2V0-16.25 · Question #35
The security team has requested that high-sensitivity workloads be protected using Confidential Computing in your VMware vSphere Foundation (VVF) 9.0 environment. These workloads handle regulated…
The correct answer is C. Enable AMD SEV-SNP or Intel TDX support in the host BIOS and confirm compatibility in vSphere. E. Enable vSphere Trust Authority and set the Confidential Computing flag. Confidential Computing in vSphere requires two distinct layers working together: hardware-level memory encryption and a trusted host attestation framework. Option C is required because AMD SEV-SNP and Intel TDX are the CPU technologies that actually enforce cryptographic memory…
Question
The security team has requested that high-sensitivity workloads be protected using Confidential Computing in your VMware vSphere Foundation (VVF) 9.0 environment. These workloads handle regulated data that must be isolated from the hypervisor and other tenants, even when running on the same ESX host. The vSphere administrator is responsible for ensuring that only trusted hosts are used and that virtual machines are configured with hardware-enforced memory isolation. Which two configurations must you implement to support Confidential Computing for these workloads? (Choose two.)
Options
- ACreate virtual machines with hardware version 22 and set the Confidential Computing flag.
- BUse TPM 2.0 on the guest OS to generate attestation reports for VM launch.
- CEnable AMD SEV-SNP or Intel TDX support in the host BIOS and confirm compatibility in vSphere.
- DConfigure Encrypted vMotion with "Required" mode for the VM.
- EEnable vSphere Trust Authority and set the Confidential Computing flag.
How the community answered
(27 responses)- A7% (2)
- B4% (1)
- C85% (23)
- D4% (1)
Explanation
Confidential Computing in vSphere requires two distinct layers working together: hardware-level memory encryption and a trusted host attestation framework. Option C is required because AMD SEV-SNP and Intel TDX are the CPU technologies that actually enforce cryptographic memory isolation at silicon - without enabling them in the host BIOS and confirming vSphere compatibility, no amount of software configuration can protect workload memory from the hypervisor. Option E is required because vSphere Trust Authority (vTA) establishes the chain of trust, ensuring that only attested, known-good hosts are permitted to run sensitive workloads; the Confidential Computing flag on the VM then instructs vSphere to activate those hardware protections for that specific guest.
Why the distractors are wrong:
- A is wrong because setting a hardware version and the CC flag alone - without vTA - provides no attestation chain; you could inadvertently run that VM on an untrusted or compromised host.
- B is wrong because guest-OS TPM attestation serves VM Secure Boot and guest integrity, not hypervisor-level memory isolation; attestation for Confidential Computing is handled at the infrastructure layer by vTA, not inside the guest.
- D is wrong because Encrypted vMotion protects data in transit during live migration, a completely different threat model - it does nothing to isolate memory while the VM is running.
Memory tip: Think of it as "Silicon + Trust" - you need the CPU silicon (SEV-SNP/TDX via BIOS, option C) and the vSphere Trust framework (vTA + CC flag, option E). One without the other leaves a gap: hardware without attestation means you can't verify the host is safe; attestation without hardware means there's nothing isolating the memory.
Topics
Community Discussion
No community discussion yet for this question.