2V0-620 · Question #99
What happens to the status of users already logged into ESXi Shell when a vSphere administrator enables lockdown mode?
The correct answer is A. Users remain logged in and can run commands, except to disable lockdown mode. Enabling lockdown mode on an ESXi host does not forcibly terminate existing ESXi Shell sessions - those users remain logged in and can continue running commands. However, they are specifically blocked from disabling lockdown mode.
Question
What happens to the status of users already logged into ESXi Shell when a vSphere administrator enables lockdown mode?
Options
- AUsers remain logged in and can run commands, except to disable lockdown mode.
- BUsers remain logged in and can run commands, including disabling lockdown mode.
- CUsers are immediately logged out of ESXi Shell.
- DUsers are logged out after a timeout specified by the vSphere administrator.
How the community answered
(42 responses)- A90% (38)
- B2% (1)
- C5% (2)
- D2% (1)
Why each option
Enabling lockdown mode on an ESXi host does not forcibly terminate existing ESXi Shell sessions - those users remain logged in and can continue running commands. However, they are specifically blocked from disabling lockdown mode.
When a vSphere administrator enables lockdown mode, any users who are already authenticated and active in ESXi Shell retain their session and can continue to execute commands. The restriction introduced by lockdown mode is that these users cannot disable lockdown mode from within the shell, preserving the security posture enforced by vCenter Server. This behavior applies to both Normal and Strict lockdown modes for already-established sessions.
This is incorrect because users already logged in cannot disable lockdown mode - that specific operation is restricted as part of lockdown mode enforcement.
Enabling lockdown mode does not immediately terminate active ESXi Shell sessions; existing sessions are preserved with the restriction that lockdown mode cannot be disabled from them.
There is no administrator-configurable timeout that logs out existing shell users upon lockdown mode activation; session termination based on a timeout is not part of the lockdown mode feature.
Concept tested: ESXi lockdown mode effect on active shell sessions
Source: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-88B24613-E8F9-40D2-B838-225C5FF06F6F.html
Topics
Community Discussion
No community discussion yet for this question.