Given a Scenario, Troubleshoot Issues with Identity and Access Management (VMware Identity Broker) VCP-VCF-SUPPORT Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An administrator configures VMware Identity Broker to synchronize groups from Active Directory. After the initial sync, users in the 'vSphere Admins' group can log in, but users in the 'vSphere Viewers' group cannot. Both groups are in the same AD OU and are synced successfully. What should the administrator check?

   • AEnsure that the 'vSphere Viewers' group is not nested inside another group that is blocked by the sync policy.
   • BCheck whether the 'vSphere Viewers' group exceeds the maximum group size limit in Identity Broker.
   • CVerify that the 'vSphere Viewers' group is included in the Identity Broker policy that maps groups to vCenter roles.
   • DConfirm that the 'vSphere Viewers' group has a valid email address in AD.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A VCF administrator configures Identity Broker to use a new LDAP identity source. Users can authenticate, but group membership is not being resolved, so authorization fails. The LDAP source is reachable and the bind credentials are valid. What should the administrator verify?

   • AThe LDAP server's SSL certificate is trusted by Identity Broker.
   • BThe LDAP group base DN is set correctly and the broker has permission to read group objects.
   • CThe LDAP server is configured to allow anonymous binds.
   • DThe user's password is synchronized with the LDAP directory.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A user can log in to vCenter but receives an 'Insufficient Privileges' error when trying to power on a VM. Which of the following is the most likely cause?

   • AThe user's role does not include the 'Power On' privilege on the VM or its parent object.
   • BThe Identity Broker is not configured to forward group membership information.
   • CThe user's account is locked in the external identity source.
   • DThe vCenter SSO service is not responding.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   During troubleshooting, you find that the Identity Broker cannot communicate with vCenter SSO due to an SSL error. Which of the following is the most likely cause?

   • AThe Identity Broker service is not running.
   • BThe user's account is locked in the external identity source.
   • CThe LDAP server is not reachable.
   • DThe SSO certificate has expired or is not trusted by Identity Broker.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An administrator is troubleshooting why users cannot authenticate to vCenter through Identity Broker. The broker logs show that the user is found in AD and the password is validated, but the broker fails to obtain a SAML assertion for vCenter. Which component is most likely misconfigured?

   • AThe vCenter Server's SSO configuration is not registered as a service provider with Identity Broker.
   • BThe AD identity source is not configured with the correct base DN.
   • CThe network firewall is blocking traffic between Identity Broker and vCenter on port 443.
   • DThe Identity Broker service account lacks read permission on the AD user objects.
   Reveal Solution Discussion Select an answer first