VCP Risk Assessment & Management 4 — Questions and Answers
Question 1: A security audit finds that vCenter Server has accounts with administrator privileges that have not logged in for 180 days. Which risk does this BEST represent?
- Performance degradation risk from idle session tokens
- Privilege creep and insider threat risk from stale privileged accounts (Correct answer)
- Availability risk due to expired passwords locking vCenter
- Compliance risk because VMware requires 90-day password rotation
Correct answer: Privilege creep and insider threat risk from stale privileged accounts
Stale privileged accounts that are no longer used represent privilege creep and an insider/external threat vector if those credentials are compromised.
Question 2: In VMware Cloud Foundation (VCF), which component provides centralized visibility into the risk posture of the entire SDDC stack?
- SDDC Manager (Correct answer)
- VMware Aria Operations for Networks
- NSX Federation
- vSphere Cluster Services (vCLS)
Correct answer: SDDC Manager
SDDC Manager in VCF orchestrates lifecycle management and provides centralized health and compliance visibility across the entire SDDC stack.
Question 3: Which VMware security configuration best practice reduces the risk of unauthorized access to ESXi hosts in production?
- Enabling ESXi Shell and SSH permanently for quick troubleshooting access
- Restricting ESXi management access to a dedicated management VLAN with firewall rules (Correct answer)
- Setting all VMs to use E1000 virtual NICs for broader driver compatibility
- Disabling vSphere HA to reduce management plane attack surface
Correct answer: Restricting ESXi management access to a dedicated management VLAN with firewall rules
Isolating ESXi management traffic to a dedicated VLAN with firewall restrictions limits exposure of the management interface to only authorized systems.
Question 4: A VMware administrator discovers that vCenter's self-signed certificate is expiring in 7 days. Which risk does this pose if not addressed?
- vMotion migrations will fail due to encryption handshake errors
- Management plane access and API-based automation may break due to certificate validation failures (Correct answer)
- vSAN data path will become unavailable as encryption keys rotate
- ESXi hosts will disconnect from the vSAN cluster upon certificate expiry
Correct answer: Management plane access and API-based automation may break due to certificate validation failures
An expired vCenter certificate causes browser and API clients to reject connections, disrupting management access and any automation that validates TLS certificates.
Question 5: When performing a Business Impact Analysis (BIA) for a VMware-hosted critical application, which metric defines the maximum tolerable downtime?
- Recovery Point Objective (RPO)
- Maximum Tolerable Downtime (MTD) / Maximum Tolerable Period of Disruption (MTPD) (Correct answer)
- Mean Time Between Failures (MTBF)
- Recovery Time Actual (RTA)
Correct answer: Maximum Tolerable Downtime (MTD) / Maximum Tolerable Period of Disruption (MTPD)
MTD/MTPD defines the maximum time a business function can be disrupted before causing unacceptable consequences; it drives RTO requirements.
Question 6: Which risk does enabling vSphere Fault Tolerance (FT) specifically address that vSphere HA does NOT fully address?
- Risk of data loss from datastore corruption
- Risk of any application downtime during a host failure, including in-flight transactions (Correct answer)
- Risk of DRS imbalance causing performance degradation
- Risk of unauthorized VM cloning across clusters
Correct answer: Risk of any application downtime during a host failure, including in-flight transactions
vSphere FT provides zero-downtime and zero-data-loss protection by running a live shadow VM, whereas HA restarts VMs after failure causing brief downtime.
Question 7: An organization wants to assess the risk of a ransomware attack propagating to their vSphere backups. Which control MOST directly mitigates this risk?
- Enabling vSphere vMotion encryption
- Storing immutable backup copies using an air-gapped or WORM-capable backup target (Correct answer)
- Configuring DRS to automatically rebalance VM workloads
- Using vSAN deduplication to reduce backup storage footprint
Correct answer: Storing immutable backup copies using an air-gapped or WORM-capable backup target
Immutable or air-gapped backup targets prevent ransomware from encrypting or deleting backup data, ensuring a clean recovery point is always available.
VCP Risk Assessment & Management 4
A security audit finds that vCenter Server has accounts with administrator privileges that have not logged in for 180 days.
Which risk does this BEST represent?