How to Quickly Apply a Critical Patch to a Baseline-Managed Cluster
A vSphere administrator needs to apply a critical security patch to all ESXi hosts in a cluster that is managed by a baseline. The patch is not yet available as an update in the baseline group. What is the best approach to apply this patch quickly?
Quick Answer
Attaching the patch as a new baseline to the cluster alongside the existing baselines is correct because baseline-based patching in vSphere is additive by design; administrators can attach multiple baselines and baseline groups to the same cluster simultaneously, and remediation evaluates compliance against all of them. Since the critical patch is not yet part of the existing baseline group, waiting for that group to be updated would delay applying an urgent security fix, but there is no need to wait, because a standalone baseline containing just this patch can be created and attached directly to the cluster without touching the existing baseline group at all. This gets the patch onto all the hosts through the normal scan-and-remediate workflow, quickly and without disrupting whatever baselines are already governing the cluster's regular patch cycle. This differs from remediating hosts individually via the CLI, which works but throws away the efficiency of managing patch compliance at the cluster level, and it is also different from rebuilding the baseline group itself, which is unnecessary extra work and risks altering the cluster's established patching structure. It is also worth remembering this only applies to baseline-managed clusters; a cluster using vLCM's image-based management would not use baselines at all. When a scenario needs an urgent patch applied outside the normal update cycle without disturbing existing baseline structure, attaching a new, separate baseline is the fast path built for exactly that.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach the patch as a new baseline to the cluster alongside existing baselines.
Attaching the patch as a new baseline to the cluster alongside existing baselines allows you to quickly apply the critical security patch without modifying the existing baseline group. This method is efficient and directly addresses the immediate need. Option A is incorrect because remediating each host individually via CLI is time-consuming and less efficient for a cluster. Option B is incorrect because creating a new baseline group is unnecessary and may cause disruption by replacing the current baseline group. Option C is incorrect because vLCM is used for image-based management, not baseline-based management, and the cluster is managed by baselines, not images.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remediate each host individually using CLI commands.
Why it's wrong here
This is time-consuming and not the best approach.
- ✗
Create a new baseline group that includes the patch and attach it to the cluster.
Why it's wrong here
A baseline group is not needed; a single baseline suffices.
- ✗
Download the patch as an offline bundle and use vLCM to apply it directly.
Why it's wrong here
vLCM image-based does not apply standalone patches; baselines are used.
- ✓
Attach the patch as a new baseline to the cluster alongside existing baselines.
Why this is correct
Attaching a patch baseline allows remediation of the cluster.
Go deeper
Related to this question
About these practice questions
One of 498 original VCP-DCV practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on VCP-DCV
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to apply a critical security patch to all ESXi hosts in a cluster that is managed by a baseline. The patch is not yet available as an update in the baseline group. What is the best approach to apply this patch quickly?
easy- A.Remediate each host individually using CLI commands.
- ✓ B.Attach the patch as a new baseline to the cluster alongside existing baselines.
- C.Create a new baseline group that includes the patch and attach it to the cluster.
- D.Download the patch as an offline bundle and use vLCM to apply it directly.
Why B: You can attach the patch as a new baseline to the cluster alongside the existing baseline group. This allows you to apply the critical patch immediately without waiting for it to be included in the baseline group. Option A is wrong because remediating each host individually with CLI commands is inefficient and not the best approach when baseline-based management is available. Option C is wrong because creating a new baseline group is unnecessary; simply attaching the patch as a single baseline is sufficient. Option D is wrong because vLCM uses image-based management, not baselines; the question specifies baseline-based management.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.