VCP Professional Standards & Ethics 3 — Questions and Answers
Question 1: A VMware professional holds both an employer NDA and a professional obligation to disclose a security breach to affected parties. How should this conflict be approached?
- Always honor the NDA regardless of any other obligation
- Seek legal counsel to determine disclosure obligations and follow applicable law (Correct answer)
- Publicly disclose everything immediately to protect end users
- Ignore both obligations and take no action
Correct answer: Seek legal counsel to determine disclosure obligations and follow applicable law
When NDAs conflict with legal disclosure obligations, professionals must seek legal guidance and comply with applicable law.
Question 2: During a vSAN implementation, the lead engineer knowingly undersizes the cluster to stay within budget but does not inform the customer. This behavior violates which professional principle?
- Efficiency
- Honesty and transparency (Correct answer)
- Cost optimization
- Vendor compliance
Correct answer: Honesty and transparency
Knowingly delivering a solution that does not meet requirements without disclosure violates honesty and transparency.
Question 3: A VMware administrator is pressured by a project manager to skip the change advisory board (CAB) process to meet a deadline. The ethical action is to:
- Skip the CAB process since the project manager has authority
- Follow the established change management process and escalate the deadline pressure if necessary (Correct answer)
- Complete the change and backfill the CAB submission afterward
- Negotiate a partial CAB review only for high-risk components
Correct answer: Follow the established change management process and escalate the deadline pressure if necessary
Bypassing established change management processes can introduce risk; professionals should follow the process and escalate scheduling conflicts appropriately.
Question 4: A VCP professional is asked to certify that a VMware environment meets compliance standards, but they lack complete knowledge of all environment components. The correct action is to:
- Sign off based on the components they have reviewed
- Refuse to certify and complete a thorough assessment before providing any certification (Correct answer)
- Delegate the certification to a junior team member
- Certify with a verbal disclaimer not included in writing
Correct answer: Refuse to certify and complete a thorough assessment before providing any certification
Certifying compliance without complete knowledge is dishonest; a thorough assessment must precede any certification statement.
Question 5: A VMware engineer discovers that a script they inherited and have been running in production contains code that exfiltrates VM metadata to an external server. What is the immediate priority?
- Continue using the script until a replacement is developed
- Immediately stop using the script, report the finding to the security team, and preserve evidence (Correct answer)
- Delete the script and tell no one to avoid organizational panic
- Modify the script to remove the exfiltration code before reporting
Correct answer: Immediately stop using the script, report the finding to the security team, and preserve evidence
Malicious code must be immediately halted, reported to the security team, and evidence preserved for forensic investigation.
Question 6: When a VMware professional's personal values conflict with a client's legal but ethically questionable project requirement, what is the recommended professional approach?
- Always comply without question since the client pays
- Discuss the ethical concerns with the client and, if unresolved, consider withdrawing from the project (Correct answer)
- Complete the project but sabotage it subtly to prevent harm
- Report the client to authorities immediately
Correct answer: Discuss the ethical concerns with the client and, if unresolved, consider withdrawing from the project
Professionals should raise ethical concerns directly with the client and, if not resolved, may withdraw from an engagement rather than violate personal professional ethics.
Question 7: A VMware consultant discovers during an engagement that the client's environment contains several critical CVEs that fall outside the project scope. What is the ethical obligation?
- Ignore them since they are outside the contracted scope
- Inform the client of the discovered vulnerabilities even though remediation is outside the current scope (Correct answer)
- Remediate the vulnerabilities and bill additional hours without prior client approval
- Include CVE details in a confidential personal report for future upselling
Correct answer: Inform the client of the discovered vulnerabilities even though remediation is outside the current scope
Professionals have a duty of care to disclose discovered security risks to clients even if remediation is outside the contracted scope.
VCP Professional Standards & Ethics 3
A VMware professional holds both an employer NDA and a professional obligation to disclose a security breach to affected parties.
How should this conflict be approached?