- A
Set the vMotion encryption policy to 'Encrypt all data' in the cluster settings.
Required: Setting 'Encrypt all data' in the cluster forces encryption for all vMotion migrations, ensuring data protection.
- B
Configure a Key Management Server (KMS) for the cluster.
Why wrong: Incorrect: A KMS is required for VM encryption or encrypted vSAN, not for vMotion encryption.
- C
Enable Storage DRS on the cluster.
Why wrong: Incorrect: Storage DRS is unrelated to vMotion encryption; it deals with storage load balancing.
- D
Ensure all ESXi hosts in the cluster are joined to the same Active Directory domain.
Why wrong: Incorrect: Active Directory domain membership is not required. Hosts use built-in certificates for vMotion encryption; domain membership is an alternative for certificate trust but not a requirement.
- E
Set the vMotion encryption policy to 'Encrypt when supported' in the cluster settings.
Why wrong: Incorrect: 'Encrypt when supported' only encrypts when both hosts support it, not enforcing encryption for all VMs.
How to Enable Encrypted vSphere vMotion for All VMs in a Cluster
This VCP-DCV practice question tests your understanding of vsphere security. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: vMotion encryption. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO actions are required to enable encrypted vSphere vMotion for all virtual machines in a cluster?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Set the vMotion encryption policy to 'Encrypt all data' in the cluster settings.
Option A is correct because setting the vMotion encryption policy to 'Encrypt all data' enforces encryption for all vMotion migrations in the cluster, using TLS 1.2 and host-based certificates. Option D is incorrect because Active Directory domain membership is not required; vMotion encryption works with the default host certificates as long as the hosts trust each other's certificates, which is achieved by default in a cluster. A KMS (Option B) is not needed for vMotion encryption, only for VM-level encryption. Storage DRS (Option C) is unrelated. Option E, 'Encrypt when supported', does not enforce encryption for all VMs; it only encrypts when both source and target hosts support it, which may not apply to all migrations.
Key principle: vMotion encryption
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the vMotion encryption policy to 'Encrypt all data' in the cluster settings.
Why this is correct
Required: Setting 'Encrypt all data' in the cluster forces encryption for all vMotion migrations, ensuring data protection.
Related concept
vMotion encryption
- ✗
Configure a Key Management Server (KMS) for the cluster.
Why it's wrong here
Incorrect: A KMS is required for VM encryption or encrypted vSAN, not for vMotion encryption.
- ✗
Enable Storage DRS on the cluster.
Why it's wrong here
Incorrect: Storage DRS is unrelated to vMotion encryption; it deals with storage load balancing.
- ✗
Ensure all ESXi hosts in the cluster are joined to the same Active Directory domain.
Why it's wrong here
Incorrect: Active Directory domain membership is not required. Hosts use built-in certificates for vMotion encryption; domain membership is an alternative for certificate trust but not a requirement.
- ✗
Set the vMotion encryption policy to 'Encrypt when supported' in the cluster settings.
Why it's wrong here
Incorrect: 'Encrypt when supported' only encrypts when both hosts support it, not enforcing encryption for all VMs.
Common exam traps
Common exam trap: answer the scenario, not the keyword
A common trap is thinking that vMotion encryption requires a KMS or Active Directory domain membership. In reality, vMotion encryption uses host-based certificates and TLS 1.2, so no external infrastructure is needed. Another trap is confusing 'Encrypt when supported' with 'Encrypt all data'; the former does not guarantee encryption for all migrations.
Detailed technical explanation
How to think about this question
vSphere vMotion encryption leverages TLS 1.2 with ephemeral Diffie-Hellman key exchange, using host certificates for authentication. The encryption policy is enforced at the cluster level via the vCenter Server, and when set to 'Encrypt all data', vCenter will refuse to initiate a vMotion if the destination host does not support encryption, ensuring a consistent security posture across the cluster.
KKey Concepts to Remember
- vMotion encryption
- Encrypt all data policy
- Host certificates
- TLS 1.2
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
vMotion encryption
Real-world example
How this comes up in practice
A practitioner preparing for the VCP-DCV exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. vMotion encryption Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Review vMotion encryption, then practise related VCP-DCV questions on the same topic to reinforce the concept.
- →
vSphere Security — study guide chapter
Learn the concepts, then practise the questions
- →
vSphere Security practice questions
Targeted practice on this topic area only
- →
All VCP-DCV questions
521 questions across all exam domains
- →
VMware Certified Professional Data Center Virtualization VCP-DCV study guide
Full concept coverage aligned to exam objectives
- →
VCP-DCV practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related VCP-DCV practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
vSphere Architecture, Products and Solutions practice questions
Practise VCP-DCV questions linked to vSphere Architecture, Products and Solutions.
Configure and Manage vSphere Networking practice questions
Practise VCP-DCV questions linked to Configure and Manage vSphere Networking.
Configure and Manage vSphere Storage practice questions
Practise VCP-DCV questions linked to Configure and Manage vSphere Storage.
vSphere Lifecycle Management practice questions
Practise VCP-DCV questions linked to vSphere Lifecycle Management.
vSphere Security practice questions
Practise VCP-DCV questions linked to vSphere Security.
vSphere Performance and Scaling practice questions
Practise VCP-DCV questions linked to vSphere Performance and Scaling.
VCP-DCV fundamentals practice questions
Practise VCP-DCV questions linked to VCP-DCV fundamentals.
VCP-DCV scenario practice questions
Practise VCP-DCV questions linked to VCP-DCV scenario.
VCP-DCV troubleshooting practice questions
Practise VCP-DCV questions linked to VCP-DCV troubleshooting.
Practice this exam
Start a free VCP-DCV practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this VCP-DCV question test?
vSphere Security — This question tests vSphere Security — vMotion encryption.
What is the correct answer to this question?
The correct answer is: Set the vMotion encryption policy to 'Encrypt all data' in the cluster settings. — Option A is correct because setting the vMotion encryption policy to 'Encrypt all data' enforces encryption for all vMotion migrations in the cluster, using TLS 1.2 and host-based certificates. Option D is incorrect because Active Directory domain membership is not required; vMotion encryption works with the default host certificates as long as the hosts trust each other's certificates, which is achieved by default in a cluster. A KMS (Option B) is not needed for vMotion encryption, only for VM-level encryption. Storage DRS (Option C) is unrelated. Option E, 'Encrypt when supported', does not enforce encryption for all VMs; it only encrypts when both source and target hosts support it, which may not apply to all migrations.
What should I do if I get this VCP-DCV question wrong?
Review vMotion encryption, then practise related VCP-DCV questions on the same topic to reinforce the concept.
What is the key concept behind this question?
vMotion encryption
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More VCP-DCV practice questions
- A vSphere administrator is managing a cluster with vLCM and receives a notification that a new ESXi patch is available.…
- An administrator needs to apply a security patch to a vLCM-managed cluster. The patch is available as an ESXi image in t…
- An administrator sees the above JSON output from a vLCM compliance report. What should the administrator do to resolve t…
- An administrator is planning to migrate from legacy baselines to vLCM for a cluster. Which TWO statements are true about…
- A vSphere administrator is using vLCM and needs to ensure that all hosts are compliant with the desired image. Which TWO…
- Which TWO actions are recommended to secure the vCenter Server Appliance (VCSA)?
Last reviewed: Jun 11, 2026
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.