VCP-DCV vSphere Security — Timed 10 Questions

Question 1

An administrator is troubleshooting a situation where a virtual machine cannot be powered on. The error message indicates insufficient permissions. The VM is in a folder named 'Production' and the administrator has been assigned a custom role with 'Virtual machine > Power On' permission at the folder level. However, the VM is also in a resource pool. What additional permission is most likely missing?

Accepted Answer

Resource > Assign virtual machine to resource pool permission on the resource pool. To power on a virtual machine that resides in a resource pool, the user must have the 'Resource > Assign virtual machine to resource pool' permission on that resource pool. Even though the user has 'Virtual machine > Power On' at the folder level, the VM's association with the resource pool introduces an additional authorization check. Without this resource pool permission, the power-on operation fails with an insufficient permissions error.

Answer

Network > Assign network permission on the network

Answer

Datastore > Allocate space permission on the datastore

Answer

Virtual machine > Configuration permission on the VM

Question 2

A security audit reveals that an ESXi host has been compromised due to an attacker gaining root access via the DCUI. The host is configured with a default DCUI password. Which security best practice should have been implemented to prevent this?

Accepted Answer

Configure the DCUI lockdown mode to 'Normal'. DCUI Lockdown Mode 'Normal' disables direct root access via the Direct Console User Interface (DCUI) by requiring authentication through vCenter Single Sign-On (SSO). This prevents an attacker from using the default or weak DCUI password to gain root access, as the root account is no longer accepted for DCUI login. The mode still allows authorized vCenter administrators to access the host via the DCUI using their SSO credentials, maintaining manageability while eliminating the root password attack vector.

Answer

Disable the DCUI service

Answer

Set a strong password for the root account

Answer

Disable SSH access

Question 3

A vSphere administrator needs to ensure that all HTTPS traffic to ESXi hosts is encrypted using TLS 1.2. Where should the administrator configure the minimum TLS version?

Accepted Answer

Host Advanced Settings (Config.HostAgent.plugins.vimsvc.auth.minTLSVersion). Option A is correct because the minimum TLS version for ESXi host HTTPS traffic is configured via the host advanced setting `Config.HostAgent.plugins.vimsvc.auth.minTLSVersion`. This setting directly controls the TLS protocol version used by the ESXi host's HTTP services, including the vSphere Client and API endpoints, ensuring only TLS 1.2 or higher is accepted.

Answer

Security Profile in the vSphere Client

Answer

vCenter Server Appliance (VAMI) web interface

Answer

ESXi Firewall rules

Question 4

An administrator is configuring a distributed switch and needs to ensure that all virtual machine traffic on a specific VLAN is isolated. The administrator creates a port group with VLAN ID 100. However, a security scanner reports that packets from this VLAN are appearing on other VLANs. Which security policy setting on the distributed switch should the administrator verify?

Accepted Answer

VLAN trunking. The VLAN trunking policy on a distributed switch controls whether a port group can pass multiple VLAN IDs (trunk mode) or is restricted to a single VLAN (access mode). When VLAN trunking is enabled, the port group may forward traffic from VLAN 100 onto other VLANs if the virtual switch is configured to allow it, breaking isolation. The administrator should verify that VLAN trunking is disabled (set to 'Reject') to ensure strict VLAN isolation.

Answer

MAC address changes

Answer

Forged transmits

Answer

Promiscuous mode

Question 5

A vSphere environment uses Active Directory for authentication. The administrator notices that users from a specific AD group cannot log in to the vCenter Server, although other AD users can. The group is added to vCenter Server with the correct permissions. What is the most likely cause?

Accepted Answer

The domain of the group is not configured as an identity source in vCenter Single Sign-On. The most likely cause is that the domain of the group is not configured as an identity source in vCenter Single Sign-On. Even if the group is added with correct permissions in vCenter Server, vCenter SSO must be able to authenticate users against the domain. Without the domain listed as an identity source, vCenter cannot validate the credentials of users from that group, causing authentication failures for all users in that domain.

Answer

The users are not members of the vCenter Single Sign-On domain

Answer

The user accounts have expired passwords

Answer

The group is nested within another group

Question 6

Which TWO actions are recommended to secure the vCenter Server Appliance (VCSA)?

Accepted Answer

Change the default 'root' password. Option B is correct because changing the default 'root' password is a fundamental security best practice for the VCSA. The default password is well-known and documented, leaving the appliance vulnerable to unauthorized access if not changed immediately after deployment. This action directly mitigates the risk of brute-force or credential-based attacks against the root account.

Answer

Enable the auto-lock feature for the admin account

Answer

Configure the password policy for local accounts

Answer

Enable FIPS 140-2 compliance mode

Question 7

Which THREE security features are available in vSphere Trust Authority (vTA)?

Accepted Answer

Attestation of ESXi hosts. Option A is correct because vSphere Trust Authority (vTA) uses attestation to verify the integrity of ESXi hosts before allowing them to interact with trusted infrastructure. This attestation process confirms that the host is running genuine, untampered VMware code, which is a core security feature of vTA.

Answer

Integration with Active Directory for authentication

Answer

Encryption of vMotion traffic

Question 8

A multinational corporation runs a vSphere environment with 100 ESXi hosts managed by a single vCenter Server. The security team mandates that all virtual machine disks (VMDKs) must be encrypted at rest. The administrator enables vSphere Virtual Machine Encryption and creates a Key Management Server (KMS) cluster. After encrypting a test VM, the VM powers on successfully, but the administrator notices that the VM's configuration files (VMX, NVRAM) are not encrypted. The security policy requires that all VM files, including configuration files, be encrypted. The administrator checks the VM storage policy and sees that the policy is set to 'VM Encryption Policy' with 'Disk Encryption' enabled. What should the administrator do to ensure the entire VM is encrypted?

Accepted Answer

Modify the VM storage policy to include encryption of VM home files. The VM storage policy 'VM Encryption Policy' with only 'Disk Encryption' enabled encrypts VMDK files but not the VM configuration files (VMX, NVRAM, logs, etc.). To encrypt all VM files, the storage policy must include the 'Encrypt VM home files' option, which applies encryption to the entire VM home directory on the datastore. This ensures compliance with the security mandate for full VM encryption at rest.

Answer

Enable encryption on the datastore where the VM resides

Answer

Add a second KMS cluster for redundancy

Answer

Enable vSphere Host Encryption on each ESXi host

Question 9

A vSphere administrator needs to ensure that all virtual machine disks are encrypted at rest. The environment uses a KMS cluster with multiple KMIP-compliant servers. The administrator has already configured a storage policy with encryption enabled. However, newly created VMs on a particular datastore still show unencrypted disks. What is the most likely cause?

Accepted Answer

The storage policy with encryption is not assigned to the VMs or their home namespace.. Option D is correct because even when a storage policy with encryption is configured, it must be explicitly assigned to the VMs or their home namespace (the VM's configuration and swap files). If the policy is not assigned, the VM will be created using the default datastore policy, which typically does not include encryption, resulting in unencrypted disks. The administrator must ensure the encryption-enabled policy is applied to the VM during creation or via a storage policy-based management (SPBM) assignment.

Answer

The datastore is a vSAN datastore, which does not support VM-level encryption.

Answer

The KMS cluster must have at least two KMS servers to function correctly.

Answer

The datastore is formatted with VMFS6, which does not support encryption.

Question 10

A security audit reveals that a vCenter Server has weak TLS configuration. The administrator needs to enforce strong ciphers and disable SSLv3. Which two steps should the administrator take? (Choose two.)

Accepted Answer

Use the vSphere Certificate Manager utility to replace the machine SSL certificate with a new one that uses strong ciphers.. Option A is correct because the vSphere Certificate Manager utility can be used to replace the machine SSL certificate with one that enforces strong ciphers, directly addressing the weak TLS configuration. This utility manages certificate operations and allows administrators to specify cipher strength during certificate generation or replacement, ensuring compliance with security policies.

Answer

Edit the registry on the vCenter Server to disable SSLv3.

Answer

Disable TLS 1.2 and enable only TLS 1.3 on all ESXi hosts.

Answer

Configure the TLS settings in the vSphere Web Client under Administration > Security.