nerdexam
Broadcom-VMware

2V0-621 · Question #16

Lockdown Mode has been enabled on an ESXi 6.x host and users are restricted from logging into the Direct Console User Interface (DCUI). Which two statements are true given this configuration?…

The correct answer is A. A user granted administrative privileges in the Exception User list can login. B. A user defined in the DCUI.Access without administrative privileges can login. When ESXi Lockdown Mode restricts DCUI access, two specific mechanisms still allow login - the Exception Users list for users with admin privileges and the DCUI.Access advanced configuration for designated users without requiring admin rights.

Section 1 – Configure and Administer vSphere 6.x Security

Question

Lockdown Mode has been enabled on an ESXi 6.x host and users are restricted from logging into the Direct Console User Interface (DCUI). Which two statements are true given this configuration? (Choose two.)

Options

  • AA user granted administrative privileges in the Exception User list can login.
  • BA user defined in the DCUI.Access without administrative privileges can login.
  • CA user defined in the ESXi Admins domain group can login.
  • DA user set to the vCenter Administrator role can login.

How the community answered

(50 responses)
  • A
    80% (40)
  • C
    14% (7)
  • D
    6% (3)

Why each option

When ESXi Lockdown Mode restricts DCUI access, two specific mechanisms still allow login - the Exception Users list for users with admin privileges and the DCUI.Access advanced configuration for designated users without requiring admin rights.

AA user granted administrative privileges in the Exception User list can login.Correct

A user added to the ESXi Exception Users list who holds administrative privileges retains the ability to log into the DCUI even when Lockdown Mode is active, because the Exception Users list is explicitly designed to preserve emergency console access for authorized administrators.

BA user defined in the DCUI.Access without administrative privileges can login.Correct

Users listed in the DCUI.Access advanced configuration option can access the DCUI in Lockdown Mode regardless of whether they hold administrative privileges, because this setting provides a direct-access grant that is evaluated independently of role-based permission checks.

CA user defined in the ESXi Admins domain group can login.

Membership in the ESXi Admins domain group grants administrative privileges on the host but is not recognized as an exception mechanism by Lockdown Mode, so group members are still blocked from DCUI access.

DA user set to the vCenter Administrator role can login.

The vCenter Administrator role grants permissions within vCenter Server but does not translate into DCUI login capability on an ESXi host that has Lockdown Mode enabled.

Concept tested: ESXi Lockdown Mode DCUI access exception mechanisms

Source: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-88B24613-E8F9-40D2-B838-225F5FF5B7E0.html

Topics

#lockdown mode#DCUI access#exception users#ESXi security

Community Discussion

No community discussion yet for this question.

Full 2V0-621 Practice