An administrator deployed vRealize Operations and has been tasked with ensuring that the VMware SDDC remains compliant to the VMware vSphere Security Configuration Guide. The compliance benchmark is…

Question

Options

• AThe lockdown mode on a vSphere ESXi host is set to Disabled.
• BTransparent Page Sharing is Disabled on a virtual machine.
• CThe SNMP service on a vSphere ESXi host is set to Disabled.
• DThe Enable 3D Support setting for the Virtual Machine is set to FALSE.
• EThe Disable console copy operation for a Virtual Machine is set to FALSE.
• FThe Forged Transmit policy is set to allow on a Distributed Port Group.

• A
  79% (27)
• B
  12% (4)
• C
  3% (1)
• D
  6% (2)

Explanation

Options A, E, and F each represent configurations that weaken security in violation of the VMware vSphere Security Configuration Guide. Lockdown mode being Disabled (A) means ESXi hosts can be accessed directly without going through vCenter, bypassing centralized access controls - the guide mandates at least Normal lockdown mode. "Disable console copy" set to FALSE (E) means copy operations between the VM console and client are permitted, violating the guide's requirement to block clipboard/copy functionality; note the double-negative logic: FALSE on a "disable" setting = feature is ON. Forged Transmits set to Allow (F) permits MAC address spoofing at the network layer, which the guide explicitly requires to be set to Reject on all port groups.

The distractors describe configurations that are actually secure or neutral: TPS being Disabled (B) is the recommended state since it prevents side-channel memory attacks; SNMP being Disabled (C) is more secure than enabled; and 3D Support set to FALSE (D) is the recommended hardened setting since 3D acceleration expands the attack surface.

Memory tip: Flag anything that opens access or enables transmission - Lockdown off, copy allowed (watch the double-negative), Forged Transmits allowed. The wrong answers all describe things being turned off, which almost always means more secure, not less.

No community discussion yet for this question.