VCP-DCV vSphere Security Practice Question
A vSphere environment uses VMCA for certificate management. An administrator needs to replace the certificate for vCenter Server with a custom CA-signed certificate. The custom CA root certificate must be trusted by all ESXi hosts. Which method should the administrator use to distribute the custom CA root certificate to ESXi hosts?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a host profile containing the custom CA root certificate and apply it to the ESXi hosts
Using a host profile to apply the custom CA root certificate ensures consistent, policy-driven deployment across all ESXi hosts, leveraging vCenter's host profile functionality. Option A is incorrect: restarting the rhttpproxy service with a new configuration does not distribute certificates; it only restarts the proxy service. Option B is incorrect: while vCenter can manage machine SSL certificates, it does not automatically push root CA certificates to ESXi hosts; the administrator must explicitly import the root CA into the ESXi trust store, which is not done automatically by vCenter. Option C is incorrect: manually uploading via SCP is not scalable and is not the recommended method for managing certificate trust across multiple hosts; host profiles provide a centralized, automated approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restart the rhttpproxy service on each ESXi host with a new configuration
Why it's wrong here
rhttpproxy does not handle certificate distribution.
- ✗
Import the root CA certificate into vCenter Server and it will automatically push to hosts
Why it's wrong here
vCenter does not automatically push root CAs.
- ✗
Manually upload the root CA certificate to each ESXi host via SCP
Why it's wrong here
Manual distribution is error-prone and unscalable.
- ✓
Create a host profile containing the custom CA root certificate and apply it to the ESXi hosts
Why this is correct
Host profiles provide consistent, policy-based distribution.
Go deeper
Related to this question
About these practice questions
One of 498 original VCP-DCV practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.