Given a Scenario, Troubleshoot Issues with Identity and Access Management (VMware Identity Broker) VCP-VCF-SUPPORT Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A VCF administrator is troubleshooting an authentication failure. Users report that they can log in to the SDDC Manager UI but cannot log in to vCenter through Identity Broker. The broker logs show 'invalid_grant' errors. Which diagnostic step should the administrator perform first?

   • ACompare the system clocks of the Identity Broker and the vCenter Server.
   • BCheck the AD identity source connectivity from the broker.
   • CVerify that the user's group membership is synced correctly.
   • DRestart the Identity Broker service to clear cached tokens.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   Users report intermittent authentication failures to the VCF management plane through Identity Broker. The failures occur only during peak business hours. The Identity Broker logs show 'connection timed out' errors when contacting the AD domain controllers. What is the most likely cause?

   • AThe AD domain controllers are overloaded and cannot respond to authentication requests within the broker's timeout threshold.
   • BThe time synchronization between Identity Broker and AD is off by a few seconds.
   • CThe Identity Broker certificate has expired and needs renewal.
   • DThe Identity Broker service account password is set to expire soon.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a VMware Cloud Foundation (VCF) fleet, which component acts as the central intermediary that brokers authentication requests between vCenter Single Sign-On (SSO) and external identity providers?

   • AVMware Identity Broker
   • BPlatform Services Controller (PSC)
   • CNSX Manager
   • DvCenter Server Appliance (VCSA)
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When troubleshooting Identity Broker connectivity to an external identity source, which of the following is the most likely cause of an 'LDAP bind failed' error?

   • AThe Identity Broker service is not running.
   • BThe LDAP server is not reachable from the Identity Broker.
   • CThe user's password has expired.
   • DThe service account credentials used by Identity Broker are incorrect or lack sufficient permissions.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Users in a VCF fleet can authenticate but are not receiving the expected group-based permissions. Which of the following is the most likely cause of this configuration misalignment?

   • AThe user's password has expired.
   • BThe vCenter SSO certificate is expired.
   • CThe LDAP server is unreachable.
   • DThe Identity Broker is not configured to synchronize group membership from the external identity source.
   Reveal Solution Discussion Select an answer first