2V0-13.24 · Question #56
A VMware Cloud Foundation (VCF) platform has been commissioned, and lines of business are requesting approved virtual machine applications via the platform's integrated automation portal. The…
The correct answer is A. The VCF platform and all PCI application virtual machines must be monitored using the Aria. In VMware Cloud Foundation (VCF) 5.2, non-functional requirements define how the system operates (e.g., security, performance), not what it does. The new service must comply with PCI DSS, a standard for protecting cardholder data, and the design must reflect this. The platform…
Question
A VMware Cloud Foundation (VCF) platform has been commissioned, and lines of business are requesting approved virtual machine applications via the platform's integrated automation portal. The platform was built following all provided company security guidelines and has been assessed against Sarbanes-Oxley Act of 2002 (SOX) regulations. The platform has the following characteristics:
- One Management Domain with a single cluster, supporting all
management services with all network traffic handled by a single Distributed Virtual Switch (DVS).
- A dedicated VI Workload Domain with a single cluster for all line of
business applications.
- A dedicated VI Workload Domain with a single cluster for Virtual
Desktop Infrastructure (VDI).
- Aria Operations is being used to monitor all clusters.
- VI Workload Domains are using a shared NSX instance.
An application owner has asked for approval to install a new service that must be protected as per the Payment Card Industry (PCI) Data Security Standard, which is going to be verified by a third-party organization. To support the new service, which additional non-functional requirement should be added to the design?
Options
- AThe VCF platform and all PCI application virtual machines must be monitored using the Aria
- BThe VCF platform and all PCI application virtual machines must be assessed for SOX compliance.
- CThe VCF platform and all PCI application virtual machine network traffic must be routed via NSX.
- DThe VCF platform and all PCI application virtual machines must be assessed against Payment
How the community answered
(35 responses)- A77% (27)
- B14% (5)
- C6% (2)
- D3% (1)
Explanation
In VMware Cloud Foundation (VCF) 5.2, non-functional requirements define how the system operates (e.g., security, performance), not what it does. The new service must comply with PCI DSS, a standard for protecting cardholder data, and the design must reflect this. The platform is already SOX-compliant, and the question seeks an additional non-functional requirement to support PCI compliance. Let's evaluate: Option A: The VCF platform and all PCI application virtual machines must be monitored using the Aria Operations Compliance Pack for Payment Card Industry This is correct. PCI DSS requires continuous monitoring and auditing (e.g., Requirement 10). The Aria Operations Compliance Pack for PCI provides pre-configured dashboards, alerts, and reports tailored to PCI DSS, ensuring the VCF platform and PCI VMs meet these standards. This is a non-functional requirement (monitoring quality), leverages existing Aria Operations, and directly supports the new service's compliance needs, making it the best addition. Option B: The VCF platform and all PCI application virtual machines must be assessed for SOX This is incorrect. The platform is already SOX-compliant, as stated. SOX (financial reporting) and PCI DSS (cardholder data) are distinct standards. Reassessing for SOX doesn't address the new service's PCI requirement and adds no value to the design for this purpose. Option C: The VCF platform and all PCI application virtual machine network traffic must be routed This is incorrect as a new requirement. The VI Workload Domains already use a shared NSX instance, implying NSX handles network traffic (e.g., overlay, security policies). PCI DSS requires network segmentation (Requirement 1), which NSX already supports. Adding this as a "new" requirement is redundant since it's an existing characteristic, not an additional need. Option D: The VCF platform and all PCI application virtual machines must be assessed against Payment Card Industry Data Security Standard (PCI DSS) compliance This is a strong contender but incorrect as a non-functional requirement. Assessing against PCI DSS is a process or action, not a quality of the system's operation. Non-functional requirements specify ongoing attributes (e.g., "must be secure," "must be monitored"), not one-time assessments. While PCI compliance is the goal, this option is more a project mandate than a
Topics
Community Discussion
No community discussion yet for this question.