Given a Scenario, Troubleshoot Issues with Identity and Access Management (VMware Identity Broker) VCP-VCF-SUPPORT Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An administrator configures Identity Broker with two AD identity sources: Source A and Source B. Users from Source A can authenticate, but users from Source B cannot. The broker logs show 'connection refused' for Source B. Source B is reachable from the broker's management network via LDAP. What is the most likely cause?

   • AThe bind credentials for Source B are incorrect.
   • BThe base DN for Source B is incorrect.
   • CThe LDAP port configured for Source B is incorrect, pointing to a port where no service is listening.
   • DThe Source B server's SSL certificate is not trusted by Identity Broker.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   During troubleshooting of an authentication failure in a VCF fleet, you notice that the Identity Broker logs show 'Unable to validate user credentials against the identity source.' Which of the following is the most likely cause?

   • AThe Identity Broker's SSL certificate has expired.
   • BThe user is trying to log in with an incorrect domain name.
   • CThe user's account is locked in the external identity source.
   • DThe vCenter SSO service is not registered with Identity Broker.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In the VMware Identity Broker architecture, what is the typical flow when a user attempts to log in to a vCenter Server in a VCF fleet?

   • AIdentity Broker stores all user passwords locally and authenticates users without contacting any external identity source.
   • BvCenter SSO forwards the authentication request to Identity Broker, which validates the user against the external identity source and returns a token to SSO.
   • CThe user must authenticate separately to both Identity Broker and vCenter SSO before gaining access.
   • DUser credentials are sent directly to the external identity provider, which then grants access to vCenter without involving SSO.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A user reports that they cannot log in to the VCF management plane through Identity Broker. The broker logs show 'user not found in identity source'. The user confirms their account is active in AD. What should the administrator check first?

   • AThe user's password is correct in AD.
   • BThe Identity Broker service is running.
   • CThe base DN configured for the AD identity source in Identity Broker.
   • DThe user's account is not locked out in AD.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Users in a VCF fleet cannot authenticate, and the Identity Broker logs show 'Connection to LDAP server timed out.' Which of the following is the most likely cause?

   • AThe Identity Broker's SSL certificate is expired.
   • BThe user's password is incorrect.
   • CThe vCenter SSO service is not running.
   • DThe LDAP server is unreachable due to a network issue.
   Reveal Solution Discussion Select an answer first