VCP-DCV vSphere Security Practice Question
A company uses an external Platform Services Controller (PSC) in a vSphere 6.7 environment. They plan to upgrade to vSphere 7.0. Which security-related consideration is most important?
⚠ Common exam trap
VCP-DCV often tests the deprecation of external PSC and the requirement to converge, but candidates may assume automatic conversion or focus on certificate issues instead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The external PSC is deprecated; it must be converged into the vCenter Server.
In vSphere 7.0, external Platform Services Controllers (PSC) are deprecated and must be converged into the vCenter Server during upgrade. This convergence simplifies management and improves security by reducing the attack surface. The upgrade process requires a topology change to embedded PSC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The external PSC will automatically convert to an embedded PSC during upgrade.
Why it's wrong here
The external PSC is not converted automatically; vSphere 7.0 requires an explicit convergence or migration step to embed the PSC into the vCenter Server appliance. Automatic conversion applies to nothing here, though convergence is the correct path when retiring external PSC topology.
- ✓
The external PSC is deprecated; it must be converged into the vCenter Server.
Why this is correct
External Platform Services Controller deployments are deprecated in vSphere 7.0, so the PSC services must be converged into the vCenter Server during upgrade. This convergence is the critical security and supportability consideration for the migration.
- ✗
The SSL certificates for the PSC must be reissued from a new CA.
Why it's wrong here
Reissuing PSC SSL certificates from a new CA is unnecessary; existing certificates remain valid through the upgrade. Reissuing is required only when certificates are expiring, use weak algorithms, or the CA itself is being replaced — none of which the scenario mentions.
- ✗
The STS certificates need to be replaced with custom ones immediately after upgrade.
Why it's wrong here
Replacing STS certificates is optional, not required, after upgrade; vSphere 7.0 continues to trust existing VMCA-issued STS certificates. Custom STS certificates are chosen when an organisation mandates third-party CA trust for internal services, which this scenario does not state.
Go deeper
Related to this question
About these practice questions
This VCP-DCV question is part of Courseiva's 281-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official VMware exam blueprint
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.