nerdexam
Broadcom-VMware

2V0-622 · Question #283

An administrator is attempting to access an ESXi host via the DCUI but is unable to do so. Which could be two possible causes? (Choose two.)

The correct answer is C. Strict lockdown mode is enabled on the host. E. The DCUI service is disabled on the host.. DCUI access can be blocked either by strict lockdown mode - which disables the DCUI service entirely - or by the DCUI service being stopped independently on the host.

Section 1 – Configure and Administer vSphere 6.5 Security

Question

An administrator is attempting to access an ESXi host via the DCUI but is unable to do so. Which could be two possible causes? (Choose two.)

Options

  • AThe host in question has no out-of-band management capability (i.e. iLO/iDRAC).
  • BThe SSH service is disabled on the host.
  • CStrict lockdown mode is enabled on the host.
  • DNormal lockdown mode is enabled and the administrator is a member of the Exception User list.
  • EThe DCUI service is disabled on the host.

How the community answered

(35 responses)
  • A
    11% (4)
  • B
    6% (2)
  • C
    80% (28)
  • D
    3% (1)

Why each option

DCUI access can be blocked either by strict lockdown mode - which disables the DCUI service entirely - or by the DCUI service being stopped independently on the host.

AThe host in question has no out-of-band management capability (i.e. iLO/iDRAC).

Out-of-band management hardware (iLO/iDRAC) provides a separate remote console path but has no effect on the DCUI, which operates through the host's own physical or virtual console.

BThe SSH service is disabled on the host.

SSH is an independent remote shell service; its state has no bearing on the DCUI, which is a completely separate service running on the host.

CStrict lockdown mode is enabled on the host.Correct

Strict lockdown mode disables the DCUI service on the ESXi host as part of its design to force all management through vCenter only, making it impossible to log in via the console regardless of user privileges. This is distinct from normal lockdown mode, which still allows DCUI access for certain privileged users.

DNormal lockdown mode is enabled and the administrator is a member of the Exception User list.

Normal lockdown mode explicitly permits DCUI access for administrators who are members of the Exception User list, so this combination would allow - not block - access.

EThe DCUI service is disabled on the host.Correct

If the DCUI service is explicitly stopped or disabled on the host, the console interface will not respond to input, preventing any user from accessing it regardless of lockdown state.

Concept tested: ESXi DCUI access restrictions under lockdown mode

Source: https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.security.doc/GUID-88B24C73-9E71-4A5A-AB75-37F4CE50AECE.html

Topics

#DCUI#lockdown mode#ESXi access control#Exception User list

Community Discussion

No community discussion yet for this question.

Full 2V0-622 Practice