VCP-DCV vSphere Security Practice Question
Which TWO of the following are valid methods to restrict access to the ESXi host's Direct Console User Interface (DCUI) to authorized administrators only?
⚠ Common exam trap
VCP-DCV often tests the confusion between SSH/ESXi Shell access and DCUI access — candidates assume disabling SSH locks the console, but the DCUI is a separate interface controlled by lockdown mode and DCUI.Access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable lockdown mode and add only authorized administrators to the Exception Users list.
Option B is correct because enabling lockdown mode restricts direct host access (including the DCUI) so that only users on the Exception Users list—authorized administrators—can log in to the DCUI and other local management interfaces. Option D is correct because the advanced setting 'DCUI.Access' explicitly defines which local users are permitted to access the Direct Console User Interface, so setting it to a list of authorized users restricts DCUI access to exactly those accounts. Option A is not correct because SSH is a separate remote shell service and disabling it has no effect on DCUI access, which is a local console interface. Option C is not correct because the root user cannot simply be removed from the DCUI local users list in the manner described; DCUI access is controlled via lockdown mode and DCUI.Access, not by deleting root from a list. Option E is not correct because Active Directory integration and group policy do not provide a supported mechanism to disable the DCUI on an ESXi host.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable SSH access on the host to prevent remote DCUI access.
Why it's wrong here
SSH governs remote command-line access to the host, a separate service from the local DCUI console; disabling it leaves DCUI reachable at the physical console. It is tempting because both are administrative access paths, and SSH is genuinely restricted when hardening remote management.
- ✓
Enable lockdown mode and add only authorized administrators to the Exception Users list.
Why this is correct
Lockdown mode blocks all users except those on the Exception Users list from accessing the DCUI, satisfying the requirement to permit only authorised administrators. Adding administrators to that list grants them the explicit exemption needed, while all other accounts are denied by default.
- ✗
Remove the root user from the DCUI local users list.
Why it's wrong here
The DCUI local users list controls who may log in at the console; root is a built-in account that cannot be removed from it. It is tempting because removing named accounts genuinely revokes their DCUI access, so root appears to be just another removable entry.
- ✓
Set the advanced option 'DCUI.Access' to a list of authorized users.
Why this is correct
The DCUI.Access advanced option lists users permitted to access the Direct Console User Interface; anyone absent is denied. This directly restricts DCUI access to authorised administrators, satisfying the question's requirement without relying on lockdown mode.
- ✗
Configure Active Directory integration and use group policy to disable DCUI.
Why it's wrong here
DCUI access is governed by host-level permissions and the DCUI.Access advanced setting, not by Active Directory group policy, which does not manage ESXi console logins. It is tempting because AD integration genuinely centralises ESXi authentication, and Group Policy is the standard Windows mechanism for restricting console access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VCP-DCV question from scratch — 281 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official VMware exam blueprint
This VCP-DCV practice question is part of Courseiva's free VMware certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VCP-DCV exam.