VCP-DCV vSphere Security Practice Test 5 — 15 Questions

Question 1

Order the steps to take a snapshot of a virtual machine.

Accepted Answer

Initiate snapshot, name it, choose memory and quiesce options, then confirm.. The correct order for taking a snapshot in VMware vSphere is to first initiate the snapshot by right-clicking the VM and selecting 'Snapshot > Take Snapshot', then in the dialog provide a name and optional description, select whether to snapshot the virtual machine's memory and whether to quiesce the file system, and finally confirm by clicking OK. This sequence ensures that all necessary parameters are set before the snapshot is created.

Answer

Initiate snapshot, choose memory and quiesce options, name it, then confirm.

Answer

Name the snapshot, initiate snapshot, choose memory and quiesce options, then confirm.

Answer

Initiate snapshot, confirm, then name it and choose memory and quiesce options.

Question 2

A company wants to integrate vCenter Server with an external identity source to allow users to authenticate using their corporate credentials. The administrator must ensure that authentication traffic is encrypted. Which solution should the administrator implement?

Accepted Answer

Active Directory over LDAPS. Active Directory over LDAPS uses LDAP over SSL/TLS, which encrypts authentication traffic between vCenter Server and the AD domain controller. This meets the requirement for encrypted authentication. LDAPS typically uses port 636 and requires proper certificates on the domain controllers. This is the correct solution for integrating vCenter with an external identity source while ensuring encryption.

Answer

Local OS authentication on vCenter Server

Answer

Active Directory over NTLM

Answer

Active Directory over LDAP

Question 3

An organization is implementing vSphere Trust Authority for sensitive workloads. The administrator must configure the trusted ESXi hosts to attest to vCenter Server. Which component is responsible for performing attestation?

Accepted Answer

A separate vCenter Server instance acting as the Trust Authority. VSphere Trust Authority uses a dedicated vCenter Server instance (Trust Authority vCenter) to perform attestation of ESXi hosts. Option A is incorrect because the administrator's workstation is not part of the trust chain and does not perform attestation. Option C is incorrect because the Key Provider (KMS) server is used for encryption key management, not for host attestation. Option D is incorrect because the trusted ESXi hosts themselves are the subjects of attestation; they do not perform attestation.

Answer

The administrator's workstation

Answer

The Key Provider (KMS) server

Answer

The trusted ESXi hosts themselves

Question 4

A vSphere administrator wants to restrict direct console access to an ESXi host to authorized administrators only, without interrupting running virtual machines. Which feature should the administrator enable?

Accepted Answer

Lockdown mode. Lockdown mode restricts direct console access to an ESXi host to only users with administrator privileges, while allowing running VMs to continue unaffected. It enforces that all management access must go through vCenter Server, enhancing security without disrupting workloads.

Answer

Enable DRS

Answer

Configure a host profile

Answer

Disable SSH service

Question 5

Which TWO actions are required to enable vSphere VM encryption? (Choose two.)

Accepted Answer

Configure a Key Management Server (KMS) or native key provider. vSphere VM encryption requires a key provider to supply the encryption keys, so option A is correct: you must configure a Key Management Server (KMS) or a vSphere Native Key Provider and add it to the vCenter Server before any VM can be encrypted. Option D is also correct because, after the key provider is trusted, you must actually apply encryption by assigning a VM encryption storage policy to the virtual machine (or enabling encryption on the VM), which triggers the encryption of the VM's files and disks. Option B is not required: SSH access to ESXi hosts is not used to manage encryption keys, since key management is handled through the KMS/Native Key Provider and vCenter. Option C is not required: vMotion remains fully supported with encrypted VMs and does not need to be disabled. Option E is not required: lockdown mode is a security hardening setting for host access and has no role in enabling VM encryption.

Answer

Enable SSH on each ESXi host to manage encryption keys

Answer

Disable vMotion on the cluster

Answer

Place the ESXi hosts in lockdown mode

Question 6

Which THREE security hardening measures should be applied to an ESXi host? (Choose three.)

Accepted Answer

Enable lockdown mode. Option B is correct because enabling lockdown mode restricts direct root access to an ESXi host, forcing all administrative actions through vCenter Server or an authorized privileged account, which reduces the attack surface from unauthorized local or remote logins. Option D is correct because applying a host profile enforces a consistent, validated set of security configuration settings (such as firewall rules, services, and authentication policies) across ESXi hosts, preventing configuration drift that could introduce vulnerabilities. Option E is correct because disabling the ESXi Shell and SSH services closes unneeded remote-access channels that attackers could exploit; these services should only be enabled temporarily for troubleshooting and then disabled again. Option A is not a security hardening measure—increasing memory for management VMs is a performance/resource tuning action and does not reduce the host's attack surface. Option C, while SNMPv3 does provide authentication and encryption compared to earlier SNMP versions, is not one of the three required hardening measures here and enabling SNMP at all can expose management information, so it is not selected as a correct answer.

Answer

Increase memory resource allocation for management VMs

Answer

Enable SNMP v3

Question 7

Which TWO statements about vCenter Single Sign-On (SSO) are true? (Choose two.)

Accepted Answer

It supports multiple identity sources such as Active Directory and LDAP. Option A is correct because vCenter Single Sign-On supports multiple identity sources, including Active Directory (integrated Windows authentication), LDAP, and local SSO identity sources, allowing authentication against different user directories. Option E is correct because SSO issues SAML 2.0 tokens that are used to authenticate and authorize users across vCenter services and other vSphere components, enabling single sign-on without re-entering credentials. Option B is not correct because SSO does not rely on Kerberos as its authentication mechanism; it uses SAML tokens and can use various identity sources, though Kerberos may be involved in some Active Directory scenarios, it is not the defining authentication method. Option C is not correct because SSO does not store user passwords in plaintext; credentials are handled securely and passwords are not stored in plaintext for authentication. Option D is not correct because SSO does not require a Windows Active Directory domain; it can function with local SSO users or other supported identity sources such as LDAP.

Answer

It uses Kerberos to authenticate users to vCenter Server

Answer

It stores user passwords in plaintext for faster authentication

Answer

It requires a Windows Active Directory domain to function

Question 8

An administrator runs the command shown in the exhibit on a vCenter Server appliance. What is the primary purpose of the Machine ID?

Accepted Answer

To serve as a unique identifier for the vCenter Server instance in SSO. The Machine ID serves as a unique identifier for the vCenter Server instance within VMware SSO (Single Sign-On) and is used for certificate management. It is not related to workload distribution in DRS (option A), ESXi host identification (option B), or virtual machine identification for vMotion (option D). Therefore, option C is correct.

Answer

To calculate workload distribution in DRS

Answer

To identify an ESXi host to vCenter Server

Answer

To uniquely identify a virtual machine for vMotion

Question 9

An administrator notices that HTTP connections to the ESXi host are timing out frequently. Based on the exhibit, which configuration change would most likely resolve the issue?

Accepted Answer

Increase maxKeepAliveTimeout to a higher value, such as 180. Increasing maxKeepAliveTimeout to a higher value, such as 180, would most likely resolve the issue of HTTP connections timing out frequently. The maxKeepAliveTimeout setting controls how long the ESXi host's reverse proxy (rhttpproxy) keeps an HTTP connection open for keep-alive requests. If it is too low, connections may time out prematurely, causing frequent timeouts. Increasing it allows longer-lived connections.

Answer

Restart the rhttpproxy service

Answer

Set useProxy to true and specify a proxy server

Answer

Set maxKeepAliveTimeout to 0 to disable keepalive

Question 10

A company requires all vMotion traffic to be encrypted. The vSphere administrator enables vMotion encryption at the cluster level. What else must be configured to ensure vMotion operations are encrypted?

Accepted Answer

Ensure all VMs have virtual hardware version 11 or later.. For vMotion encryption to work, the virtual machine must have hardware version 11 or later. This requirement is documented for vSphere 6.5 and later, which support vMotion encryption. Option A is incorrect because there is no requirement to allocate additional memory for vMotion encryption; cryptographic operations for vMotion are handled by the host's CPU. Option B is incorrect because vMotion encryption is supported on ESXi 6.5 and later, not specifically version 7.0 or later. Option C is incorrect because VM Encryption is a separate feature that encrypts the VM's files at rest, not vMotion traffic. Therefore, ensuring VMs have virtual hardware version 11 or later is necessary for encrypted vMotion.

Answer

Allocate at least 4 GB of additional memory for cryptographic operations.

Answer

Upgrade all ESXi hosts to version 7.0 or later.

Answer

Enable VM Encryption also.

Question 11

An administrator wants to configure the ESXi host firewall to allow connections only from a specific management subnet. How can this be achieved?

Accepted Answer

Use the ESXi firewall settings to define allowed IP addresses for the required services.. ESXi's built-in firewall allows you to restrict each service (e.g., SSH, vSphere Client, vMotion) to specific IP addresses or subnets via the 'Allowed IP addresses' list in the firewall ruleset. By editing the ruleset for the management services and specifying the management subnet, you limit connections to only those sources.

Answer

Enable vSphere HA and set it to control management traffic.

Answer

Configure the DCUI to restrict management access.

Answer

Set the firewall to enabled and allow all incoming connections.

Question 12

During a security audit, it is found that the vCenter Server is using the default self-signed certificate. The administrator is tasked to replace it with a certificate from an enterprise CA. What is the first step after obtaining the CA-signed certificate?

Accepted Answer

Convert the certificate and private key into PEM format and place them in the appropriate directory.. The certificate must be in a format that vCenter can use; typically, it needs to be combined with the private key. Option B is premature before preparing the certificate. Option C is incorrect because certificate import is done via certificate management tools, not vSphere Web Client. Option D is incorrect because the private key is included in the signed certificate generation process, not imported separately.

Answer

Use the vSphere Web Client to upload the certificate.

Answer

Import the private key into the Windows Certificate Store.

Answer

Restart the VMware Certificate Service.

Question 13

An administrator wants to ensure that no user can view or modify VMs in a particular folder except the folder owner. What is the proper method to achieve this?

Accepted Answer

On the folder, assign permissions to the folder owner with the desired role and ensure propagation is set to 'All children'.. To restrict access so only the folder owner can view or modify VMs in a folder, you assign the owner the desired role on the folder and set propagation to 'All children'. This ensures the permission is inherited by all VMs and sub-objects within the folder, giving the owner the necessary rights while others without explicit permissions are denied by default.

Answer

Use the No Access permission on the folder for all other users.

Answer

Assign the folder owner with Administrator role on the folder.

Answer

Create a global role that denies access to all VMs except the folder owner.

Question 14

A company uses an external Platform Services Controller (PSC) in a vSphere 6.7 environment. They plan to upgrade to vSphere 7.0. Which security-related consideration is most important?

Accepted Answer

The external PSC is deprecated; it must be converged into the vCenter Server.. In vSphere 7.0, external Platform Services Controllers (PSC) are deprecated and must be converged into the vCenter Server during upgrade. This convergence simplifies management and improves security by reducing the attack surface. The upgrade process requires a topology change to embedded PSC.

Answer

The external PSC will automatically convert to an embedded PSC during upgrade.

Answer

The SSL certificates for the PSC must be reissued from a new CA.

Answer

The STS certificates need to be replaced with custom ones immediately after upgrade.

Question 15

A security administrator notices that a virtual machine (VM) running a legacy application is experiencing network connectivity issues after enabling Network I/O Control (NIOC) on the distributed switch. The VM is in a high-priority traffic class for management traffic. What is the most likely cause of the issue?

Accepted Answer

The VM is assigned to the management traffic class, but its traffic should be in a different class, causing bandwidth throttling.. Network I/O Control (NIOC) on a vSphere Distributed Switch enforces bandwidth allocation based on traffic classes such as management, vMotion, iSCSI, and VM traffic. If a VM's traffic is incorrectly classified into the management traffic class, it is subject to that class's share, reservation, and limit, which can throttle the VM's bandwidth and cause connectivity issues. The most likely cause is misclassification of the VM's traffic into the wrong NIOC traffic class.

Answer

NIOC is blocking the VM's MAC address due to a security policy.

Answer

The VM is using jumbo frames, which are not supported with NIOC.

Answer

The virtual switch has promiscuous mode enabled, which conflicts with NIOC.