An administrator is using virtual machine encryption in their vSphere 6.5 environment. The Key Management Server (KMS) has experienced a critical failure. Which two statements are true about VM encryption when the KMS is not available? (Choose two.)

Question

Accepted Answer

B. VMs which were running at the time of the KMS failure will continue to run. ESXi hosts cache the encryption keys in memory at the time of VM power-on, so VMs that were already running when the KMS failed continue to operate normally without needing to contact the KMS again. C. If an ESXi host is rebooted,it will be unable to power on encrypted VMs until KMS connectivity is When an ESXi host reboots, it clears its in-memory key cache and must contact the KMS to retrieve the Key Encryption Keys (KEKs) needed to unlock encrypted VM files - without KMS connectivity, encrypted VMs cannot be powered on.

Answer

A. VMs will shut down gracefully in the event of a KMS outage as a proactive measure to prevent ESXi does not gracefully shut down running encrypted VMs during a KMS outage - running VMs are unaffected as long as the host itself is not rebooted.

Answer

D. vCenter Server will continue to distribute encryption keys as long as it is not rebooted while the vCenter Server does not distribute or cache encryption keys - key distribution is exclusively the responsibility of the KMS, and vCenter only brokers the key ID references.

Answer

E. ESXi hosts within the same cluster will share keyswith one another while the KMS is unreachable. ESXi hosts do not share encryption keys with each other - each host independently retrieves keys from the KMS and there is no peer-to-peer key distribution mechanism.

An administrator is using virtual machine encryption in their vSphere 6.5 environment. The Key Management Server (KMS) has experienced a critical failure. Which two statements are true about VM…

Question

Options

How the community answered

Why each option

Topics

Community Discussion