An administrator has deployed vRealize Operations and has been tasked with ensuring that the VMware SDDC remains compliant to the VMware vSphere Security Configuration Guide. The compliance…

Question

Options

• AThe MAC Address Changes policy is set to reject on a Distributed Port Group.
• BNTP is enabled and configured on a vSphere ESXi host.
• CSSH is enabled and configured on a vSphere ESXi host.
• DA Floppy drive is connected to a virtual machine.
• ETransparent Page Sharing is Disabled on a virtual machine.
• FThe Promiscuous Mode policy is set to allow on a Distributed Port Group.

• A
  8% (2)
• B
  31% (8)
• C
  50% (13)
• E
  12% (3)

Explanation

Options C, D, and F each violate VMware's vSphere Security Configuration Guide defaults. SSH enabled on ESXi (C) is flagged because SSH should be disabled when not actively needed, as it expands the attack surface of the hypervisor. A connected floppy drive (D) triggers an alert because the guide mandates removing all unnecessary virtual hardware (floppy, serial, parallel devices) from VMs to eliminate potential data exfiltration paths. Promiscuous Mode set to Allow (F) is a clear violation - it permits a VM's vNIC to receive all traffic on the port group, enabling network sniffing; the guide requires this be set to Reject.

The distractors represent already-compliant configurations: A (MAC Address Changes set to Reject) is the recommended secure setting, not a violation. B (NTP enabled) is actively required by the guide for log integrity and time synchronization. E (Transparent Page Sharing disabled) is also the secure recommended state - TPS is disabled to prevent cross-VM side-channel memory attacks.

Memory tip: Think "SSH, Floppy, Promiscuous" as the three things that should be OFF or GONE - if any are active/present, the environment is insecure. The distractors flip this: NTP must be ON, MAC Changes must be REJECT, and TPS must be OFF - all already in their secure state.

No community discussion yet for this question.