CCNA vSphere Security Questions

Assigning the folder owner the desired role on the folder with propagation set to 'All children' grants permissions to the folder and all VMs within it, while other users without explicit permissions cannot view or modify the VMs. Option A is incorrect because 'No Access' on the folder for all other users would block their access but does not grant the folder owner access unless also assigned. Option B is incorrect because the Administrator role is too broad and grants full administrative rights beyond the folder.

Option C is incorrect because a global role applies across the entire vCenter, not just a specific folder, and cannot be limited to a single folder owner.

Using a host profile to apply the custom CA root certificate ensures consistent, policy-driven deployment across all ESXi hosts, leveraging vCenter's host profile functionality. Option A is incorrect: restarting the rhttpproxy service with a new configuration does not distribute certificates; it only restarts the proxy service. Option B is incorrect: while vCenter can manage machine SSL certificates, it does not automatically push root CA certificates to ESXi hosts; the administrator must explicitly import the root CA into the ESXi trust store, which is not done automatically by vCenter.

Option C is incorrect: manually uploading via SCP is not scalable and is not the recommended method for managing certificate trust across multiple hosts; host profiles provide a centralized, automated approach.

Recovering a VM from a corrupted encrypted disk in a vSAN environment with VM encryption enabled requires access to the key management server (KMS) and the encryption keys (KEK/Rekey). Without these keys, the encrypted data cannot be decrypted. Option A is incorrect because the vSAN health service monitors vSAN health but does not provide cryptographic keys.

Option B is incorrect because a backup of VM files alone is insufficient; the backup would still be encrypted and require the same keys to restore. Option D is incorrect because the VM's storage policy defines properties like encryption, but the policy itself does not contain the actual encryption keys needed for recovery.

Options C and E are correct. Enabling lockdown mode (C) restricts direct root access to the host, requiring administrators to use vCenter Server for management, which is a security best practice. Configuring Active Directory integration (E) allows centralized user management and authentication, avoiding the need for local accounts.

Option A is incorrect because granting root user direct permissions on all hosts bypasses security controls. Option B is incorrect because disabling the ESXi firewall exposes the host to network threats. Option D is incorrect because DCUI (Direct Console User Interface) should be accessed only via the local console, not from the network; allowing DCUI access from trusted management networks still poses a security risk.

For FIPS 140-2 compliance, the ESXi host must be placed in lockdown mode to restrict direct root access and ensure only authorized users via vCenter can manage the host. Option A is incorrect because disabling the ESXi Shell and SSH services alone does not achieve FIPS compliance; lockdown mode is the required step. Option C is incorrect because host profiles can apply security settings but do not enforce lockdown mode for FIPS.

Option D is incorrect because FIPS mode is not configured in the host's BIOS; it is a software-level cryptographic compliance enforced by ESXi lockdown and other settings.

Options B and D are correct. vMotion encryption requires that both source and destination ESXi hosts run version 6.5 or later (B), and the virtual machine must have virtual hardware version 11 or later (D). Option A is incorrect because vMotion encryption does not require hosts from the same vendor. Option C is incorrect because a Key Management Server (KMS) is not required for vMotion encryption; it is only required for VM-level encryption.

Option E is incorrect because the VM does not need encryption enabled at the VM level for vMotion encryption; vMotion encryption is configured at the cluster or host level.

The most likely cause is that the new KMS certificate was not imported into the vCenter Server trust store. Even though the KMS appliance is reachable and the new certificate is installed on the KMS, vCenter Server must trust the KMS certificate to establish a secure connection. Without the certificate in the trust store, vCenter considers the KMS unhealthy, leading to the 'No key providers are available' error.

The vSAN encryption keys are not lost during certificate renewal—they remain stored on the KMS. Recreating the KMS cluster is unnecessary because the configuration is still valid, and restarting vCenter services would not resolve the trust issue.

Normal Lockdown Mode disables the local root account for DCUI access, but it allows you to pre-configure a DCUI access list with specific users or groups (local or AD) who can still log in via DCUI. By adding a user to this list before enabling Lockdown Mode, the administrator could have gained DCUI access during the outage. Option A is incorrect because the vSphere Web Client does not have an option to add host exceptions for DCUI; the DCUI access list must be configured directly on the host or via host profile.

Option C is incorrect because Strict Lockdown Mode disables all local accounts, including the DCUI access list, making DCUI entirely unavailable. Option D is incorrect because disabling Lockdown Mode requires vCenter Server access, which is unavailable during the outage.

When the vCenter Server machine SSL certificate is replaced, each ESXi host must trust the certificate's issuing CA. If one host's trusted root certificate store does not contain the new certificate's CA certificate, TLS verification fails, causing vCenter to appear disconnected from that host. Option A is incorrect because the Common Name is used for server identity, but it does not need to match the host's IP; the issue is trust of the CA, not name mismatch.

Option C is incorrect because system time differences would affect all hosts, not just one, and typically cause certificate validity errors, not trust issues. Option D is incorrect because the machine SSL certificate is distinct from SSO certificates; replacing it does not affect SSO if other certificates are unchanged.

The command output shows that lockdown mode is enabled, root is listed as an exception user, and the allowed exception commands are 'terminal' and 'vimsh'. In normal lockdown mode (not strict), exception users retain access to the DCUI and SSH using only the permitted commands. Therefore, root can still access the DCUI or SSH via the allowed commands, making option A correct.

Option B is incorrect because lockdown mode is indeed enabled. Option C is incorrect because the exception user can only run the specified commands, not any command. Option D is incorrect because the presence of exception commands indicates normal lockdown mode, not strict lockdown.

For vMotion encryption to work, the virtual machine must have hardware version 11 or later. This requirement is documented for vSphere 6.5 and later, which support vMotion encryption. Option A is incorrect because there is no requirement to allocate additional memory for vMotion encryption; cryptographic operations for vMotion are handled by the host's CPU.

Option B is incorrect because vMotion encryption is supported on ESXi 6.5 and later, not specifically version 7.0 or later. Option C is incorrect because VM Encryption is a separate feature that encrypts the VM's files at rest, not vMotion traffic. Therefore, ensuring VMs have virtual hardware version 11 or later is necessary for encrypted vMotion.

The correct answers are A and D. Implement a backup solution with immutable snapshots and offsite storage (A) ensures backups cannot be deleted or encrypted by ransomware, enabling recovery. Enabling vSAN encryption (D) protects data at rest, preventing unauthorized access if storage is compromised.

Option B is wrong because vMotion encryption protects data in transit during migration, not against ransomware. Option C is wrong because VM snapshots are not backups; they can be deleted by ransomware and do not provide long-term recovery. Option E is wrong because allowing all outbound traffic by default violates the principle of least privilege and increases attack surface.

To enforce strong ciphers and disable SSLv3 on a vCenter Server, the administrator should modify the Tomcat server.xml file to restrict allowed protocols and ciphers (Option E). Additionally, if the vCenter Server is running on Windows, editing the registry to disable SSLv3 is also required (Option B). Option A is incorrect because the Certificate Manager replaces certificates but does not configure cipher suites.

Option C is wrong because disabling TLS 1.2 and enabling only TLS 1.3 may break compatibility and is not the standard method. Option D is incorrect as there is no such setting in the vSphere Web Client under Administration > Security.

Enabling lockdown mode on an ESXi host disables direct root access via SSH and DCUI. Additionally, removing the root user from the permissions list ensures that root cannot be granted access through exception lists. Option A is wrong because setting lockdown mode with root exception would still allow root access under specific circumstances.

Option B is wrong because disabling DCUI and SSH services does not prevent root access via other means (e.g., vCenter) and does not enforce persistent restriction. Option C is wrong because configuring SSO with Smart Card authentication does not affect local root access at the ESXi host level.

User1 has permissions only on host1, not on host2.domain.com. The 'Limited' role, which includes 'Read' and 'Console interaction' privileges, is assigned at the host level for host1 only, so it does not apply to host2. Therefore, user1 lacks any permissions on host2, preventing console access to VMs running there.

Option A is incorrect because the 'Limited' role does include 'Console interaction' privilege as stated. Option C is incorrect because the permissions are applied at the host level (as shown in the exhibit), not at the datacenter level. Option D is incorrect because there is no requirement or indication that user1 needs to be added to the admin group; the issue is simply lack of permissions on the target host.

The error 'Unable to decrypt the encrypted virtual machine upon re-registration. Reason: The KMS server is unreachable' indicates that the ESXi host cannot contact the KMS server to retrieve the VM's encryption key. Since other encrypted VMs on the same host power on successfully, the host can reach the KMS cluster, but this specific VM's encryption key may have been issued by a different KMS server (e.g., an older or alternative KMS) that is now unavailable.

The key ID stored in the VM's metadata points to that unreachable server, causing the failure. Option A is incorrect because if the vCenter KMS cluster configuration were deleted, all VMs would be affected. Option B is incorrect because modifying the storage policy does not change the existing encryption key; the VM remains encrypted with its original key.

Option C is incorrect because vTA attestation is separate from KMS key retrieval; the error message is specific to KMS unavailability.

When a new ESXi host is added to the cluster, it must be added to the Key Provider's trust list or the KMS must be configured to trust the host's certificate. Without this, the host cannot retrieve keys from the KMS, even though it has network connectivity and is properly licensed. Option B is incorrect: a firewall issue would typically cause a connection timeout or refusal error, not a 'key provider unavailable' error.

Option C is incorrect because the host is verified to have the correct encryption license. Option D is incorrect because the error indicates the KMS is not available to that host, not a policy mismatch.

Enable FIPS 140-2 mode on the vCenter Server appliance. When deploying vCenter Server in a DMZ, enabling FIPS 140-2 mode ensures that the appliance uses only FIPS-approved cryptographic algorithms, enhancing security and compliance. Option A is incorrect because joining the vCenter Server to the corporate Active Directory domain exposes it to domain-related attacks and increases the attack surface in the DMZ.

Option B is incorrect because enabling SSH for remote administration is a security risk; SSH should be disabled unless absolutely necessary, and even then, it should be tightly controlled. Option D is incorrect because deleting the root user account is not a best practice; the root account is essential for system recovery and maintenance, and the recommended approach is to limit its use and enforce strong passwords.

To see objects in vCenter, a user must have the 'System > View' privilege on the parent folder. The user can see VMs in the Production folder because that folder likely inherits the 'System > View' privilege or has it explicitly. However, the Development folder does not have the 'System > View' privilege assigned to the user or group, so the VMs inside are invisible.

Option A is incorrect because there is no evidence of another group denying access, and propagation is enabled. Option C is incorrect because 'Folder > Create' is not required to view existing folders or VMs. Option D is incorrect because if 'No Access' were assigned, the user would not see any objects at all; the issue is specifically the lack of 'View' on the Development folder.

NIOC traffic classes assign bandwidth shares and limits per class. If the VM's traffic (legacy application) is placed in the management traffic class, it will be subject to the bandwidth constraints of that class, which may cause connectivity issues if the application requires more bandwidth or different QoS. Option A is incorrect because NIOC does not block MAC addresses; MAC address blocking is a security policy on the distributed switch port group.

Option C is incorrect because NIOC supports jumbo frames; jumbo frames are configured at the VM or vSwitch level and do not conflict with NIOC. Option D is incorrect because promiscuous mode is a port group security setting unrelated to NIOC; NIOC manages bandwidth allocation and does not interfere with promiscuous mode.

When the key provider's certificate is expired or invalid, the ESXi hosts may be able to reach the key provider over the network, but the SSL/TLS handshake fails, resulting in a 'Not Responding' status. Option A is wrong because an expired vCenter certificate would affect vCenter operations but not the ESXi hosts' direct communication with the key provider. Option B is wrong: Port 443 is commonly used for HTTPS, but if firewall blocked port 443, the status would typically show as 'Unreachable' or 'Connection Refused', not 'Not Responding'.

Option C is wrong: ESXi hosts do not need internet access for an on-premises key provider; they only need local network connectivity.

The maxKeepAliveTimeout default of 100 seconds may be too low for long-lived HTTP connections, causing timeouts. Increasing it to 180 seconds allows the server to keep idle connections open longer, reducing the likelihood of timeouts. Option B is incorrect because restarting the rhttpproxy service does not change the timeout value; it only temporarily resets the service, which would not address the underlying timeout issue.

Option C is incorrect because enabling a proxy server is unrelated to HTTP connection timeouts; it would add an intermediary but not resolve the keepalive timeout. Option D is incorrect because setting maxKeepAliveTimeout to 0 disables HTTP keepalive entirely, which would force new connections for every request, likely increasing latency and timeouts rather than resolving them.

The ESXi host firewall can be configured with rule sets that allow traffic only from specific IP addresses or subnets. This is done by editing the firewall rules for the required services and specifying the allowed IP addresses. Option A is incorrect because vSphere HA is a high availability feature that does not manage firewall settings or control management traffic.

Option C is incorrect because the DCUI (Direct Console User Interface) is used for local console configuration, not for setting firewall rules. Option D is incorrect because allowing all incoming connections would be insecure and not restrict access to a specific management subnet.

Creating a custom role with the required Datastore privileges and assigning it at the cluster level provides the most granular, least-privileged access to manage only that cluster. Option B is incorrect because the ReadOnly role does not include Datastore management privileges; it only allows viewing objects. Option C is incorrect because global permissions apply to all objects in vCenter, granting access to all clusters and datastores, which violates the principle of least privilege.

Option D is incorrect because adding users to the local Administrators group grants full administrative access to vCenter, far exceeding the needed permissions for datastore management.

Options B, D, and E are correct. Enabling lockdown mode restricts direct root access to the ESXi host via the DCUI, enhancing security. Applying a host profile ensures consistent security configurations across hosts.

Disabling ESXi Shell and SSH services reduces the attack surface by eliminating remote CLI access. Option A is incorrect because increasing memory resource allocation for management VMs does not directly improve security; it is a resource management practice. Option C is incorrect because although SNMPv3 provides authentication and encryption, enabling SNMP services is not a standard hardening measure and is often disabled to reduce the attack surface.

After the signed certificate is received from the CA, it must be imported into the appropriate VECS store (e.g., the machine SSL certificate store). Then, the certificate-manager utility (located at /usr/lib/vmware-vmca/bin/certificate-manager) must be run to update all vCenter services to use the new certificate. Option A is incorrect because generating a new CSR after replacement is unnecessary.

Option B is incorrect because restarting the vCenter Management Agent only affects that single service, not all services that need the new certificate. Option D is incorrect because the certificate-manager utility is used for CA-signed certificates, not certool (which is for self-signed certificates).