VCP-DCV vSphere Security Practice Question
An administrator needs to allow HTTP traffic from a specific management workstation to an ESXi host while blocking all other inbound traffic. The ESXi firewall uses the default ruleset. What should the administrator do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use esxcli network firewall ruleset set to create an allowed IP list for the HTTP ruleset
The ESXi firewall allows restricting a specific ruleset (such as HTTP) to a list of allowed IP addresses using the esxcli network firewall ruleset set command. Option A is wrong because opening all firewall ports for the management subnet is overly permissive and allows more than just HTTP traffic. Option B is wrong because disabling the ESXi firewall removes all host-level protection and is not recommended. Option C is wrong because the service console firewall is deprecated in modern ESXi; the correct method is to use the ESXi firewall with esxcli.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Open all firewall ports for the management subnet
Why it's wrong here
Opening all firewall ports for the management subnet is unnecessary and insecure; it would allow more than just HTTP traffic and from any IP in the subnet, not just the specific workstation.
- ✗
Disable the ESXi firewall and use a network firewall
Why it's wrong here
Disabling the ESXi firewall is insecure and not recommended; it would remove all filtering, and using a network firewall alone does not satisfy the requirement to allow only HTTP from a specific workstation at the ESXi level.
- ✗
Modify the service console firewall rules
Why it's wrong here
Modifying the service console firewall rules is not applicable because modern ESXi does not have a service console firewall; the ESXi firewall is managed via esxcli or the vSphere Client.
- ✓
Use esxcli network firewall ruleset set to create an allowed IP list for the HTTP ruleset
Why this is correct
Using esxcli network firewall ruleset set with an allowed IP list for the HTTP ruleset is correct because it restricts the HTTP ruleset to only the specified management workstation IP, blocking all other inbound traffic by default.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every VCP-DCV question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on VCP-DCV
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator wants to configure the ESXi host firewall to allow connections only from a specific management subnet. How can this be achieved?
easy- A.Enable vSphere HA and set it to control management traffic.
- ✓ B.Use the ESXi firewall settings to define allowed IP addresses for the required services.
- C.Configure the DCUI to restrict management access.
- D.Set the firewall to enabled and allow all incoming connections.
Why B: The ESXi host firewall can be configured with rule sets that allow traffic only from specific IP addresses or subnets. This is done by editing the firewall rules for the required services and specifying the allowed IP addresses. Option A is incorrect because vSphere HA is a high availability feature that does not manage firewall settings or control management traffic. Option C is incorrect because the DCUI (Direct Console User Interface) is used for local console configuration, not for setting firewall rules. Option D is incorrect because allowing all incoming connections would be insecure and not restrict access to a specific management subnet.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.