How to Restrict Access to the ESXi Direct Console User Interface (DCUI)
Which two actions can be performed to restrict access to the ESXi host Direct Console User Interface (DCUI)? (Choose two.)
Quick Answer
Setting DCUI access to Strict is correct because it closes the specific gap that normal lockdown mode leaves open: even with lockdown mode enabled, the DCUI still allows a defined list of exception users to log in locally, which is useful for emergency access but is also exactly the kind of access path an administrator trying to fully restrict DCUI use would want to eliminate. Strict access removes that exception entirely, disabling the DCUI for everyone except the root user during the initial ESXi setup process, which is the tightest level of restriction available. This works together with enabling lockdown mode itself, which is the other correct action, since lockdown mode is what funnels host management through vCenter Server in the first place by blocking direct local and SSH logins; Strict access then extends that same restriction to the console interface specifically. Together these two settings represent layered restriction: lockdown mode addresses remote and API-level access paths, while DCUI Strict access closes the local console path, including the exception list that lockdown mode alone still permits. When a question asks how to fully restrict access to the ESXi console beyond what basic lockdown mode provides, look for the DCUI-specific access level setting rather than assuming lockdown mode alone covers every access path.
⚠ Common exam trap
Many exam-takers confuse 'disabling the DCUI service' (which is not possible) with 'setting DCUI access to Strict' (which is a valid restriction), or they mistakenly think adding users to the exception list restricts access when it actually grants it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable lockdown mode
Lockdown mode restricts access to the ESXi host's Direct Console User Interface (DCUI) by requiring authentication through vCenter Server and preventing direct local or SSH logins. Enabling lockdown mode (Option B) is a primary method to enforce this restriction, ensuring only authorized users via vCenter can manage the host. Setting DCUI access to 'Strict' (Option E) further tightens security by disabling the DCUI entirely for all users, including those in the exception list, except for root during initial setup.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the DCUI service
Why it's wrong here
Disabling the DCUI service is not possible; the DCUI is a built-in interface that cannot be disabled as a service. This option is incorrect.
- ✓
Enable lockdown mode
Why this is correct
Enabling lockdown mode restricts access to the ESXi host's DCUI by requiring authentication through vCenter Server, preventing direct local or SSH logins. This is one of the correct actions.
- ✗
Add users to the DCUI exception list
Why it's wrong here
Adding users to the DCUI exception list actually grants them access to the DCUI even when lockdown mode is enabled, contrary to restricting access. This option is incorrect.
- ✗
Remove the root user from the local password store
Why it's wrong here
Removing the root user from the local password store does not restrict DCUI access; it may prevent root from logging in locally but does not affect DCUI specifically. This option is incorrect.
- ✓
Set DCUI access to 'Strict'
Why this is correct
Setting DCUI access to 'Strict' disables the DCUI entirely for all users, including those in the exception list, except for the root user during initial setup. This is one of the correct actions.
Go deeper
Related to this question
About these practice questions
One of 498 original VCP-DCV practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on VCP-DCV
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A vSphere administrator wants to restrict direct console access to an ESXi host to authorized administrators only, without interrupting running virtual machines. Which feature should the administrator enable?
easy- ✓ A.Lockdown mode
- B.Enable DRS
- C.Configure a host profile
- D.Disable SSH service
Why A: Lockdown mode restricts direct access to the ESXi host via DCUI and SSH, but allows access through vCenter Server while VMs continue to run. Option B (Enable DRS) is wrong because DRS is for load balancing, not security. Option C (Configure a host profile) is wrong because host profiles configure settings but do not enforce access restriction. Option D (Disable SSH service) is wrong because disabling SSH alone does not restrict DCUI.
Variation 2. An administrator wants to prevent direct root access to an ESXi host via SSH and the DCUI. Which two configurations are necessary?
easy- A.Set the host to lockdown mode with root exception.
- B.Disable DCUI and SSH services.
- C.Configure SSO to require Smart Card authentication.
- ✓ D.Enable lockdown mode and remove root from permissions.
Why D: Enabling lockdown mode on an ESXi host disables direct root access via SSH and DCUI. Additionally, removing the root user from the permissions list ensures that root cannot be granted access through exception lists. Option A is wrong because setting lockdown mode with root exception would still allow root access under specific circumstances. Option B is wrong because disabling DCUI and SSH services does not prevent root access via other means (e.g., vCenter) and does not enforce persistent restriction. Option C is wrong because configuring SSO with Smart Card authentication does not affect local root access at the ESXi host level.
Variation 3. Which TWO of the following are valid methods to restrict access to the ESXi host's Direct Console User Interface (DCUI) to authorized administrators only?
medium- A.Disable SSH access on the host to prevent remote DCUI access.
- ✓ B.Enable lockdown mode and add only authorized administrators to the Exception Users list.
- C.Remove the root user from the DCUI local users list.
- ✓ D.Set the advanced option 'DCUI.Access' to a list of authorized users.
- E.Configure Active Directory integration and use group policy to disable DCUI.
Why B: Options B and D are correct. Enabling lockdown mode and adding only authorized administrators to the Exception Users list restricts DCUI access to those users. Setting the advanced option 'DCUI.Access' to a list of authorized users also restricts DCUI access. Option A is incorrect because disabling SSH does not affect DCUI access; DCUI is accessed directly from the console, not via SSH. Option C is incorrect because the root user cannot be removed from the DCUI local users list. Option E is incorrect because Active Directory integration does not restrict DCUI access.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.