2V0-11.25 · Question #125
Following an internal security audit of the new VMware Cloud Foundation (VCF) instance, the following audit finding was documented for priority remediation: - All users from the custom…
The correct answer is C. Add the restricted administrators group to the DCUI.Access advanced system setting. E. Enable Normal Lockdown Mode. C: You can add users or groups to the DCUI.Access advanced system setting to allow them to access the Direct Console User Interface (DCUI) even when the host is in lockdown mode. Ensure that only the authorized group (restricted administrators group) is included in this…
Question
Following an internal security audit of the new VMware Cloud Foundation (VCF) instance, the following audit finding was documented for priority remediation:
- All users from the custom administrators group could access the
Direct Console User Interface (DCUI) on all ESXi hosts within the workload domain. RISK=High, IMPACT=High
- The company IT security policy around accessing ESXi servers states
the following:
- Users within the custom administrators group must access ESXi host
configurations from within vCenter Server or the vSphere Web Client only.
- Only users within the restricted administrators group must be allowed
direct access to ESXi hosts. Which two actions should the administrator perform on each of the hosts within the workload domain to remediate the security finding? (Choose two.)
Options
- ADisable SSH and the ESXi Shell.
- BAdd the custom administrators group to the DCUI.Access advanced system setting.
- CAdd the restricted administrators group to the DCUI.Access advanced system setting.
- DEnable Strict Lockdown Mode.
- EEnable Normal Lockdown Mode.
How the community answered
(47 responses)- A4% (2)
- B6% (3)
- C79% (37)
- D11% (5)
Explanation
C: You can add users or groups to the DCUI.Access advanced system setting to allow them to access the Direct Console User Interface (DCUI) even when the host is in lockdown mode. Ensure that only the authorized group (restricted administrators group) is included in this setting, and remove any other groups that should not have DCUI access." E: When Normal Lockdown Mode is enabled, only users and groups in the DCUI.Access list can log in to the Direct Console User Interface (DCUI) of the host. All other local or direct access is denied unless explicitly permitted in the DCUI.Access list. This mode allows vCenter-controlled access for all other administrative operations, which matches the company's security policy
Topics
Community Discussion
No community discussion yet for this question.