VCP-DCV vSphere Security — Timed 15 Questions

Question 1

An administrator is troubleshooting a situation where a virtual machine cannot be powered on. The error message indicates insufficient permissions. The VM is in a folder named 'Production' and the administrator has been assigned a custom role with 'Virtual machine > Power On' permission at the folder level. However, the VM is also in a resource pool. What additional permission is most likely missing?

Accepted Answer

Resource > Assign virtual machine to resource pool permission on the resource pool. To power on a virtual machine that resides in a resource pool, the user must have the 'Resource > Assign virtual machine to resource pool' permission on that resource pool. Even though the user has 'Virtual machine > Power On' at the folder level, the VM's association with the resource pool introduces an additional authorization check. Without this resource pool permission, the power-on operation fails with an insufficient permissions error.

Answer

Network > Assign network permission on the network

Answer

Datastore > Allocate space permission on the datastore

Answer

Virtual machine > Configuration permission on the VM

Question 2

A security audit reveals that an ESXi host has been compromised due to an attacker gaining root access via the DCUI. The host is configured with a default DCUI password. Which security best practice should have been implemented to prevent this?

Accepted Answer

Configure the DCUI lockdown mode to 'Normal'. DCUI Lockdown Mode 'Normal' disables direct root access via the Direct Console User Interface (DCUI) by requiring authentication through vCenter Single Sign-On (SSO). This prevents an attacker from using the default or weak DCUI password to gain root access, as the root account is no longer accepted for DCUI login. The mode still allows authorized vCenter administrators to access the host via the DCUI using their SSO credentials, maintaining manageability while eliminating the root password attack vector.

Answer

Disable the DCUI service

Answer

Set a strong password for the root account

Answer

Disable SSH access

Question 3

A vSphere administrator needs to ensure that all HTTPS traffic to ESXi hosts is encrypted using TLS 1.2. Where should the administrator configure the minimum TLS version?

Accepted Answer

Host Advanced Settings (Config.HostAgent.plugins.vimsvc.auth.minTLSVersion). Option A is correct because the minimum TLS version for ESXi host HTTPS traffic is configured via the host advanced setting `Config.HostAgent.plugins.vimsvc.auth.minTLSVersion`. This setting directly controls the TLS protocol version used by the ESXi host's HTTP services, including the vSphere Client and API endpoints, ensuring only TLS 1.2 or higher is accepted.

Answer

Security Profile in the vSphere Client

Answer

vCenter Server Appliance (VAMI) web interface

Answer

ESXi Firewall rules

Question 4

An administrator is configuring a distributed switch and needs to ensure that all virtual machine traffic on a specific VLAN is isolated. The administrator creates a port group with VLAN ID 100. However, a security scanner reports that packets from this VLAN are appearing on other VLANs. Which security policy setting on the distributed switch should the administrator verify?

Accepted Answer

VLAN trunking. The VLAN trunking policy on a distributed switch controls whether a port group can pass multiple VLAN IDs (trunk mode) or is restricted to a single VLAN (access mode). When VLAN trunking is enabled, the port group may forward traffic from VLAN 100 onto other VLANs if the virtual switch is configured to allow it, breaking isolation. The administrator should verify that VLAN trunking is disabled (set to 'Reject') to ensure strict VLAN isolation.

Answer

MAC address changes

Answer

Forged transmits

Answer

Promiscuous mode

Question 5

A vSphere environment uses Active Directory for authentication. The administrator notices that users from a specific AD group cannot log in to the vCenter Server, although other AD users can. The group is added to vCenter Server with the correct permissions. What is the most likely cause?

Accepted Answer

The domain of the group is not configured as an identity source in vCenter Single Sign-On. The most likely cause is that the domain of the group is not configured as an identity source in vCenter Single Sign-On. Even if the group is added with correct permissions in vCenter Server, vCenter SSO must be able to authenticate users against the domain. Without the domain listed as an identity source, vCenter cannot validate the credentials of users from that group, causing authentication failures for all users in that domain.

Answer

The users are not members of the vCenter Single Sign-On domain

Answer

The user accounts have expired passwords

Answer

The group is nested within another group

Question 6

Which TWO actions are recommended to secure the vCenter Server Appliance (VCSA)?

Accepted Answer

Change the default 'root' password. Option B is correct because changing the default 'root' password is a fundamental security best practice for the VCSA. The default password is well-known and documented, leaving the appliance vulnerable to unauthorized access if not changed immediately after deployment. This action directly mitigates the risk of brute-force or credential-based attacks against the root account.

Answer

Enable the auto-lock feature for the admin account

Answer

Configure the password policy for local accounts

Answer

Enable FIPS 140-2 compliance mode

Question 7

Which THREE security features are available in vSphere Trust Authority (vTA)?

Accepted Answer

Attestation of ESXi hosts. Option A is correct because vSphere Trust Authority (vTA) uses attestation to verify the integrity of ESXi hosts before allowing them to interact with trusted infrastructure. This attestation process confirms that the host is running genuine, untampered VMware code, which is a core security feature of vTA.

Answer

Integration with Active Directory for authentication

Answer

Encryption of vMotion traffic

Question 8

A multinational corporation runs a vSphere environment with 100 ESXi hosts managed by a single vCenter Server. The security team mandates that all virtual machine disks (VMDKs) must be encrypted at rest. The administrator enables vSphere Virtual Machine Encryption and creates a Key Management Server (KMS) cluster. After encrypting a test VM, the VM powers on successfully, but the administrator notices that the VM's configuration files (VMX, NVRAM) are not encrypted. The security policy requires that all VM files, including configuration files, be encrypted. The administrator checks the VM storage policy and sees that the policy is set to 'VM Encryption Policy' with 'Disk Encryption' enabled. What should the administrator do to ensure the entire VM is encrypted?

Accepted Answer

Modify the VM storage policy to include encryption of VM home files. The VM storage policy 'VM Encryption Policy' with only 'Disk Encryption' enabled encrypts VMDK files but not the VM configuration files (VMX, NVRAM, logs, etc.). To encrypt all VM files, the storage policy must include the 'Encrypt VM home files' option, which applies encryption to the entire VM home directory on the datastore. This ensures compliance with the security mandate for full VM encryption at rest.

Answer

Enable encryption on the datastore where the VM resides

Answer

Add a second KMS cluster for redundancy

Answer

Enable vSphere Host Encryption on each ESXi host

Question 9

A vSphere administrator needs to ensure that all virtual machine disks are encrypted at rest. The environment uses a KMS cluster with multiple KMIP-compliant servers. The administrator has already configured a storage policy with encryption enabled. However, newly created VMs on a particular datastore still show unencrypted disks. What is the most likely cause?

Accepted Answer

The storage policy with encryption is not assigned to the VMs or their home namespace.. Option D is correct because even when a storage policy with encryption is configured, it must be explicitly assigned to the VMs or their home namespace (the VM's configuration and swap files). If the policy is not assigned, the VM will be created using the default datastore policy, which typically does not include encryption, resulting in unencrypted disks. The administrator must ensure the encryption-enabled policy is applied to the VM during creation or via a storage policy-based management (SPBM) assignment.

Answer

The datastore is a vSAN datastore, which does not support VM-level encryption.

Answer

The KMS cluster must have at least two KMS servers to function correctly.

Answer

The datastore is formatted with VMFS6, which does not support encryption.

Question 10

A security audit reveals that a vCenter Server has weak TLS configuration. The administrator needs to enforce strong ciphers and disable SSLv3. Which two steps should the administrator take? (Choose two.)

Accepted Answer

Use the vSphere Certificate Manager utility to replace the machine SSL certificate with a new one that uses strong ciphers.. Option A is correct because the vSphere Certificate Manager utility can be used to replace the machine SSL certificate with one that enforces strong ciphers, directly addressing the weak TLS configuration. This utility manages certificate operations and allows administrators to specify cipher strength during certificate generation or replacement, ensuring compliance with security policies.

Answer

Edit the registry on the vCenter Server to disable SSLv3.

Answer

Disable TLS 1.2 and enable only TLS 1.3 on all ESXi hosts.

Answer

Configure the TLS settings in the vSphere Web Client under Administration > Security.

Question 11

An administrator is troubleshooting a failed attempt to add an ESXi host to a vCenter Server domain. The error message states: 'The host's certificate has been tampered with or is invalid.' What is the most likely cause?

Accepted Answer

The ESXi host's certificate thumbprint does not match the thumbprint stored in vCenter Server.. The error 'The host's certificate has been tampered with or is invalid' occurs when the ESXi host presents a certificate whose thumbprint does not match the thumbprint that vCenter Server has stored for that host. This mismatch can happen if the host's certificate was replaced (e.g., due to a reinstall or manual rotation) without updating the vCenter Server's trusted store. vCenter Server verifies the host's identity by comparing the SHA-1 or SHA-256 thumbprint of the presented certificate against its stored record; a mismatch triggers this specific error.

Answer

The vCenter Server's account lockout policy has been triggered.

Answer

The ESXi host's SSH keys have been rotated.

Answer

The ESXi host's certificate has expired.

Question 12

A company has a vSphere environment with 20 ESXi hosts and 500 VMs. The security team mandates that all administrative access to vCenter Server must be through a single, highly restricted account with multi-factor authentication (MFA). The account must be used for both the vSphere Client and API integrations. Which step should the administrator take?

Accepted Answer

Integrate vCenter Server with an external identity provider (e.g., ADFS, Okta) that supports MFA, and use a service account with MFA for API access.. Option B is correct because integrating vCenter Server with an external identity provider (IdP) such as ADFS or Okta allows the use of a single service account that supports multi-factor authentication (MFA) for both the vSphere Client and API integrations. This approach meets the security mandate by centralizing authentication through an IdP that enforces MFA, while also supporting OAuth 2.0 token-based API access, which is required for modern vSphere API integrations. The built-in administrator account cannot be directly configured with MFA in a way that satisfies both interactive and API access requirements without external integration.

Answer

Configure the built-in administrator account to require smart card authentication.

Answer

Create a new local account and configure it as a member of the Administrators group, then enforce MFA via a third-party tool on the vCenter Server OS.

Answer

Disable the built-in administrator account and create a new local account with the same privileges.

Question 13

A large financial institution runs a vSphere 7.0 environment with 100 ESXi hosts and 2,000 VMs. The security team has identified that several VMs are vulnerable to a critical side-channel attack that requires disabling hyperthreading on the ESXi hosts. The administrator needs to implement a solution that minimizes performance impact while ensuring compliance. The environment uses DRS clusters with varying workloads: some VMs are CPU-intensive (financial modeling) and others are memory-bound (database servers). The administrator cannot afford to take hosts offline for maintenance during business hours. The change must be implemented within 48 hours. Which course of action should the administrator take?

Accepted Answer

Place each host in maintenance mode individually, disable hyperthreading in the host BIOS, reboot the host, and then move to the next host. Rebalance VMs after all hosts are updated.. Option B is correct because disabling hyperthreading to mitigate side-channel attacks (e.g., L1TF or MDS) requires a host BIOS change, which necessitates a reboot. The only supported method in vSphere 7.0 is to place each host into maintenance mode, change the BIOS setting, reboot, and then repeat for all hosts. This approach minimizes performance impact by allowing VMs to be migrated via vMotion and avoids simultaneous downtime, meeting the 48-hour requirement without taking all hosts offline during business hours.

Answer

Use a vSphere DRS rule to disable hyperthreading for all VMs in the cluster, avoiding the need to modify host BIOS.

Answer

Delay the change and schedule a maintenance window for the next month when business impact is lower.

Answer

Disable hyperthreading on all hosts simultaneously using a vSphere Cluster feature, then reboot all hosts at once during off-peak hours.

Question 14

A company is implementing vSphere 7.0 and wants to encrypt all vMotion traffic between ESXi hosts in a cluster. The cluster is not using any other encryption features. What is the minimum requirement to enable vMotion encryption?

Accepted Answer

The ESXi hosts must be joined to an Active Directory domain.. In vSphere 7.0, vMotion encryption can be enabled without any additional infrastructure by setting the vMotion encryption policy to 'Required' or 'Opportunistic' on the ESXi host's advanced system settings. The minimum requirement is that the ESXi hosts must be joined to an Active Directory domain, because vMotion encryption relies on Kerberos authentication (RFC 4120) to establish a secure channel between hosts. This eliminates the need for a separate Key Management Server (KMS) for vMotion traffic alone, as the domain provides the necessary trust and key exchange mechanism.

Answer

A VM Encryption Key Management Server must be configured.

Answer

The ESXi hosts must have a host profile applied with encryption enabled.

Answer

The cluster must be configured with Enhanced vMotion Compatibility (EVC).

Question 15

Which TWO actions are required to enable encrypted vSphere vMotion for all virtual machines in a cluster?

Accepted Answer

Set the vMotion encryption policy to 'Encrypt all data' in the cluster settings.. Option A is correct because setting the vMotion encryption policy to 'Encrypt all data' in the cluster settings enforces encryption for all vMotion migrations within that cluster. This ensures that memory and state data transferred between ESXi hosts is protected using TLS 1.2, preventing eavesdropping or tampering during live migrations.

Answer

Configure a Key Management Server (KMS) for the cluster.

Answer

Enable Storage DRS on the cluster.

Answer

Set the vMotion encryption policy to 'Encrypt when supported' in the cluster settings.