Minimum Requirements to Enable vMotion Encryption
A company is implementing vSphere 7.0 and wants to encrypt all vMotion traffic between ESXi hosts in a cluster. The cluster is not using any other encryption features. What is the minimum requirement to enable vMotion encryption?
Quick Answer
The answer is that the ESXi hosts must be joined to an Active Directory domain. This is the minimum requirement because vMotion encryption in vSphere 7.0 leverages Kerberos authentication (RFC 4120) to establish a secure, encrypted channel between hosts, and Active Directory provides the necessary trust and key exchange mechanism without needing a separate Key Management Server. On the VCP-DCV exam, this question tests your understanding that vMotion encryption does not require a KMS or certificates when using Kerberos, which is a common trap—many candidates mistakenly think a KMS is mandatory. Remember, if the cluster uses no other encryption features, the domain join alone satisfies the requirement for both 'Opportunistic' and 'Required' policies. Memory tip: “vMotion needs a domain, not a KMS, for Kerberos to kiss and encrypt.”
⚠ Common exam trap
Candidates often mistakenly believe that vMotion encryption requires external configuration such as host profiles, AD, or a KMS. In reality, it uses built-in certificate trust and can be enabled directly on each host without any additional setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ESXi hosts must have a host profile applied with encryption enabled.
In vSphere 7.0, enabling vMotion encryption does not require Active Directory, a Key Management Server, Enhanced vMotion Compatibility (EVC), or host profiles. The minimum requirement is simply to configure the vMotion encryption policy on each ESXi host (set to 'Required' or 'Opportunistic'). No additional infrastructure or profiles are needed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A VM Encryption Key Management Server must be configured.
Why it's wrong here
A VM Encryption Key Management Server is required for encrypting virtual machines, not for vMotion traffic. vMotion encryption does not require a KMS.
- ✗
The ESXi hosts must be joined to an Active Directory domain.
Why it's wrong here
Active Directory domain membership is not required for vMotion encryption. vSphere 7.0 uses host certificates for trust, not Kerberos from AD.
- ✓
The ESXi hosts must have a host profile applied with encryption enabled.
Why this is correct
A host profile applied with encryption enabled is the minimum requirement because it ensures consistent encryption policy across the cluster, leveraging default certificate trust.
- ✗
The cluster must be configured with Enhanced vMotion Compatibility (EVC).
Why it's wrong here
Enhanced vMotion Compatibility (EVC) ensures CPU compatibility for vMotion, but is unrelated to encryption of vMotion traffic.
Go deeper
Related to this question
About these practice questions
One of 498 original VCP-DCV practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on VCP-DCV
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are required to configure vMotion encryption for a VM? (Choose two.)
medium- A.The source and destination hosts must be from the same vendor.
- ✓ B.The source and destination ESXi hosts must be version 6.5 or later.
- C.A Key Management Server (KMS) must be configured in vCenter.
- ✓ D.The virtual hardware version of the VM must be 11 or later.
- E.The VM must have encryption enabled at the VM level.
Why B: Options B and D are correct. vMotion encryption requires that both source and destination ESXi hosts run version 6.5 or later (B), and the virtual machine must have virtual hardware version 11 or later (D). Option A is incorrect because vMotion encryption does not require hosts from the same vendor. Option C is incorrect because a Key Management Server (KMS) is not required for vMotion encryption; it is only required for VM-level encryption. Option E is incorrect because the VM does not need encryption enabled at the VM level for vMotion encryption; vMotion encryption is configured at the cluster or host level.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.