- A
Use the vSphere Certificate Manager utility to replace the machine SSL certificate with a new one that uses strong ciphers.
Why wrong: This is incorrect because the vSphere Certificate Manager utility replaces certificates but does not configure cipher suites or protocols. It does not enforce strong ciphers.
- B
Edit the registry on the vCenter Server to disable SSLv3.
This is correct for a Windows-based vCenter Server. By editing the registry under SCHANNEL protocols, you can disable SSLv3 and enforce stronger protocols.
- C
Disable TLS 1.2 and enable only TLS 1.3 on all ESXi hosts.
Why wrong: This is incorrect. Disabling TLS 1.2 and enabling only TLS 1.3 would weaken security and is not a standard hardening step. You should disable SSLv3 and weak protocols.
- D
Configure the TLS settings in the vSphere Web Client under Administration > Security.
Why wrong: This is incorrect because the vSphere Web Client does not have a TLS configuration setting under Administration > Security.
- E
Modify the Tomcat server.xml file on the vCenter Server to restrict ciphers and protocols.
This is correct. Modifying the Tomcat server.xml file on the vCenter Server (both Windows and Appliance) allows you to restrict allowed protocols and ciphers, effectively disabling SSLv3 and enforcing strong ciphers.
VCP-DCV vSphere Security Practice Question
This VCP-DCV practice question tests your understanding of vsphere security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security audit reveals that a vCenter Server has weak TLS configuration. The administrator needs to enforce strong ciphers and disable SSLv3. Which two steps should the administrator take? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Edit the registry on the vCenter Server to disable SSLv3.
To enforce strong ciphers and disable SSLv3 on a vCenter Server, the administrator should modify the Tomcat server.xml file to restrict allowed protocols and ciphers (Option E). Additionally, if the vCenter Server is running on Windows, editing the registry to disable SSLv3 is also required (Option B). Option A is incorrect because the Certificate Manager replaces certificates but does not configure cipher suites. Option C is wrong because disabling TLS 1.2 and enabling only TLS 1.3 may break compatibility and is not the standard method. Option D is incorrect as there is no such setting in the vSphere Web Client under Administration > Security.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the vSphere Certificate Manager utility to replace the machine SSL certificate with a new one that uses strong ciphers.
Why it's wrong here
This is incorrect because the vSphere Certificate Manager utility replaces certificates but does not configure cipher suites or protocols. It does not enforce strong ciphers.
- ✓
Edit the registry on the vCenter Server to disable SSLv3.
Why this is correct
This is correct for a Windows-based vCenter Server. By editing the registry under SCHANNEL protocols, you can disable SSLv3 and enforce stronger protocols.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Disable TLS 1.2 and enable only TLS 1.3 on all ESXi hosts.
Why it's wrong here
This is incorrect. Disabling TLS 1.2 and enabling only TLS 1.3 would weaken security and is not a standard hardening step. You should disable SSLv3 and weak protocols.
- ✗
Configure the TLS settings in the vSphere Web Client under Administration > Security.
Why it's wrong here
This is incorrect because the vSphere Web Client does not have a TLS configuration setting under Administration > Security.
- ✓
Modify the Tomcat server.xml file on the vCenter Server to restrict ciphers and protocols.
Why this is correct
This is correct. Modifying the Tomcat server.xml file on the vCenter Server (both Windows and Appliance) allows you to restrict allowed protocols and ciphers, effectively disabling SSLv3 and enforcing strong ciphers.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse vCenter Server's Windows-based legacy behavior with its current Linux-based architecture, leading them to incorrectly select registry editing (Option B) instead of recognizing that Tomcat configuration files are the correct method.
Detailed technical explanation
How to think about this question
The vCenter Server uses Apache Tomcat as its web server, and TLS settings are controlled via the server.xml file, where connectors define allowed ciphers and protocols (e.g., sslEnabledProtocols="TLSv1.2" and ciphers="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"). Disabling SSLv3 is critical because it is vulnerable to the POODLE attack (CVE-2014-3566), and strong ciphers like those using ECDHE and AES-GCM provide forward secrecy and resistance to known attacks. In a real-world scenario, failing to update both the certificate and the Tomcat configuration could leave the vCenter Server exposed to downgrade attacks even after certificate replacement.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the VCP-DCV exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
vSphere Security — study guide chapter
Learn the concepts, then practise the questions
- →
vSphere Security practice questions
Targeted practice on this topic area only
- →
All VCP-DCV questions
521 questions across all exam domains
- →
VMware Certified Professional Data Center Virtualization VCP-DCV study guide
Full concept coverage aligned to exam objectives
- →
VCP-DCV practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related VCP-DCV practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
vSphere Architecture, Products and Solutions practice questions
Practise VCP-DCV questions linked to vSphere Architecture, Products and Solutions.
Configure and Manage vSphere Networking practice questions
Practise VCP-DCV questions linked to Configure and Manage vSphere Networking.
Configure and Manage vSphere Storage practice questions
Practise VCP-DCV questions linked to Configure and Manage vSphere Storage.
vSphere Lifecycle Management practice questions
Practise VCP-DCV questions linked to vSphere Lifecycle Management.
vSphere Security practice questions
Practise VCP-DCV questions linked to vSphere Security.
vSphere Performance and Scaling practice questions
Practise VCP-DCV questions linked to vSphere Performance and Scaling.
VCP-DCV fundamentals practice questions
Practise VCP-DCV questions linked to VCP-DCV fundamentals.
VCP-DCV scenario practice questions
Practise VCP-DCV questions linked to VCP-DCV scenario.
VCP-DCV troubleshooting practice questions
Practise VCP-DCV questions linked to VCP-DCV troubleshooting.
Practice this exam
Start a free VCP-DCV practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this VCP-DCV question test?
vSphere Security — This question tests vSphere Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Edit the registry on the vCenter Server to disable SSLv3. — To enforce strong ciphers and disable SSLv3 on a vCenter Server, the administrator should modify the Tomcat server.xml file to restrict allowed protocols and ciphers (Option E). Additionally, if the vCenter Server is running on Windows, editing the registry to disable SSLv3 is also required (Option B). Option A is incorrect because the Certificate Manager replaces certificates but does not configure cipher suites. Option C is wrong because disabling TLS 1.2 and enabling only TLS 1.3 may break compatibility and is not the standard method. Option D is incorrect as there is no such setting in the vSphere Web Client under Administration > Security.
What should I do if I get this VCP-DCV question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More VCP-DCV practice questions
- A vSphere administrator is managing a cluster with vLCM and receives a notification that a new ESXi patch is available.…
- An administrator needs to apply a security patch to a vLCM-managed cluster. The patch is available as an ESXi image in t…
- An administrator sees the above JSON output from a vLCM compliance report. What should the administrator do to resolve t…
- An administrator is planning to migrate from legacy baselines to vLCM for a cluster. Which TWO statements are true about…
- A vSphere administrator is using vLCM and needs to ensure that all hosts are compliant with the desired image. Which TWO…
- Which TWO actions are recommended to secure the vCenter Server Appliance (VCSA)?
Last reviewed: Jun 11, 2026
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.