VCP-DCV vSphere Security Practice Question
Which TWO of the following are best practices for securing ESXi hosts? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable lockdown mode on the host.
Options C and E are correct. Enabling lockdown mode (C) restricts direct root access to the host, requiring administrators to use vCenter Server for management, which is a security best practice. Configuring Active Directory integration (E) allows centralized user management and authentication, avoiding the need for local accounts. Option A is incorrect because granting root user direct permissions on all hosts bypasses security controls. Option B is incorrect because disabling the ESXi firewall exposes the host to network threats. Option D is incorrect because DCUI (Direct Console User Interface) should be accessed only via the local console, not from the network; allowing DCUI access from trusted management networks still poses a security risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Grant the root user direct permissions on all hosts.
Why it's wrong here
Root should be used sparingly; individual administrators should have individual accounts.
- ✗
Disable the ESXi firewall to simplify management.
Why it's wrong here
Firewall is essential for security.
- ✓
Enable lockdown mode on the host.
Why this is correct
Lockdown mode disables direct root access via SSH and DCUI.
- ✗
Allow DCUI access from trusted management networks.
Why it's wrong here
DCUI is for direct console access; enabling network access defeats its purpose.
- ✓
Configure Active Directory integration for host authentication.
Why this is correct
AD integration allows AD users to be granted permissions without local accounts.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VCP-DCV question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.