Applying Security Patches to vLCM Image-Managed Clusters

Quick Answer

The correct procedure is to create a new desired state image with the patch, validate it, and then remediate the cluster. This is because vLCM uses a declarative model where the cluster’s software is defined by a single, immutable image specification; applying a security patch requires updating that desired state image to include the new ESXi version from the vSphere Lifecycle Manager depot, rather than patching individual hosts. After creating the new image, validation checks hardware and software compatibility across the cluster, and remediation ensures every host is rebuilt to match the exact new image, maintaining consistency. On the VCP-DCV exam, this question tests your understanding that vLCM does not support traditional patch baselines or rolling updates—a common trap is thinking you can apply a patch directly to a host or use a baseline. Remember: in vLCM, you never patch the host, you replace the image. A helpful memory tip is “New Image, Validate, Remediate”—treat it like swapping out a recipe, not adding a single ingredient.