vSphere Security practice questions

An administrator is troubleshooting a situation where a virtual machine cannot be powered on. The error message indicates insufficient permissions. The VM is in a folder named 'Production' and the administrator has been assigned a custom role with 'Virtual machine > Power On' permission at the folder level. However, the VM is also in a resource pool. What additional permission is most likely missing?

Trap 1: Network > Assign network permission on the network

Assign network is not required for power on.

Trap 2: Datastore > Allocate space permission on the datastore

Allocate space is not required for power on.

Trap 3: Virtual machine > Configuration permission on the VM

Configuration is not needed for power on.

A
Network > Assign network permission on the network
Why wrong: Assign network is not required for power on.
B
Resource > Assign virtual machine to resource pool permission on the resource pool
This permission is necessary to assign the VM to the resource pool during power on.
C
Datastore > Allocate space permission on the datastore
Why wrong: Allocate space is not required for power on.
D
Virtual machine > Configuration permission on the VM
Why wrong: Configuration is not needed for power on.

Question 2hardmultiple choice

A security audit reveals that an ESXi host has been compromised due to an attacker gaining root access via the DCUI. The host is configured with a default DCUI password. Which security best practice should have been implemented to prevent this?

Trap 1: Disable the DCUI service

Disabling DCUI prevents local console access, which may be needed.

Trap 2: Set a strong password for the root account

While important, it does not prevent all attack vectors.

Trap 3: Disable SSH access

SSH is not directly related to DCUI.

A
Configure the DCUI lockdown mode to 'Normal'
Normal lockdown mode restricts DCUI access to local console only.
B
Disable the DCUI service
Why wrong: Disabling DCUI prevents local console access, which may be needed.
C
Set a strong password for the root account
Why wrong: While important, it does not prevent all attack vectors.
D
Disable SSH access
Why wrong: SSH is not directly related to DCUI.

Question 3easymultiple choice

A vSphere administrator needs to ensure that all HTTPS traffic to ESXi hosts is encrypted using TLS 1.2. Where should the administrator configure the minimum TLS version?

Trap 1: Security Profile in the vSphere Client

Security Profile shows services, not TLS settings.

Trap 2: vCenter Server Appliance (VAMI) web interface

VAMI is for vCenter Server, not ESXi.

Trap 3: ESXi Firewall rules

Firewall does not control TLS version.

A
Host Advanced Settings (Config.HostAgent.plugins.vimsvc.auth.minTLSVersion)
This advanced setting controls the minimum TLS version.
B
Security Profile in the vSphere Client
Why wrong: Security Profile shows services, not TLS settings.
C
vCenter Server Appliance (VAMI) web interface
Why wrong: VAMI is for vCenter Server, not ESXi.
D
ESXi Firewall rules
Why wrong: Firewall does not control TLS version.

Open the full VLAN trunking answer →

Question 4mediummultiple choice

An administrator is configuring a distributed switch and needs to ensure that all virtual machine traffic on a specific VLAN is isolated. The administrator creates a port group with VLAN ID 100. However, a security scanner reports that packets from this VLAN are appearing on other VLANs. Which security policy setting on the distributed switch should the administrator verify?

Trap 1: MAC address changes

This controls whether guest can change MAC.

Trap 2: Forged transmits

Forged transmits control MAC spoofing.

Trap 3: Promiscuous mode

Promiscuous mode allows all traffic to be seen.

A
MAC address changes
Why wrong: This controls whether guest can change MAC.
B
Forged transmits
Why wrong: Forged transmits control MAC spoofing.
C
VLAN trunking
VLAN trunking ensures proper tagging.
D
Promiscuous mode
Why wrong: Promiscuous mode allows all traffic to be seen.

Question 5hardmultiple choice

A vSphere environment uses Active Directory for authentication. The administrator notices that users from a specific AD group cannot log in to the vCenter Server, although other AD users can. The group is added to vCenter Server with the correct permissions. What is the most likely cause?

Trap 1: The users are not members of the vCenter Single Sign-On domain

SSO domain is for local users.

Trap 2: The user accounts have expired passwords

Would affect individual users, not entire group.

Trap 3: The group is nested within another group

Nesting is usually supported.

A
The users are not members of the vCenter Single Sign-On domain
Why wrong: SSO domain is for local users.
B
The user accounts have expired passwords
Why wrong: Would affect individual users, not entire group.
C
The group is nested within another group
Why wrong: Nesting is usually supported.
D
The domain of the group is not configured as an identity source in vCenter Single Sign-On
Without the identity source, authentication fails.

Question 6easymulti select

Which TWO actions are recommended to secure the vCenter Server Appliance (VCSA)?

Trap 1: Enable the auto-lock feature for the admin account

Auto-lock is not a VCSA feature.

Trap 2: Configure the password policy for local accounts

Already enforced by default.

Trap 3: Enable FIPS 140-2 compliance mode

Optional, not always recommended.

A
Enable the auto-lock feature for the admin account
Why wrong: Auto-lock is not a VCSA feature.
B
Change the default 'root' password
Default passwords should be changed.
C
Disable SSH access
Disabling SSH reduces attack surface.
D
Configure the password policy for local accounts
Why wrong: Already enforced by default.
E
Enable FIPS 140-2 compliance mode
Why wrong: Optional, not always recommended.

Question 7mediummulti select

Which THREE security features are available in vSphere Trust Authority (vTA)?

Trap 1: Integration with Active Directory for authentication

vTA does not handle AD integration.

Trap 2: Encryption of vMotion traffic

vMotion encryption is separate from vTA.

A
Attestation of ESXi hosts
vTA attests host integrity.
B
Integration with Active Directory for authentication
Why wrong: vTA does not handle AD integration.
C
Trusted Platform Module (TPM) based attestation
vTA uses TPM for attestation.
D
Encryption of vMotion traffic
Why wrong: vMotion encryption is separate from vTA.
E
Key provider services for virtual machines
vTA acts as a key server.

Read the full NAT/PAT explanation →

Question 8hardmultiple choice

A multinational corporation runs a vSphere environment with 100 ESXi hosts managed by a single vCenter Server. The security team mandates that all virtual machine disks (VMDKs) must be encrypted at rest. The administrator enables vSphere Virtual Machine Encryption and creates a Key Management Server (KMS) cluster. After encrypting a test VM, the VM powers on successfully, but the administrator notices that the VM's configuration files (VMX, NVRAM) are not encrypted. The security policy requires that all VM files, including configuration files, be encrypted. The administrator checks the VM storage policy and sees that the policy is set to 'VM Encryption Policy' with 'Disk Encryption' enabled. What should the administrator do to ensure the entire VM is encrypted?

Trap 1: Enable encryption on the datastore where the VM resides

Datastore encryption is not a feature.

Trap 2: Add a second KMS cluster for redundancy

Redundancy does not encrypt config files.

Trap 3: Enable vSphere Host Encryption on each ESXi host

Host encryption encrypts host data, not VM config files.

A
Modify the VM storage policy to include encryption of VM home files
The policy must include 'Virtual Machine Home' encryption.
B
Enable encryption on the datastore where the VM resides
Why wrong: Datastore encryption is not a feature.
C
Add a second KMS cluster for redundancy
Why wrong: Redundancy does not encrypt config files.
D
Enable vSphere Host Encryption on each ESXi host
Why wrong: Host encryption encrypts host data, not VM config files.

Question 9mediummultiple choice

A vSphere administrator needs to ensure that all virtual machine disks are encrypted at rest. The environment uses a KMS cluster with multiple KMIP-compliant servers. The administrator has already configured a storage policy with encryption enabled. However, newly created VMs on a particular datastore still show unencrypted disks. What is the most likely cause?

Trap 1: The datastore is a vSAN datastore, which does not support VM-level…

vSAN supports encryption natively, but VM-level encryption is also supported on vSAN.

Trap 2: The KMS cluster must have at least two KMS servers to function…

A single KMS server is sufficient; multiple servers provide redundancy.

Trap 3: The datastore is formatted with VMFS6, which does not support…

VMFS6 supports encryption.

A
The datastore is a vSAN datastore, which does not support VM-level encryption.
Why wrong: vSAN supports encryption natively, but VM-level encryption is also supported on vSAN.
B
The KMS cluster must have at least two KMS servers to function correctly.
Why wrong: A single KMS server is sufficient; multiple servers provide redundancy.
C
The datastore is formatted with VMFS6, which does not support encryption.
Why wrong: VMFS6 supports encryption.
D
The storage policy with encryption is not assigned to the VMs or their home namespace.
The encryption-enabled storage policy must be explicitly assigned; otherwise, the default storage policy is used.

Question 10hardmulti select

A security audit reveals that a vCenter Server has weak TLS configuration. The administrator needs to enforce strong ciphers and disable SSLv3. Which two steps should the administrator take? (Choose two.)

Trap 1: Edit the registry on the vCenter Server to disable SSLv3.

vCenter Server is a Linux appliance; registry edits are not applicable.

Trap 2: Disable TLS 1.2 and enable only TLS 1.3 on all ESXi hosts.

Disabling TLS 1.2 may cause compatibility issues; it's better to enable strong ciphers on existing TLS versions.

Trap 3: Configure the TLS settings in the vSphere Web Client under…

The vSphere Web Client does not have settings for TLS ciphers.

A
Use the vSphere Certificate Manager utility to replace the machine SSL certificate with a new one that uses strong ciphers.
This utility can update the TLS configuration.
B
Edit the registry on the vCenter Server to disable SSLv3.
Why wrong: vCenter Server is a Linux appliance; registry edits are not applicable.
C
Disable TLS 1.2 and enable only TLS 1.3 on all ESXi hosts.
Why wrong: Disabling TLS 1.2 may cause compatibility issues; it's better to enable strong ciphers on existing TLS versions.
D
Configure the TLS settings in the vSphere Web Client under Administration > Security.
Why wrong: The vSphere Web Client does not have settings for TLS ciphers.
E
Modify the Tomcat server.xml file on the vCenter Server to restrict ciphers and protocols.
This configures the Tomcat web server to use only strong ciphers.

Question 11easymultiple choice

An administrator is troubleshooting a failed attempt to add an ESXi host to a vCenter Server domain. The error message states: 'The host's certificate has been tampered with or is invalid.' What is the most likely cause?

Trap 1: The vCenter Server's account lockout policy has been triggered.

Account lockout would give an authentication failure, not a certificate error.

Trap 2: The ESXi host's SSH keys have been rotated.

SSH keys are separate from SSL certificates.

Trap 3: The ESXi host's certificate has expired.

An expired certificate would give a different error, not 'tampered with'.

A
The vCenter Server's account lockout policy has been triggered.
Why wrong: Account lockout would give an authentication failure, not a certificate error.
B
The ESXi host's SSH keys have been rotated.
Why wrong: SSH keys are separate from SSL certificates.
C
The ESXi host's certificate has expired.
Why wrong: An expired certificate would give a different error, not 'tampered with'.
D
The ESXi host's certificate thumbprint does not match the thumbprint stored in vCenter Server.
This mismatch causes the 'tampered' error.

Question 12hardmultiple choice

A company has a vSphere environment with 20 ESXi hosts and 500 VMs. The security team mandates that all administrative access to vCenter Server must be through a single, highly restricted account with multi-factor authentication (MFA). The account must be used for both the vSphere Client and API integrations. Which step should the administrator take?

Trap 1: Configure the built-in administrator account to require smart card…

Smart card authentication is not equivalent to MFA and may not be supported for API integrations.

Trap 2: Create a new local account and configure it as a member of the…

Third-party MFA on the OS is not supported and would not cover API access.

Trap 3: Disable the built-in administrator account and create a new local…

Local accounts do not support MFA; disabling the built-in account can cause issues.

A
Configure the built-in administrator account to require smart card authentication.
Why wrong: Smart card authentication is not equivalent to MFA and may not be supported for API integrations.
B
Integrate vCenter Server with an external identity provider (e.g., ADFS, Okta) that supports MFA, and use a service account with MFA for API access.
External identity providers can enforce MFA and work with both UI and API access.
C
Create a new local account and configure it as a member of the Administrators group, then enforce MFA via a third-party tool on the vCenter Server OS.
Why wrong: Third-party MFA on the OS is not supported and would not cover API access.
D
Disable the built-in administrator account and create a new local account with the same privileges.
Why wrong: Local accounts do not support MFA; disabling the built-in account can cause issues.

Question 13hardmultiple choice

A large financial institution runs a vSphere 7.0 environment with 100 ESXi hosts and 2,000 VMs. The security team has identified that several VMs are vulnerable to a critical side-channel attack that requires disabling hyperthreading on the ESXi hosts. The administrator needs to implement a solution that minimizes performance impact while ensuring compliance. The environment uses DRS clusters with varying workloads: some VMs are CPU-intensive (financial modeling) and others are memory-bound (database servers). The administrator cannot afford to take hosts offline for maintenance during business hours. The change must be implemented within 48 hours. Which course of action should the administrator take?

Trap 1: Use a vSphere DRS rule to disable hyperthreading for all VMs in the…

vSphere does not have a DRS rule to disable hyperthreading; it is a BIOS-level setting.

Trap 2: Delay the change and schedule a maintenance window for the next…

This does not meet the 48-hour requirement.

Trap 3: Disable hyperthreading on all hosts simultaneously using a vSphere…

Rebooting all hosts at once would cause significant downtime and is not feasible within the 48-hour window.

A
Use a vSphere DRS rule to disable hyperthreading for all VMs in the cluster, avoiding the need to modify host BIOS.
Why wrong: vSphere does not have a DRS rule to disable hyperthreading; it is a BIOS-level setting.
B
Place each host in maintenance mode individually, disable hyperthreading in the host BIOS, reboot the host, and then move to the next host. Rebalance VMs after all hosts are updated.
This minimizes downtime as VMs are migrated off each host before reboot, and can be completed within 48 hours.
C
Delay the change and schedule a maintenance window for the next month when business impact is lower.
Why wrong: This does not meet the 48-hour requirement.
D
Disable hyperthreading on all hosts simultaneously using a vSphere Cluster feature, then reboot all hosts at once during off-peak hours.
Why wrong: Rebooting all hosts at once would cause significant downtime and is not feasible within the 48-hour window.

Question 14mediummultiple choice

A company is implementing vSphere 7.0 and wants to encrypt all vMotion traffic between ESXi hosts in a cluster. The cluster is not using any other encryption features. What is the minimum requirement to enable vMotion encryption?

Trap 1: A VM Encryption Key Management Server must be configured.

Incorrect: VM Encryption requires a KMS, but vMotion encryption does not.

Trap 2: The ESXi hosts must have a host profile applied with encryption…

Incorrect: Host profiles are not required for vMotion encryption.

Trap 3: The cluster must be configured with Enhanced vMotion Compatibility…

Incorrect: EVC is unrelated to vMotion encryption.

A
A VM Encryption Key Management Server must be configured.
Why wrong: Incorrect: VM Encryption requires a KMS, but vMotion encryption does not.
B
The ESXi hosts must be joined to an Active Directory domain.
Correct: vMotion encryption uses certificates from the domain to establish encrypted tunnels.
C
The ESXi hosts must have a host profile applied with encryption enabled.
Why wrong: Incorrect: Host profiles are not required for vMotion encryption.
D
The cluster must be configured with Enhanced vMotion Compatibility (EVC).
Why wrong: Incorrect: EVC is unrelated to vMotion encryption.

Question 15hardmulti select

Which TWO actions are required to enable encrypted vSphere vMotion for all virtual machines in a cluster?

Trap 1: Configure a Key Management Server (KMS) for the cluster.

Incorrect: KMS is not required for vMotion encryption.

Trap 2: Enable Storage DRS on the cluster.

Incorrect: Storage DRS does not affect vMotion encryption.

Trap 3: Set the vMotion encryption policy to 'Encrypt when supported' in…

Incorrect: This does not guarantee encryption for all VMs.

A
Set the vMotion encryption policy to 'Encrypt all data' in the cluster settings.
Correct: This forces encryption for all vMotion traffic in the cluster.
B
Configure a Key Management Server (KMS) for the cluster.
Why wrong: Incorrect: KMS is not required for vMotion encryption.
C
Enable Storage DRS on the cluster.
Why wrong: Incorrect: Storage DRS does not affect vMotion encryption.
D
Ensure all ESXi hosts in the cluster are joined to the same Active Directory domain.
Correct: Domain membership is required for certificate-based key exchange.
E
Set the vMotion encryption policy to 'Encrypt when supported' in the cluster settings.
Why wrong: Incorrect: This does not guarantee encryption for all VMs.

Question 16easymultiple choice

Refer to the exhibit. An administrator runs the vmkfstools command on an ESXi host and views the output. Which conclusion can be drawn from the output?

Exhibit

Refer to the exhibit.
```
vmkfstools -P /vmfs/volumes/datastore1/vm/vm.vmx
```

Output:
```
File system label: datastore1
File system type: VMFS-6
Volume capacity: 1024000 MB
Volume free: 512000 MB
Disk capacity: 1024000 MB
Disk free: 512000 MB
Block size: 1 MB
```

Trap 1: The VMDK file is thin provisioned.

Incorrect: The command shows datastore capacity, not VMDK provisioning.

Trap 2: The datastore has a block size of 1 MB, which is the maximum for…

Incorrect: VMFS-6 supports larger block sizes.

Trap 3: The virtual machine's disk is encrypted.

Incorrect: vmkfstools -P does not show encryption status.

A
The datastore has approximately 50% free space.
Correct: Volume free is half of volume capacity.
B
The VMDK file is thin provisioned.
Why wrong: Incorrect: The command shows datastore capacity, not VMDK provisioning.
C
The datastore has a block size of 1 MB, which is the maximum for VMFS-6.
Why wrong: Incorrect: VMFS-6 supports larger block sizes.
D
The virtual machine's disk is encrypted.
Why wrong: Incorrect: vmkfstools -P does not show encryption status.

Question 17mediumdrag order

Order the steps to take a snapshot of a virtual machine.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 18mediummatching

Match each vSphere networking component to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Logical grouping of ports with common configuration

Network interface for vSphere services like vMotion

Physical NIC connected to a virtual switch

Segments network traffic at Layer 2

Combining multiple uplinks for load balancing or failover

Question 19easymultiple choice

A company wants to integrate vCenter Server with an external identity source to allow users to authenticate using their corporate credentials. The administrator must ensure that authentication traffic is encrypted. Which solution should the administrator implement?

Trap 1: Local OS authentication on vCenter Server

Local authentication does not use corporate credentials.

Trap 2: Active Directory over NTLM

NTLM is not a supported identity source type for vCenter Single Sign-On.

Trap 3: Active Directory over LDAP

LDAP transmits credentials in plaintext, which is not encrypted.

A
Local OS authentication on vCenter Server
Why wrong: Local authentication does not use corporate credentials.
B
Active Directory over NTLM
Why wrong: NTLM is not a supported identity source type for vCenter Single Sign-On.
C
Active Directory over LDAPS
LDAPS uses SSL/TLS to encrypt authentication traffic.
D
Active Directory over LDAP
Why wrong: LDAP transmits credentials in plaintext, which is not encrypted.

Question 20mediummultiple choice

An administrator is troubleshooting a failed VM encryption operation. The key provider status shows as 'Not Responding' in the vSphere Web Client. The administrator has verified network connectivity between the ESXi hosts and the key provider. What is the most likely cause of the failure?

Trap 1: The vCenter Server certificate has expired

vCenter Server certificate expiration does not affect key provider status.

Trap 2: The firewall on the key provider is blocking port 443

A blocked port would show as 'Unreachable', not 'Not Responding'.

Trap 3: The ESXi hosts cannot reach the internet

Internet access is not required for on-premises KMS.

A
The vCenter Server certificate has expired
Why wrong: vCenter Server certificate expiration does not affect key provider status.
B
The firewall on the key provider is blocking port 443
Why wrong: A blocked port would show as 'Unreachable', not 'Not Responding'.
C
The ESXi hosts cannot reach the internet
Why wrong: Internet access is not required for on-premises KMS.
D
The key provider certificate is expired or invalid
Expired or invalid KMS certificate causes hosts to reject connections.