An administrator is planning a new VMware Cloud Director deployment and is concerned about secure communications between the clients and servers. Which two recommended steps would ensure secure…

Question

Options

• AVMware Cloud Director automatically creates self-signed certificates.
• BCreate a single certificate for each member of the server group, and import the certificates into the
• CCreate two certificates for the server group, and import the certificates into each cell's keystore.
• DCreate a single certificate and upload it through the Service Provider Portal to all members of the
• ECreate or use an existing wildcard certificate, and import it into each cell's keystore.

• A
  4% (1)
• B
  4% (1)
• C
  81% (22)
• D
  11% (3)

Explanation

Options C and E reflect VMware Cloud Director's recommended certificate strategy: VCD requires two certificates per server group (one for HTTPS and one for the console proxy endpoint), which must be manually imported into each cell's keystore - and using a wildcard certificate (e.g., *.domain.com) imported into each cell's keystore is an equally valid, supported approach that covers all cells under a common domain.

Option A is wrong because while VCD does auto-generate self-signed certificates, self-signed certs are not recommended for production as they are untrusted by browsers and clients by default. Option B is wrong because creating a unique certificate per cell member introduces inconsistency and is not the recommended architecture - all cells should share the same certificate(s). Option D is a distractor; there is no "Service Provider Portal" bulk-upload mechanism that distributes certificates to all cells - each cell's keystore must be configured directly.

Memory tip: Think of VCD cells like identical twins sharing the same ID - either give them both the same two certificates (HTTP + console proxy per group) or one wildcard cert that covers them all, and manually register it in each cell's keystore. "Two certs for the group, or one wild card for all."

No community discussion yet for this question.