As part of the VMware Cloud Foundation (VCF) logical design, the architect documented the following requirement: - The solution must include high security hardening levels to meet military…

Question

Options

• AThe vSAN storage policy will be configured as Secondary Failures to Tolerate = 1.
• BVCF Operations will be configured to renew the SSL certificate for vCenter Server per security
• CNTP will be configured to the internal NTP servers of 192.168.12.1 and 192.168.24.1.
• DThe advanced setting UserVars.SuppressShellWarning will be configured to 0 across all ESXi
• EThe certificate of the VI workload domain vCenter Server will be issued by

• A
  31% (9)
• B
  17% (5)
• C
  45% (13)
• D
  7% (2)

Explanation

Options C and E satisfy the military compliance requirement because they represent physical design decisions - specifying concrete infrastructure elements that enforce security. Using internal NTP servers (option C) ensures time synchronization never traverses untrusted external networks, which is a foundational requirement in military/DoD environments where internet connectivity may be restricted or prohibited; accurate, internally-controlled time is also critical for audit log integrity and Kerberos authentication. Option E (vCenter certificate issued by an internal/enterprise CA) satisfies military PKI requirements by establishing a chain of trust rooted in a controlled, organizational Certificate Authority rather than relying on self-signed or vendor-default certificates - both are physical design decisions because they specify actual infrastructure components (real IP addresses, a specific issuing CA).

The distractors fail for these reasons:

• A (vSAN SFTT=1) addresses availability/resilience, not security hardening - it has nothing to do with compliance standards.
• B (VCF Operations renewing SSL certs) is an operational lifecycle task, not a physical design decision.
• D (UserVars.SuppressShellWarning = 0) is a logical configuration setting (an ESXi advanced parameter), not a physical design decision, even though it is a valid security hardening step.

Memory tip: For military compliance, think "trust nothing external" - both correct answers keep critical infrastructure internal: internal time sources (NTP IPs) and an internal CA for certificates. If an answer describes a specific IP, hostname, or issuing authority, it's likely a physical design decision.

No community discussion yet for this question.