with immutable snapshots and offsite storage (A) ensures backups cannot be deleted or encrypted by ransomware, enabling recovery. Enabling vSAN encryption (D) protects data at rest, preventing unauthorized access if storage is compromised. Option B is wrong because vMotion encryption protects data in transit during migration, not against ransomware. Option C is wrong because VM snapshots are not backups; they can be deleted by ransomware and do not provide long-term recovery. Option E is wrong because allowing all outbound traffic by default violates the principle of least privilege and increases attack surface.

Answer

Enable vMotion encryption for all migrations.

Answer

Use VM snapshots as primary backup method.

Answer

Configure the distributed firewall to allow all outbound traffic by default.

Question 15

A company runs a critical e-commerce platform on a vSphere 7 cluster with ESXi hosts connected to a vSAN datastore. The environment uses vSphere Trust Authority (vTA) and VM encryption with an external KMS. Recently, after a successful vTA attestation, one of the VMs (WebServer-01) failed to power on with the error: 'Unable to decrypt the encrypted virtual machine upon re-registration. Reason: The KMS server is unreachable.' The administrator verifies that other encrypted VMs on the same host power on successfully. The KMS cluster consists of two servers: KMS-01 and KMS-02, both accessible from the management network. The administrator checks the VM's configuration and finds that it uses a custom storage policy with encryption. What is the most likely cause of this specific VM's failure?

Accepted Answer

The VM's encryption key was retrieved from a different KMS server that is now unavailable, and the key ID in the VM's metadata points to that KMS server.. The error 'Unable to decrypt the encrypted virtual machine upon re-registration. Reason: The KMS server is unreachable' indicates that the ESXi host cannot contact the KMS server to retrieve the VM's encryption key. Since other encrypted VMs on the same host power on successfully, the host can reach the KMS cluster, but this specific VM's encryption key may have been issued by a different KMS server (e.g., an older or alternative KMS) that is now unavailable. The key ID stored in the VM's metadata points to that unreachable server, causing the failure. Option A is incorrect because if the vCenter KMS cluster configuration were deleted, all VMs would be affected. Option B is incorrect because modifying the storage policy does not change the existing encryption key; the VM remains encrypted with its original key. Option C is incorrect because vTA attestation is separate from KMS key retrieval; the error message is specific to KMS unavailability.

Answer

The vCenter Server's KMS cluster configuration has been deleted, affecting all VMs but not this one.

Answer

The storage policy used by the VM has been modified and no longer includes encryption.

Answer

The vTA attestation process failed for the VM's host, but the error message is misleading.