VCP-DCV vSphere Security Practice Question
A large financial institution runs a vSphere 7.0 environment with 100 ESXi hosts and 2,000 VMs. The security team has identified that several VMs are vulnerable to a critical side-channel attack that requires disabling hyperthreading on the ESXi hosts. The administrator needs to implement a solution that minimizes performance impact while ensuring compliance. The environment uses DRS clusters with varying workloads: some VMs are CPU-intensive (financial modeling) and others are memory-bound (database servers). The administrator cannot afford to take hosts offline for maintenance during business hours. The change must be implemented within 48 hours. Which course of action should the administrator take?
⚠ Common exam trap
The trap here is that candidates mistakenly believe hyperthreading can be disabled via a vSphere software setting (like a DRS rule or cluster feature) without a host reboot, when in reality it requires a physical BIOS change and reboot per host.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Place each host in maintenance mode individually, disable hyperthreading in the host BIOS, reboot the host, and then move to the next host. Rebalance VMs after all hosts are updated.
Disabling hyperthreading to mitigate side-channel attacks (e.g., L1TF or MDS) requires a host BIOS change, which necessitates a reboot. The only supported method in vSphere 7.0 is to place each host into maintenance mode, change the BIOS setting, reboot, and then repeat for all hosts. This approach minimizes performance impact by allowing VMs to be migrated via vMotion and avoids simultaneous downtime, meeting the 48-hour requirement without taking all hosts offline during business hours.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a vSphere DRS rule to disable hyperthreading for all VMs in the cluster, avoiding the need to modify host BIOS.
Why it's wrong here
DRS rules govern VM placement and affinity, not CPU hyperthreading, which is configured in host BIOS or firmware; no DRS rule can disable it. It is tempting because DRS centrally manages cluster-wide VM behaviour, and would be correct for balancing or separating workloads across hosts.
- ✓
Place each host in maintenance mode individually, disable hyperthreading in the host BIOS, reboot the host, and then move to the next host. Rebalance VMs after all hosts are updated.
Why this is correct
Hyperthreading is a BIOS setting, so disabling it requires a host reboot. Sequentially placing each host in maintenance mode lets DRS evacuate VMs to remaining hosts, avoiding downtime, then rebalancing after all 100 hosts are updated within the 48-hour window.
- ✗
Delay the change and schedule a maintenance window for the next month when business impact is lower.
Why it's wrong here
Deferring to next month breaches the 48-hour compliance deadline the security team imposed. It is tempting because maintenance windows reduce business disruption, and would be correct when a change is discretionary rather than mandated by a critical vulnerability with a fixed remediation timeline.
- ✗
Disable hyperthreading on all hosts simultaneously using a vSphere Cluster feature, then reboot all hosts at once during off-peak hours.
Why it's wrong here
No vSphere Cluster feature disables hyperthreading; it is a BIOS or firmware setting requiring per-host reboots, and rebooting all 100 hosts simultaneously violates the no-downtime constraint. It is tempting because cluster-wide configuration simplifies bulk changes, and would suit non-disruptive settings applied through host profiles.
Go deeper
Related to this question
About these practice questions
This VCP-DCV question is part of Courseiva's 281-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.