2V0-621 · Question #242
An administrator wants to configure an ESXi 6.x host to use Active Directory (AD) to manage users and groups. The AD domain group ESX Admins was previously created. Which two conditions should be cons
The correct answer is A. If administrative access for ESX Admins is not desired, an alternate AD group must be used. D. An ESXi host provisioned with Auto Deploy cannot store AD credentials.. When joining an ESXi host to Active Directory, the ESX Admins group automatically receives full admin rights on the host, and Auto Deploy hosts cannot persistently store AD credentials.
Question
An administrator wants to configure an ESXi 6.x host to use Active Directory (AD) to manage users and groups. The AD domain group ESX Admins was previously created. Which two conditions should be considered when planning this configuration? (Choose two.)
Options
- AIf administrative access for ESX Admins is not desired, an alternate AD group must be used.
- BThe users in ESX Admins are granted administrative privileges in vCenter Server.
- CThe users in ESX Admins are not restricted by Lockdown Mode.
- DAn ESXi host provisioned with Auto Deploy cannot store AD credentials.
How the community answered
(39 responses)- A77% (30)
- B8% (3)
- C15% (6)
Why each option
When joining an ESXi host to Active Directory, the ESX Admins group automatically receives full admin rights on the host, and Auto Deploy hosts cannot persistently store AD credentials.
By default, any AD group named 'ESX Admins' is automatically granted full administrative privileges on the ESXi host. If this level of access is not desired, the administrator must configure an alternate AD group to avoid unintended privilege escalation.
The ESX Admins AD group grants administrative privileges on the ESXi host directly, not on vCenter Server - these are separate permission systems with independent access controls.
Users in ESX Admins are still subject to Lockdown Mode restrictions; Lockdown Mode limits direct host access regardless of AD group membership.
ESXi hosts provisioned via Auto Deploy boot from a network image and do not retain persistent local state by default, which means they cannot store Active Directory credentials across reboots without additional configuration such as a stateful install or a host profile with credential store.
Concept tested: ESXi Active Directory integration and Auto Deploy limitations
Source: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-DC96FFDB-F5F2-43EC-8C73-05ACDAE6BE43.html
Topics
Community Discussion
No community discussion yet for this question.