VCP-DCV vSphere Security Practice Test 4 — 15 Questions

Question 1

An administrator wants to enforce that all ESXi hosts in a cluster use only signed VIBs and reject any unsigned or tampered packages. The environment runs vSphere 7.0 Update 3 and uses vSphere Lifecycle Manager (vLCM) with a single image per cluster. Which action should the administrator take to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the host acceptance level to VMwareCertified or VMwareAccepted and enable code signing enforcement in the vLCM image.. The host acceptance level is the primary mechanism that enforces which VIB signatures are accepted. Setting it to VMwareCertified or VMwareAccepted ensures only VMware-signed VIBs are allowed. In vSphere 7.0 Update 3, vLCM cluster images can enforce this acceptance level across hosts, rejecting unsigned or tampered VIBs during remediation. Other measures like Secure Boot, FIPS, or Trust Authority do not directly control VIB signature acceptance.

Answer

Enable UEFI Secure Boot on each ESXi host and configure the cluster's vLCM image to include only VMware-signed VIBs.

Answer

Enable TPM measured boot and configure vSphere Trust Authority to attest each host before remediation.

Answer

Configure the ESXi firewall to block all outbound connections except to the vLCM depot, and enable FIPS mode on each host.

Question 2

An administrator needs to harden an ESXi 8 host so that only signed VIBs from VMware and trusted partners can be installed. The administrator has already enabled Secure Boot in the host firmware and confirmed that the host boots successfully. Which additional step most directly enforces VIB acceptance levels during installation?

Accepted Answer

Set the host acceptance level to 'PartnerSupported' using esxcli software acceptance set --level=PartnerSupported.. VIB acceptance levels control which signed packages an ESXi host will install. PartnerSupported permits VMware-signed and partner-signed VIBs while rejecting community and unsigned packages, matching the stated policy. VMwareCertified is stricter and would block partner VIBs, CommunitySupported is looser and permits community VIBs, and lockdown mode is unrelated to package signing. The acceptance level is set with esxcli software acceptance set and is enforced at installation time.

Answer

Set the host acceptance level to 'CommunitySupported' using esxcli software acceptance set --level=CommunitySupported.

Answer

Set the host acceptance level to 'VMwareCertified' using esxcli software acceptance set --level=VMwareCertified.

Answer

Set the host acceptance level to 'PartnerSupported' and ensure the host is in lockdown mode.

Question 3

An administrator manages a vSphere 7.0 cluster with vSphere with Tanzu enabled. The security team requires that all Kubernetes control plane traffic between the Supervisor Cluster and the NSX-T Tier-0 gateway be encrypted and authenticated. Which vSphere security feature should the administrator configure to meet this requirement?

Accepted Answer

Configure the NSX-T Tier-0 gateway with IPsec VPN for the Supervisor Cluster uplinks.. The Supervisor Cluster in vSphere with Tanzu uses NSX-T for networking. To encrypt and authenticate Kubernetes control plane traffic between the Supervisor Cluster and the NSX-T Tier-0 gateway, an IPsec VPN must be configured on that gateway. Other options address different security aspects such as host attestation, data-at-rest encryption, or traffic filtering, but none provide the required in-transit encryption and authentication for that specific communication path.

Answer

Enable vSphere Encryption on the Supervisor Cluster VMs.

Answer

Enable vSphere Trust Authority on the Supervisor Cluster.

Answer

Apply a distributed firewall rule to allow only HTTPS traffic on port 443.

Question 4

A government agency uses vSphere 8 with vSphere Trust Authority (vTA) to ensure ESXi hosts are trusted. An administrator attempts to add a new ESXi host to a trusted cluster, but the host fails attestation. The administrator verifies that the host's hardware is on the trusted host list and the TPM is enabled. Which additional step is required for the host to successfully attest?

Accepted Answer

The host must be added to the Trust Authority cluster and its TPM endorsement key must be registered with the Attestation Service.. vSphere Trust Authority requires that each host's TPM endorsement key be registered with the Attestation Service and that the host be added to the Trust Authority cluster. This registration enables the Attestation Service to verify the host's integrity. Without it, attestation fails even if hardware and TPM are correctly configured.

Answer

The host's TPM must be cleared and re-provisioned with a new endorsement key.

Answer

The host's Secure Boot must be disabled to allow the Attestation Service to read TPM measurements.

Answer

The host must be configured with a static IP address and added to the Trust Authority cluster's DNS.

Question 5

A vSphere administrator manages a cluster with ESXi 7.0 hosts. The security team requires that all ESXi hosts use encrypted connections for remote logging and that log files are protected from tampering. The administrator configures syslog to send logs to a remote server. Which additional step should be taken to meet the tamper-protection requirement?

Accepted Answer

Configure the remote syslog server to use TLS and enable log signing on the ESXi hosts.. Log signing on ESXi hosts cryptographically signs log entries, allowing detection of tampering. When combined with TLS for remote syslog, logs are encrypted in transit and signed for integrity. This directly addresses the requirement to protect logs from tampering. Other measures like Secure Boot, FIPS, or firewall rules do not provide log integrity or tamper detection for syslog data.

Answer

Set the ESXi host acceptance level to VMwareCertified and enable FIPS mode.

Answer

Enable the ESXi firewall rule for syslog and configure log rotation with a short retention period.

Answer

Enable Secure Boot and TPM measured boot on each ESXi host.

Question 6

A university's vSphere 8 environment has ESXi hosts managed by vCenter Server. The security team requires that all ESXi hosts use lockdown mode to restrict access. An administrator needs to enable lockdown mode and ensure that vCenter Server can still manage the hosts. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Ensure that the vCenter Server is configured as a trusted entity with the required permissions on the ESXi hosts.. To enable lockdown mode and maintain vCenter management, the administrator must enable lockdown mode on each host and ensure that vCenter Server has the necessary permissions to manage the hosts. The Exception Users list is not needed for vCenter, and disabling services or configuring AD authentication are separate tasks not required for this specific goal.

Answer

Disable the ESXi Shell and SSH services on each host.

Answer

Configure the ESXi hosts to use Active Directory authentication for all users.

Answer

Add the vCenter Server's root account to the Exception Users list on each host.

Question 7

A vSphere administrator needs to enforce that all ESXi hosts in a cluster use only signed VIBs and that any unsigned VIBs are rejected during installation. The environment is running vSphere 7.0 and uses vSphere Lifecycle Manager (vLCM) with a single image. Which action should the administrator take?

Accepted Answer

Configure the vLCM image to use only signed VIBs and enable 'Enforce' mode for the cluster.. To enforce that only signed VIBs are used and unsigned VIBs are rejected, the administrator should use vSphere Lifecycle Manager to create an image containing only signed VIBs and enable 'Enforce' mode on the cluster. This ensures hosts are remediated to match the image and any non-compliant or unsigned VIBs are rejected. Other options either do not address VIB signature validation during installation or lower the security posture.

Answer

Install a custom VIB acceptance policy using the esxcli software acceptance set --level=CommunitySupported command.

Answer

Enable UEFI Secure Boot on each ESXi host and enforce code signing.

Answer

Set the host's acceptance level to 'VMwareCertified' or 'VMwareAccepted' using vLCM.

Question 8

An administrator manages a vSphere 8 environment and wants to ensure that when an ESXi host is placed in lockdown mode, only vCenter Server can manage the host and direct console access is restricted. The administrator also wants to allow a specific third-party backup appliance to continue connecting to the host's ESXi Shell. Which lockdown mode configuration should the administrator choose?

Accepted Answer

Enable Normal lockdown mode and add the backup appliance's IP address to the Exception Users list.. Normal lockdown mode allows vCenter Server to manage the host while restricting direct access, and the Exception Users list provides a controlled way to allow specific accounts or services to connect directly. Strict lockdown mode is more restrictive and does not permit the same exceptions for shell access, disabling lockdown removes the management isolation, and firewall changes alone do not override lockdown mode's user restrictions. The combination of Normal lockdown mode and an Exception User entry meets the requirement.

Answer

Enable Normal lockdown mode and configure the ESXi firewall to allow the backup appliance's IP address on the ESXi Shell service.

Answer

Disable lockdown mode and rely on the ESXi firewall to block all connections except from vCenter Server and the backup appliance.

Answer

Enable Strict lockdown mode and add the backup appliance's IP address to the Exception Users list.

Question 9

An administrator is configuring role-based access control in vCenter Server. A new team requires the ability to create and manage virtual machines in a specific resource pool, but they must not be able to modify the resource pool's CPU or memory allocations. Which privilege set should be assigned to their role?

Accepted Answer

Virtual machine > Inventory > Create, Virtual machine > Inventory > Move, and Virtual machine > Configuration > Modify resource, assigned at the resource pool level, with no Resource privileges.. The principle of least privilege requires granting only the permissions needed. Creating and managing VMs in a resource pool requires VM inventory and configuration privileges, but not resource pool modification privileges. Assigning these at the resource pool level scopes them appropriately. Omitting Resource > Modify resource pool ensures the team cannot change CPU or memory allocations, satisfying the requirement.

Answer

Resource > Modify resource pool and Virtual machine > Inventory > Create, assigned at the data center level.

Answer

Virtual machine > Inventory > Create and Virtual machine > Configuration > Modify device settings, assigned at the resource pool level.

Answer

Resource > Assign resource pool and Virtual machine > Inventory > Create, assigned at the resource pool level.

Question 10

A vSphere environment uses Active Directory for authentication. The administrator notices that users from a specific AD group cannot log in to the vCenter Server, although other AD users can. The group is added to vCenter Server with the correct permissions. What is the most likely cause?

Accepted Answer

The domain of the group is not configured as an identity source in vCenter Single Sign-On. The most likely cause is that the domain of the group is not configured as an identity source in vCenter Single Sign-On. Even if the group is added with correct permissions in vCenter Server, vCenter SSO must be able to authenticate users against the domain. Without the domain listed as an identity source, vCenter cannot validate the credentials of users from that group, causing authentication failures for all users in that domain.

Answer

The users are not members of the vCenter Single Sign-On domain

Answer

The user accounts have expired passwords

Answer

The group is nested within another group

Question 11

A multinational corporation runs a vSphere environment with 100 ESXi hosts managed by a single vCenter Server. The security team mandates that all virtual machine disks (VMDKs) must be encrypted at rest. The administrator enables vSphere Virtual Machine Encryption and creates a Key Management Server (KMS) cluster. After encrypting a test VM, the VM powers on successfully, but the administrator notices that the VM's configuration files (VMX, NVRAM) are not encrypted. The security policy requires that all VM files, including configuration files, be encrypted. The administrator checks the VM storage policy and sees that the policy is set to 'VM Encryption Policy' with 'Disk Encryption' enabled. What should the administrator do to ensure the entire VM is encrypted?

Accepted Answer

Modify the VM storage policy to include encryption of VM home files. The VM storage policy 'VM Encryption Policy' with only 'Disk Encryption' enabled encrypts VMDK files but not the VM configuration files (VMX, NVRAM, logs, etc.). To encrypt all VM files, the storage policy must include the 'Encrypt VM home files' option, which applies encryption to the entire VM home directory on the datastore. This ensures compliance with the security mandate for full VM encryption at rest.

Answer

Enable encryption on the datastore where the VM resides

Answer

Add a second KMS cluster for redundancy

Answer

Enable vSphere Host Encryption on each ESXi host

Question 12

A vSphere administrator needs to ensure that all virtual machine disks are encrypted at rest. The environment uses a KMS cluster with multiple KMIP-compliant servers. The administrator has already configured a storage policy with encryption enabled. However, newly created VMs on a particular datastore still show unencrypted disks. What is the most likely cause?

Accepted Answer

The storage policy with encryption is not assigned to the VMs or their home namespace.. Even when a storage policy with encryption is configured, it must be explicitly assigned to the VMs or their home namespace (the VM's configuration and swap files). If the policy is not assigned, the VM will be created using the default datastore policy, which typically does not include encryption, resulting in unencrypted disks. The administrator must ensure the encryption-enabled policy is applied to the VM during creation or via a storage policy-based management (SPBM) assignment.

Answer

The datastore is a vSAN datastore, which does not support VM-level encryption.

Answer

The KMS cluster must have at least two KMS servers to function correctly.

Answer

The datastore is formatted with VMFS6, which does not support encryption.

Question 13

An administrator is troubleshooting a failed attempt to add an ESXi host to a vCenter Server domain. The error message states: 'The host's certificate has been tampered with or is invalid.' What is the most likely cause?

Accepted Answer

The ESXi host's certificate thumbprint does not match the thumbprint stored in vCenter Server.. The error 'The host's certificate has been tampered with or is invalid' occurs when the ESXi host presents a certificate whose thumbprint does not match the thumbprint that vCenter Server has stored for that host. This mismatch can happen if the host's certificate was replaced (e.g., due to a reinstall or manual rotation) without updating the vCenter Server's trusted store. vCenter Server verifies the host's identity by comparing the SHA-1 or SHA-256 thumbprint of the presented certificate against its stored record; a mismatch triggers this specific error.

Answer

The vCenter Server's account lockout policy has been triggered.

Answer

The ESXi host's SSH keys have been rotated.

Answer

The ESXi host's certificate has expired.

Question 14

A large financial institution runs a vSphere 7.0 environment with 100 ESXi hosts and 2,000 VMs. The security team has identified that several VMs are vulnerable to a critical side-channel attack that requires disabling hyperthreading on the ESXi hosts. The administrator needs to implement a solution that minimizes performance impact while ensuring compliance. The environment uses DRS clusters with varying workloads: some VMs are CPU-intensive (financial modeling) and others are memory-bound (database servers). The administrator cannot afford to take hosts offline for maintenance during business hours. The change must be implemented within 48 hours. Which course of action should the administrator take?

Accepted Answer

Place each host in maintenance mode individually, disable hyperthreading in the host BIOS, reboot the host, and then move to the next host. Rebalance VMs after all hosts are updated.. Disabling hyperthreading to mitigate side-channel attacks (e.g., L1TF or MDS) requires a host BIOS change, which necessitates a reboot. The only supported method in vSphere 7.0 is to place each host into maintenance mode, change the BIOS setting, reboot, and then repeat for all hosts. This approach minimizes performance impact by allowing VMs to be migrated via vMotion and avoids simultaneous downtime, meeting the 48-hour requirement without taking all hosts offline during business hours.

Answer

Use a vSphere DRS rule to disable hyperthreading for all VMs in the cluster, avoiding the need to modify host BIOS.

Answer

Delay the change and schedule a maintenance window for the next month when business impact is lower.

Answer

Disable hyperthreading on all hosts simultaneously using a vSphere Cluster feature, then reboot all hosts at once during off-peak hours.

Question 15

A company is implementing vSphere 7.0 and wants to encrypt all vMotion traffic between ESXi hosts in a cluster. The cluster is not using any other encryption features. What is the minimum requirement to enable vMotion encryption?

Accepted Answer

The ESXi hosts must have a host profile applied with encryption enabled.. In vSphere 7.0, enabling vMotion encryption does not require Active Directory, a Key Management Server, Enhanced vMotion Compatibility (EVC), or host profiles. The minimum requirement is simply to configure the vMotion encryption policy on each ESXi host (set to 'Required' or 'Opportunistic'). No additional infrastructure or profiles are needed.

Answer

A VM Encryption Key Management Server must be configured.

Answer

The ESXi hosts must be joined to an Active Directory domain.

Answer

The cluster must be configured with Enhanced vMotion Compatibility (EVC).