nerdexam
Broadcom-VMware

2V0-620 · Question #99

What happens to the status of users already logged into ESXi Shell when a vSphere administrator enables lockdown mode?

The correct answer is A. Users remain logged in and can run commands, except to disable lockdown mode. Enabling lockdown mode on an ESXi host does not forcibly terminate existing ESXi Shell sessions - those users remain logged in and can continue running commands. However, they are specifically blocked from disabling lockdown mode.

Section 1 – Secure vSphere Environments

Question

What happens to the status of users already logged into ESXi Shell when a vSphere administrator enables lockdown mode?

Options

  • AUsers remain logged in and can run commands, except to disable lockdown mode.
  • BUsers remain logged in and can run commands, including disabling lockdown mode.
  • CUsers are immediately logged out of ESXi Shell.
  • DUsers are logged out after a timeout specified by the vSphere administrator.

How the community answered

(42 responses)
  • A
    90% (38)
  • B
    2% (1)
  • C
    5% (2)
  • D
    2% (1)

Why each option

Enabling lockdown mode on an ESXi host does not forcibly terminate existing ESXi Shell sessions - those users remain logged in and can continue running commands. However, they are specifically blocked from disabling lockdown mode.

AUsers remain logged in and can run commands, except to disable lockdown mode.Correct

When a vSphere administrator enables lockdown mode, any users who are already authenticated and active in ESXi Shell retain their session and can continue to execute commands. The restriction introduced by lockdown mode is that these users cannot disable lockdown mode from within the shell, preserving the security posture enforced by vCenter Server. This behavior applies to both Normal and Strict lockdown modes for already-established sessions.

BUsers remain logged in and can run commands, including disabling lockdown mode.

This is incorrect because users already logged in cannot disable lockdown mode - that specific operation is restricted as part of lockdown mode enforcement.

CUsers are immediately logged out of ESXi Shell.

Enabling lockdown mode does not immediately terminate active ESXi Shell sessions; existing sessions are preserved with the restriction that lockdown mode cannot be disabled from them.

DUsers are logged out after a timeout specified by the vSphere administrator.

There is no administrator-configurable timeout that logs out existing shell users upon lockdown mode activation; session termination based on a timeout is not part of the lockdown mode feature.

Concept tested: ESXi lockdown mode effect on active shell sessions

Source: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-88B24613-E8F9-40D2-B838-225C5FF06F6F.html

Topics

#lockdown mode#ESXi Shell#security#user sessions

Community Discussion

No community discussion yet for this question.

Full 2V0-620 Practice