2V0-622 · Question #16
Lockdown Mode has been enabled on an ESXi 6.x host and users are restricted from logging into the Direct Console User Interface (DCUI). Which two statements are true given this configuration? (Choose
The correct answer is A. A user granted administrative privileges in the Exception User list can login. B. A user defined in the DCUI.Access without administrative privileges can login.. ESXi Lockdown Mode restricts direct host access but provides two specific mechanisms - the Exception Users list and the DCUI.Access setting - that allow designated users to retain DCUI login capability.
Question
Lockdown Mode has been enabled on an ESXi 6.x host and users are restricted from logging into the Direct Console User Interface (DCUI). Which two statements are true given this configuration? (Choose two.)
Options
- AA user granted administrative privileges in the Exception User list can login.
- BA user defined in the DCUI.Access without administrative privileges can login.
- CA user defined in the ESXi Admins domain group can login.
- DA user set to the vCenter Administrator role can login.
How the community answered
(17 responses)- A82% (14)
- C12% (2)
- D6% (1)
Why each option
ESXi Lockdown Mode restricts direct host access but provides two specific mechanisms - the Exception Users list and the DCUI.Access setting - that allow designated users to retain DCUI login capability.
A user included in the Exception Users list who has been granted administrative privileges on the ESXi host retains the ability to log into the DCUI even when Lockdown Mode is active. This mechanism exists specifically to ensure at least one break-glass account can access the host directly in an emergency.
The DCUI.Access advanced configuration setting on an ESXi host specifies a list of user accounts that are permitted to access the DCUI regardless of Lockdown Mode status, even if those users do not hold administrative privileges. This setting is designed for scenarios where a designated operator needs emergency console access without full admin rights.
Membership in the ESXi Admins Active Directory domain group grants administrative privileges on the host but does not by itself provide an exemption from Lockdown Mode DCUI restrictions - the user must also be explicitly added to the Exception Users list.
The vCenter Administrator role grants permissions within vCenter Server's permission model but does not confer any special bypass for ESXi Lockdown Mode, as DCUI access is governed by ESXi-local settings rather than vCenter roles.
Concept tested: ESXi Lockdown Mode DCUI access exception mechanisms
Source: https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-88B24613-E8F9-40D2-B838-225F4B97599D.html
Topics
Community Discussion
No community discussion yet for this question.