Configure Identity and Security VCP-DCV Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which component of vSphere Trust Authority is responsible for providing encryption keys to vCenter Server?

   • AKey provider
   • BAttestation service
   • CSSO server
   • DvCenter Server
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A vSphere administrator is setting up a new vCenter Server and wants to use SSO to authenticate users from multiple Active Directory domains. What is the recommended approach for configuring identity sources?

   • AUse a single LDAP identity source that points to a global catalog.
   • BAdd each Active Directory domain as a separate identity source.
   • CAdd only the primary domain and rely on trust relationships.
   • DCreate local users for all users from the secondary domains.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A large enterprise is implementing vSphere Trust Authority to secure their most sensitive VMs. They have a Trust Authority vCenter Server and a separate vCenter Server managing the workload cluster. After configuring the trust hosts and attestation, they want to ensure that only attested ESXi hosts can decrypt and run the sensitive VMs. What additional configuration is required on the workload cluster?

   • AAdd the workload vCenter Server as a trust host to the Trust Authority.
   • BConfigure the workload cluster to use the Trust Authority's key provider for VM encryption.
   • CEnable the 'Trust Authority' option on the workload vCenter Server.
   • DManually distribute the attestation keys to the ESXi hosts.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is considering vSphere Trust Authority to enhance their security posture. They are concerned about the complexity of managing a separate Trust Authority vCenter Server. What is a key benefit of using vSphere Trust Authority that justifies this complexity?

   • AIt eliminates the need for a separate Key Management Server.
   • BIt automatically patches ESXi hosts.
   • CIt provides a hardware root of trust for ESXi hosts, ensuring only attested hosts can run sensitive workloads.
   • DIt simplifies the management of vSphere SSO identity sources.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company is deploying vSphere Trust Authority to protect against insider threats. They want to ensure that even a compromised vCenter Server managing the workload cluster cannot decrypt sensitive VMs. How does Trust Authority achieve this?

   • AThe workload vCenter Server stores the keys but requires a one-time password from the Trust Authority.
   • BThe decryption keys are held by the Trust Authority and only released to attested ESXi hosts, not to the workload vCenter Server.
   • CThe keys are stored in a hardware security module (HSM) that the workload vCenter Server can access.
   • DThe ESXi hosts store the keys locally and only share them with the workload vCenter Server after attestation.
   Reveal Solution Discussion Select an answer first