VCP-DCV vSphere Security Practice Question
A security audit reveals that an ESXi host has been compromised due to an attacker gaining root access via the DCUI. The host is configured with a default DCUI password. Which security best practice should have been implemented to prevent this?
⚠ Common exam trap
Test-takers frequently choose 'Set a strong password for the root account' because they focus on password strength, but the question specifically highlights a default password being used, and the correct solution is to eliminate the root password as an authentication method for the DCUI entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the DCUI lockdown mode to 'Normal'
DCUI Lockdown Mode 'Normal' disables direct root access via the Direct Console User Interface (DCUI) by requiring authentication through vCenter Single Sign-On (SSO). This prevents an attacker from using the default or weak DCUI password to gain root access, as the root account is no longer accepted for DCUI login. The mode still allows authorized vCenter administrators to access the host via the DCUI using their SSO credentials, maintaining manageability while eliminating the root password attack vector.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the DCUI lockdown mode to 'Normal'
Why this is correct
Normal lockdown mode restricts DCUI access to local console only.
- ✗
Disable the DCUI service
Why it's wrong here
Disabling DCUI prevents local console access, which may be needed.
- ✗
Set a strong password for the root account
Why it's wrong here
While important, it does not prevent all attack vectors.
- ✗
Disable SSH access
Why it's wrong here
SSH is not directly related to DCUI.
Go deeper
Related to this question
About these practice questions
One of 498 original VCP-DCV practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.