How to Restrict Access to the ESXi Direct Console User Interface (DCUI)
A vSphere administrator wants to restrict direct console access to an ESXi host to authorized administrators only, without interrupting running virtual machines. Which feature should the administrator enable?
⚠ Common exam trap
VCP-DCV often tests the difference between lockdown mode and other access controls like SSH disabling, and candidates may think disabling SSH is sufficient for console restriction.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Lockdown mode
Lockdown mode restricts direct console access to an ESXi host to only users with administrator privileges, while allowing running VMs to continue unaffected. It enforces that all management access must go through vCenter Server, enhancing security without disrupting workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Lockdown mode
Why this is correct
Lockdown mode restricts the ESXi DCUI and SSH to users in the Exception Users list, enforced through host permissions. It applies immediately without rebooting or evacuating VMs, satisfying the constraint of restricting console access while leaving running virtual machines untouched.
- ✗
Enable DRS
Why it's wrong here
DRS (Distributed Resource Scheduler) is for load balancing VMs across hosts, not for restricting direct console access.
- ✗
Configure a host profile
Why it's wrong here
Host profiles enforce configuration compliance across hosts; they do not restrict who may open the DCUI. Lockdown mode is the feature that limits direct console and DCUI access to privileged users. Host profiles are tempting for standardising ESXi settings, but they remediate configuration drift rather than authenticate console users.
- ✗
Disable SSH service
Why it's wrong here
Disabling the SSH service only stops SSH access; it does not restrict the DCUI (Direct Console User Interface) or other direct console methods.
Go deeper
Related to this question
About these practice questions
One of 281 original VCP-DCV practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on VCP-DCV
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are valid methods to restrict access to the ESXi host's Direct Console User Interface (DCUI) to authorized administrators only?
medium- A.Disable SSH access on the host to prevent remote DCUI access.
- ✓ B.Enable lockdown mode and add only authorized administrators to the Exception Users list.
- C.Remove the root user from the DCUI local users list.
- ✓ D.Set the advanced option 'DCUI.Access' to a list of authorized users.
- E.Configure Active Directory integration and use group policy to disable DCUI.
Why B: Option B is correct because enabling lockdown mode restricts direct host access (including the DCUI) so that only users on the Exception Users list—authorized administrators—can log in to the DCUI and other local management interfaces. Option D is correct because the advanced setting 'DCUI.Access' explicitly defines which local users are permitted to access the Direct Console User Interface, so setting it to a list of authorized users restricts DCUI access to exactly those accounts. Option A is not correct because SSH is a separate remote shell service and disabling it has no effect on DCUI access, which is a local console interface. Option C is not correct because the root user cannot simply be removed from the DCUI local users list in the manner described; DCUI access is controlled via lockdown mode and DCUI.Access, not by deleting root from a list. Option E is not correct because Active Directory integration and group policy do not provide a supported mechanism to disable the DCUI on an ESXi host.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official VMware exam blueprint
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.