VCP Regulatory Compliance & Legal Framework 5 — Questions and Answers
Question 1: Which vSphere encryption feature protects VM data in transit between ESXi hosts during vMotion migrations, satisfying encryption-in-transit requirements of multiple compliance frameworks?
- vSAN Data-at-Rest Encryption
- vMotion Encryption (Correct answer)
- vSphere VM Encryption at datastore level
- NSX IPsec tunnel
Correct answer: vMotion Encryption
vMotion Encryption uses AES-256 to encrypt VM memory and disk state transferred between hosts, satisfying compliance requirements for encryption of data in transit.
Question 2: Under GDPR Article 17 (Right to Erasure), when a data subject requests deletion of their personal data, which scenario best represents compliant handling in a VMware environment?
- Archive the VM containing their data to cold storage
- Delete the VM and cryptographically erase all associated storage blocks containing their data (Correct answer)
- Snapshot the VM before deletion and retain the snapshot for 90 days
- Move the VM to a separate VLAN and restrict access
Correct answer: Delete the VM and cryptographically erase all associated storage blocks containing their data
GDPR's right to erasure requires that personal data be irrecoverably deleted; cryptographic erasure of underlying storage ensures no remnant data remains recoverable.
Question 3: A vSphere administrator is configuring ESXi hosts for a FedRAMP Moderate baseline. Which FIPS 140-2 validated cryptographic mode must be enabled on ESXi?
- ESXi FIPS mode via advanced system setting UserVars.ESXiFIPSMode (Correct answer)
- VMware vSphere Lifecycle Manager patch baseline
- vCenter Enhanced Linked Mode
- vSAN Deduplication
Correct answer: ESXi FIPS mode via advanced system setting UserVars.ESXiFIPSMode
Enabling ESXi FIPS mode forces the use of FIPS 140-2 validated cryptographic modules for SSH, TLS, and other protocols, as required by FedRAMP Moderate controls.
Question 4: Which legal concept determines whether a cloud customer or VMware cloud provider is liable for a data breach involving customer VM data, based on their contractual division of security responsibilities?
- Indemnification clause
- Shared Responsibility Model (Correct answer)
- Limitation of Liability clause
- Force Majeure provision
Correct answer: Shared Responsibility Model
The Shared Responsibility Model defines which security controls the CSP owns vs. the customer, directly determining liability exposure in breach scenarios.
Question 5: PCI DSS v4.0 Requirement 10 mandates logging and monitoring. Which VMware tool provides centralized log collection and correlation for ESXi and vCenter audit events?
- VMware vRealize Log Insight (Aria Operations for Logs) (Correct answer)
- vSphere Distributed Switch NetFlow
- vCenter Alarms
- vSAN Health Service
Correct answer: VMware vRealize Log Insight (Aria Operations for Logs)
vRealize Log Insight (now Aria Operations for Logs) aggregates, indexes, and correlates syslog and audit events from ESXi and vCenter, supporting PCI DSS Req 10 monitoring requirements.
Question 6: A company storing student educational records in VMs must comply with which US federal law governing access and disclosure of those records?
- COPPA
- FERPA (Correct answer)
- HIPAA
- GLBA
Correct answer: FERPA
FERPA (Family Educational Rights and Privacy Act) governs access to and disclosure of student educational records held by institutions receiving federal funding.
Question 7: During a compliance audit, an auditor asks for evidence that no single administrator can both approve and implement a change to production VMs. Which governance control satisfies this requirement?
- vSphere Tag-based resource policies
- Separation of Duties enforced via vCenter RBAC with distinct approval and implementation roles (Correct answer)
- vSAN stretched cluster configuration
- vSphere High Availability admission control
Correct answer: Separation of Duties enforced via vCenter RBAC with distinct approval and implementation roles
Separation of Duties implemented through distinct vCenter RBAC roles ensures no single user can both request/approve and execute changes, a key control for SOX, PCI DSS, and ISO 27001.
VCP Regulatory Compliance & Legal Framework 5
Which vSphere encryption feature protects VM data in transit between ESXi hosts during vMotion migrations, satisfying encryption-in-transit requirements of multiple compliance frameworks?