Requirements for vMotion Encryption: ESXi 6.5+ and VM Virtual Hardware 11+
Which TWO of the following are required to configure vMotion encryption for a VM? (Choose two.)
Quick Answer
The VM's virtual hardware version needing to be 11 or later is one of the two correct prerequisites because vMotion encryption is not a feature bolted onto the network transport alone; it requires support built into the virtual machine's own hardware layer to generate and manage the per-migration encryption keys involved. Alongside that, both the source and destination ESXi hosts need to be running a version that actually supports the feature, since the hosts are the ones performing the encrypted data transfer during the live migration itself; older hosts simply do not have the capability regardless of what hardware version the VM uses. These two requirements work together: an eligible VM without eligible hosts, or eligible hosts running a VM with outdated virtual hardware, would both fail to get an encrypted vMotion. This is worth separating from VM-level encryption prerequisites, which do require a Key Management Server, because vMotion encryption itself does not need a KMS at all; it is a distinct, self-contained feature configured at the cluster or host level rather than something dependent on the VM already being encrypted at rest. Matching hardware vendors between hosts is also not a factor. When a question asks about vMotion encryption specifically, expect the correct answers to center on host and VM hardware and software version compatibility rather than on KMS or encryption-at-rest requirements, which belong to a related but separate feature.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The source and destination ESXi hosts must be version 6.5 or later.
Options B and D are correct. vMotion encryption requires that both source and destination ESXi hosts run version 6.5 or later (B), and the virtual machine must have virtual hardware version 11 or later (D). Option A is incorrect because vMotion encryption does not require hosts from the same vendor. Option C is incorrect because a Key Management Server (KMS) is not required for vMotion encryption; it is only required for VM-level encryption. Option E is incorrect because the VM does not need encryption enabled at the VM level for vMotion encryption; vMotion encryption is configured at the cluster or host level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The source and destination hosts must be from the same vendor.
Why it's wrong here
Host vendor is irrelevant.
- ✓
The source and destination ESXi hosts must be version 6.5 or later.
Why this is correct
vMotion encryption is supported from ESXi 6.5 onward.
- ✗
A Key Management Server (KMS) must be configured in vCenter.
Why it's wrong here
KMS is needed for VM encryption, not vMotion encryption.
- ✓
The virtual hardware version of the VM must be 11 or later.
Why this is correct
Virtual hardware version 11 or later is required to support encryption of vMotion data.
- ✗
The VM must have encryption enabled at the VM level.
Why it's wrong here
VM encryption is separate; vMotion encryption can be set at cluster level.
Go deeper
Related to this question
About these practice questions
This VCP-DCV question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on VCP-DCV
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is implementing vSphere 7.0 and wants to encrypt all vMotion traffic between ESXi hosts in a cluster. The cluster is not using any other encryption features. What is the minimum requirement to enable vMotion encryption?
medium- A.A VM Encryption Key Management Server must be configured.
- B.The ESXi hosts must be joined to an Active Directory domain.
- ✓ C.The ESXi hosts must have a host profile applied with encryption enabled.
- D.The cluster must be configured with Enhanced vMotion Compatibility (EVC).
Why C: In vSphere 7.0, enabling vMotion encryption does not require Active Directory, a Key Management Server, Enhanced vMotion Compatibility (EVC), or host profiles. The minimum requirement is simply to configure the vMotion encryption policy on each ESXi host (set to 'Required' or 'Opportunistic'). No additional infrastructure or profiles are needed.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.