- A
Use the vSphere Certificate Manager utility to replace the machine SSL certificate with a new one that uses strong ciphers.
This utility can update the TLS configuration.
- B
Edit the registry on the vCenter Server to disable SSLv3.
Why wrong: vCenter Server is a Linux appliance; registry edits are not applicable.
- C
Disable TLS 1.2 and enable only TLS 1.3 on all ESXi hosts.
Why wrong: Disabling TLS 1.2 may cause compatibility issues; it's better to enable strong ciphers on existing TLS versions.
- D
Configure the TLS settings in the vSphere Web Client under Administration > Security.
Why wrong: The vSphere Web Client does not have settings for TLS ciphers.
- E
Modify the Tomcat server.xml file on the vCenter Server to restrict ciphers and protocols.
This configures the Tomcat web server to use only strong ciphers.
Quick Answer
The answer is to modify the Tomcat server.xml file on the vCenter Server to restrict ciphers and protocols, and to use the vSphere Certificate Manager utility to replace the machine SSL certificate with one that enforces strong ciphers. These two steps directly address a weak TLS configuration by disabling SSLv3 and enforcing strong ciphers at both the application server and certificate levels. On the VCP-DCV exam, this scenario tests your understanding of vCenter Server security hardening, often appearing as a multi-select question where one trap is choosing to disable TLS entirely or relying solely on the vSphere Web Client settings. A common memory tip is to think of the Tomcat server.xml as the gatekeeper for protocol handshakes, while the Certificate Manager is the keymaster for cryptographic strength—both must be configured together to lock out weak protocols like SSLv3.
VCP-DCV vSphere Security Practice Question
This VCP-DCV practice question tests your understanding of vsphere security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security audit reveals that a vCenter Server has weak TLS configuration. The administrator needs to enforce strong ciphers and disable SSLv3. Which two steps should the administrator take? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Use the vSphere Certificate Manager utility to replace the machine SSL certificate with a new one that uses strong ciphers.
Option A is correct because the vSphere Certificate Manager utility can be used to replace the machine SSL certificate with one that enforces strong ciphers, directly addressing the weak TLS configuration. This utility manages certificate operations and allows administrators to specify cipher strength during certificate generation or replacement, ensuring compliance with security policies.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the vSphere Certificate Manager utility to replace the machine SSL certificate with a new one that uses strong ciphers.
Why this is correct
This utility can update the TLS configuration.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Edit the registry on the vCenter Server to disable SSLv3.
Why it's wrong here
vCenter Server is a Linux appliance; registry edits are not applicable.
- ✗
Disable TLS 1.2 and enable only TLS 1.3 on all ESXi hosts.
Why it's wrong here
Disabling TLS 1.2 may cause compatibility issues; it's better to enable strong ciphers on existing TLS versions.
- ✗
Configure the TLS settings in the vSphere Web Client under Administration > Security.
Why it's wrong here
The vSphere Web Client does not have settings for TLS ciphers.
- ✓
Modify the Tomcat server.xml file on the vCenter Server to restrict ciphers and protocols.
Why this is correct
This configures the Tomcat web server to use only strong ciphers.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse vCenter Server's Windows-based legacy behavior with its current Linux-based architecture, leading them to incorrectly select registry editing (Option B) instead of recognizing that Tomcat configuration files are the correct method.
Detailed technical explanation
How to think about this question
The vCenter Server uses Apache Tomcat as its web server, and TLS settings are controlled via the server.xml file, where connectors define allowed ciphers and protocols (e.g., sslEnabledProtocols="TLSv1.2" and ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). Disabling SSLv3 is critical because it is vulnerable to the POODLE attack (CVE-2014-3566), and strong ciphers like those using ECDHE and AES-GCM provide forward secrecy and resistance to known attacks. In a real-world scenario, failing to update both the certificate and the Tomcat configuration could leave the vCenter Server exposed to downgrade attacks even after certificate replacement.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the VCP-DCV exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
vSphere Security — study guide chapter
Learn the concepts, then practise the questions
- →
vSphere Security practice questions
Targeted practice on this topic area only
- →
All VCP-DCV questions
511 questions across all exam domains
- →
VMware Certified Professional Data Center Virtualization VCP-DCV study guide
Full concept coverage aligned to exam objectives
- →
VCP-DCV practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related VCP-DCV practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
vSphere Architecture, Products and Solutions practice questions
Practise VCP-DCV questions linked to vSphere Architecture, Products and Solutions.
Configure and Manage vSphere Networking practice questions
Practise VCP-DCV questions linked to Configure and Manage vSphere Networking.
Configure and Manage vSphere Storage practice questions
Practise VCP-DCV questions linked to Configure and Manage vSphere Storage.
vSphere Lifecycle Management practice questions
Practise VCP-DCV questions linked to vSphere Lifecycle Management.
vSphere Security practice questions
Practise VCP-DCV questions linked to vSphere Security.
vSphere Performance and Scaling practice questions
Practise VCP-DCV questions linked to vSphere Performance and Scaling.
VCP-DCV fundamentals practice questions
Practise VCP-DCV questions linked to VCP-DCV fundamentals.
VCP-DCV scenario practice questions
Practise VCP-DCV questions linked to VCP-DCV scenario.
VCP-DCV troubleshooting practice questions
Practise VCP-DCV questions linked to VCP-DCV troubleshooting.
Practice this exam
Start a free VCP-DCV practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this VCP-DCV question test?
vSphere Security — This question tests vSphere Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use the vSphere Certificate Manager utility to replace the machine SSL certificate with a new one that uses strong ciphers. — Option A is correct because the vSphere Certificate Manager utility can be used to replace the machine SSL certificate with one that enforces strong ciphers, directly addressing the weak TLS configuration. This utility manages certificate operations and allows administrators to specify cipher strength during certificate generation or replacement, ensuring compliance with security policies.
What should I do if I get this VCP-DCV question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More VCP-DCV practice questions
- A vSphere administrator is managing a cluster with vLCM and receives a notification that a new ESXi patch is available.…
- An administrator needs to apply a security patch to a vLCM-managed cluster. The patch is available as an ESXi image in t…
- An administrator sees the above JSON output from a vLCM compliance report. What should the administrator do to resolve t…
- An administrator is planning to migrate from legacy baselines to vLCM for a cluster. Which TWO statements are true about…
- A vSphere administrator is using vLCM and needs to ensure that all hosts are compliant with the desired image. Which TWO…
- Which TWO actions are recommended to secure the vCenter Server Appliance (VCSA)?
Last reviewed: Jun 11, 2026
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.