ESXi Host Security Hardening Best Practices
Which THREE security hardening measures should be applied to an ESXi host? (Choose three.)
Quick Answer
The answer is to disable ESXi Shell and SSH services, enable lockdown mode, and apply a host profile. These three measures directly reduce the attack surface by eliminating unnecessary remote access points, enforce strict authentication through lockdown mode, and ensure consistent security baselines across all hosts via host profiles. On the VMware Certified Professional Data Center Virtualization VCP-DCV exam, this question tests your understanding of the principle of least privilege and configuration drift prevention—common traps include confusing SNMP (a monitoring tool, not a security control) with a hardening measure, or thinking that increasing memory workload improves security. Remember that any service left running, especially SSH, is a potential entry vector for attackers. A useful memory tip is “Lock, Disable, Profile”—lockdown mode restricts direct access, disable shell and SSH services, and use a host profile to lock in those settings across your cluster.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable lockdown mode
Options B, D, and E are correct. Enabling lockdown mode restricts direct root access to the ESXi host via the DCUI, enhancing security. Applying a host profile ensures consistent security configurations across hosts. Disabling ESXi Shell and SSH services reduces the attack surface by eliminating remote CLI access. Option A is incorrect because increasing memory resource allocation for management VMs does not directly improve security; it is a resource management practice. Option C is incorrect because although SNMPv3 provides authentication and encryption, enabling SNMP services is not a standard hardening measure and is often disabled to reduce the attack surface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Increase memory resource allocation for management VMs
Why it's wrong here
Does not enhance security.
- ✓
Enable lockdown mode
Why this is correct
Restricts direct host access.
- ✗
Enable SNMP v3
Why it's wrong here
SNMP is for monitoring, not primary hardening.
- ✓
Apply a host profile for security settings
Why this is correct
Ensures consistent configuration.
- ✓
Disable ESXi Shell and SSH services
Why this is correct
Reduces attack surface.
Go deeper
Related to this question
About these practice questions
One of 498 original VCP-DCV practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on VCP-DCV
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security audit reveals that an ESXi host has been compromised due to an attacker gaining root access via the DCUI. The host is configured with a default DCUI password. Which security best practice should have been implemented to prevent this?
hard- ✓ A.Configure the DCUI lockdown mode to 'Normal'
- B.Disable the DCUI service
- C.Set a strong password for the root account
- D.Disable SSH access
Why A: DCUI Lockdown Mode 'Normal' disables direct root access via the Direct Console User Interface (DCUI) by requiring authentication through vCenter Single Sign-On (SSO). This prevents an attacker from using the default or weak DCUI password to gain root access, as the root account is no longer accepted for DCUI login. The mode still allows authorized vCenter administrators to access the host via the DCUI using their SSO credentials, maintaining manageability while eliminating the root password attack vector.
Variation 2. Which TWO of the following are best practices for securing ESXi hosts? (Choose two.)
medium- A.Grant the root user direct permissions on all hosts.
- B.Disable the ESXi firewall to simplify management.
- ✓ C.Enable lockdown mode on the host.
- D.Allow DCUI access from trusted management networks.
- ✓ E.Configure Active Directory integration for host authentication.
Why C: Options C and E are correct. Enabling lockdown mode (C) restricts direct root access to the host, requiring administrators to use vCenter Server for management, which is a security best practice. Configuring Active Directory integration (E) allows centralized user management and authentication, avoiding the need for local accounts. Option A is incorrect because granting root user direct permissions on all hosts bypasses security controls. Option B is incorrect because disabling the ESXi firewall exposes the host to network threats. Option D is incorrect because DCUI (Direct Console User Interface) should be accessed only via the local console, not from the network; allowing DCUI access from trusted management networks still poses a security risk.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.