An architect is designing a certificate strategy for vRealize Operations (vROps) to satisfy the following requirements: - Enhance security - Avoid browser warnings - The certificate must be…

Question

Options

• ACertificates will use the PEM format.
• BCertificates will be created using the Diffie-Hellman security-key algorithm.
• CCertificates will use the PFX and/or PKCS12 format.
• DThe solution will use CA-signed certificates.
• ECertificates will use multiple Subject Alternative Name (SAN) entries.
• FThe solution will use self-signed certificates.

• A
  46% (11)
• B
  13% (3)
• C
  8% (2)
• F
  33% (8)

Explanation

A (PEM format) is correct because vROps runs on Linux-based appliances, which natively use PEM-formatted certificates (.pem, .crt, .key files). D (CA-signed certificates) directly satisfies two requirements simultaneously: CA-signed certs are trusted by browsers (eliminating warnings) and provide stronger security than self-signed options. E (SAN entries) satisfies the "applicable for all vROps servers" requirement by embedding multiple hostnames (master node, replica nodes, data nodes, remote collectors) into a single certificate.

The distractors fail as follows: B is wrong because Diffie-Hellman is a key exchange protocol, not a certificate signing algorithm (RSA/ECDSA sign certificates); C (PFX/PKCS12) is a Windows-centric format used in IIS/Windows Server - vROps uses PEM, not PFX; F (self-signed) directly violates the "avoid browser warnings" requirement, as browsers inherently distrust self-signed certs.

Memory tip: Use the acronym "PCS" to remember what vROps certs need - PEM format, CA-signed, SAN entries. If you see "self-signed" or "PFX" in a Linux appliance question, eliminate them immediately.

No community discussion yet for this question.