2V0-621 · Question #16
Lockdown Mode has been enabled on an ESXi 6.x host and users are restricted from logging into the Direct Console User Interface (DCUI). Which two statements are true given this configuration?…
The correct answer is A. A user granted administrative privileges in the Exception User list can login. B. A user defined in the DCUI.Access without administrative privileges can login. When ESXi Lockdown Mode restricts DCUI access, two specific mechanisms still allow login - the Exception Users list for users with admin privileges and the DCUI.Access advanced configuration for designated users without requiring admin rights.
Question
Lockdown Mode has been enabled on an ESXi 6.x host and users are restricted from logging into the Direct Console User Interface (DCUI). Which two statements are true given this configuration? (Choose two.)
Options
- AA user granted administrative privileges in the Exception User list can login.
- BA user defined in the DCUI.Access without administrative privileges can login.
- CA user defined in the ESXi Admins domain group can login.
- DA user set to the vCenter Administrator role can login.
How the community answered
(50 responses)- A80% (40)
- C14% (7)
- D6% (3)
Why each option
When ESXi Lockdown Mode restricts DCUI access, two specific mechanisms still allow login - the Exception Users list for users with admin privileges and the DCUI.Access advanced configuration for designated users without requiring admin rights.
A user added to the ESXi Exception Users list who holds administrative privileges retains the ability to log into the DCUI even when Lockdown Mode is active, because the Exception Users list is explicitly designed to preserve emergency console access for authorized administrators.
Users listed in the DCUI.Access advanced configuration option can access the DCUI in Lockdown Mode regardless of whether they hold administrative privileges, because this setting provides a direct-access grant that is evaluated independently of role-based permission checks.
Membership in the ESXi Admins domain group grants administrative privileges on the host but is not recognized as an exception mechanism by Lockdown Mode, so group members are still blocked from DCUI access.
The vCenter Administrator role grants permissions within vCenter Server but does not translate into DCUI login capability on an ESXi host that has Lockdown Mode enabled.
Concept tested: ESXi Lockdown Mode DCUI access exception mechanisms
Source: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-88B24613-E8F9-40D2-B838-225F5FF5B7E0.html
Topics
Community Discussion
No community discussion yet for this question.