Given a Scenario, Troubleshoot Issues with Identity and Access Management (VMware Identity Broker) VCP-VCF-SUPPORT Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   After replacing the certificate on the Identity Broker service, users report that they cannot log in to the VCF management plane. The broker logs show 'unable to establish trust' errors. Which additional component must be updated to restore functionality?

   • AThe DNS records for the Identity Broker must be updated to point to the new certificate's subject name.
   • BThe new Identity Broker certificate must be added to the trust store of each vCenter Server and the SDDC Manager.
   • CThe AD domain controllers must be updated with the new broker certificate.
   • DThe Identity Broker database must be reinitialized to clear cached certificate references.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After a scheduled maintenance window, users report that they can no longer authenticate to any VCF workload domain through Identity Broker. The Identity Broker logs show 'certificate verify failed' errors when attempting to connect to the vCenter Server instances. What is the most likely cause and the appropriate fix?

   • AThe vCenter Server certificates were replaced during maintenance, and the new certificates were not added to the Identity Broker trust store.
   • BThe network firewall was reconfigured to block port 443 between Identity Broker and vCenter.
   • CThe Identity Broker service account password expired during the maintenance window.
   • DThe AD identity source was temporarily removed and re-added, invalidating cached tokens.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is the primary log file to examine when troubleshooting Identity Broker authentication issues in a VCF fleet?

   • AIdentity Broker service logs
   • BvCenter Server system logs
   • CNSX Manager logs
   • DESXi host logs
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Users in a VCF fleet report that they cannot log in, and the Identity Broker logs show 'Certificate validation failed for LDAPS connection.' Which of the following is the most likely cause?

   • AThe LDAP server is unreachable.
   • BThe Identity Broker service account is locked.
   • CThe user's password is incorrect.
   • DThe LDAP server's certificate is not trusted by Identity Broker.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   After upgrading the vCenter Server in a workload domain, users can no longer authenticate through Identity Broker. The broker logs show 'certificate signed by unknown authority' errors. The vCenter certificate was replaced during the upgrade. What is the most likely cause and the correct remediation?

   • AThe new vCenter certificate is signed by a CA that is not in the Identity Broker trust store; import the CA certificate.
   • BThe vCenter certificate's subject name does not match the hostname; regenerate the certificate with the correct subject.
   • CThe vCenter certificate has expired; renew it and restart the vCenter services.
   • DThe Identity Broker service account lacks permission to read the vCenter certificate; grant the service account read access.
   Reveal Solution Discussion Select an answer first