VCP Risk Assessment & Management 3 — Questions and Answers
Question 1: Which risk management framework is most commonly referenced in enterprise VMware environments to structure risk assessment processes?
- TOGAF
- NIST SP 800-30 (Correct answer)
- ITIL v4 Service Value Chain
- VMware Cloud Management Platform
Correct answer: NIST SP 800-30
NIST SP 800-30 provides a structured guide for conducting risk assessments widely adopted in enterprise IT and cloud environments including VMware deployments.
Question 2: A company uses vSphere with NSX-T. Which risk does micro-segmentation primarily mitigate?
- VM configuration drift across hosts
- Lateral movement of threats between workloads in the same VLAN (Correct answer)
- Data loss due to snapshot consolidation failures
- Certificate expiry on ESXi hosts
Correct answer: Lateral movement of threats between workloads in the same VLAN
NSX-T micro-segmentation creates granular firewall policies between VMs, preventing an attacker who compromises one VM from freely moving laterally to others.
Question 3: When calculating Annual Loss Expectancy (ALE) for a vSphere component failure, which two values are required?
- MTTR and MTBF
- SLO and RPO
- Single Loss Expectancy (SLE) and Annual Rate of Occurrence (ARO) (Correct answer)
- RTO and RTO tier classification
Correct answer: Single Loss Expectancy (SLE) and Annual Rate of Occurrence (ARO)
ALE = SLE × ARO; SLE is the financial loss per incident and ARO is the expected frequency of the incident per year.
Question 4: In a vSphere high-availability design, which failure scenario does an 'Admission Control' policy primarily protect against?
- ESXi host kernel panics caused by buggy drivers
- Insufficient cluster capacity to restart VMs after multiple host failures (Correct answer)
- Unauthorized vMotion migrations initiated by low-privilege users
- Datastore corruption caused by simultaneous write operations
Correct answer: Insufficient cluster capacity to restart VMs after multiple host failures
Admission Control reserves sufficient cluster resources so that if hosts fail, vSphere HA can successfully restart all affected VMs on remaining hosts.
Question 5: Which action BEST reduces the risk of a single point of failure in an NSX-T deployment?
- Deploying NSX Manager as a single large-form-factor appliance
- Configuring an NSX Manager cluster with three nodes (Correct answer)
- Enabling DRS affinity rules to keep NSX VMs on one host
- Backing up NSX configuration to a local VMFS datastore only
Correct answer: Configuring an NSX Manager cluster with three nodes
A three-node NSX Manager cluster provides N+1 redundancy, ensuring the management plane remains available even if one manager node fails.
Question 6: A risk register entry notes that patching ESXi hosts is 'deferred due to change freeze.' What risk category does this BEST represent?
- Strategic risk
- Operational risk — accepted risk with planned remediation timeline (Correct answer)
- Compliance risk that must be escalated immediately
- Vendor risk transferred to VMware support
Correct answer: Operational risk — accepted risk with planned remediation timeline
Deferring a known patch due to change freeze is an accepted operational risk; the organization acknowledges the risk and plans to address it when the freeze lifts.
Question 7: Which vSphere feature helps identify configuration risks caused by hosts in a cluster having inconsistent firmware or driver versions?
- vSphere Lifecycle Manager (vLCM) desired state compliance check (Correct answer)
- vSphere Storage Policy Based Management (SPBM)
- vCenter Server Appliance (VCSA) health check dashboard
- VMware vSAN health service disk test
Correct answer: vSphere Lifecycle Manager (vLCM) desired state compliance check
vLCM desired state enforces a uniform firmware/driver baseline across all cluster hosts and flags hosts that deviate as non-compliant, surfacing configuration risk.
VCP Risk Assessment & Management 3
Which risk management framework is most commonly referenced in enterprise VMware environments to structure risk assessment processes?