2V0-21.23 Question 254
Select 3An organization is implementing secure boot for their ESXi 8.0 hosts to comply with security policies. During the deployment, the administrator wants to ensure that the ESXi boot loader verifies the integrity of the loaded components. Which of the following are required steps to securely boot an ESXi host?
- A
Ensure UEFI firmware is enabled on the ESXi host.
- B
Enable TPM 2.0 on the ESXi host.
- C
Verify that the ESXi image is signed with a VMware digital certificate.
- D
Disable Secure Boot in the BIOS settings to prevent conflicts.
- E
Ensure all third-party VIBs (vSphere Installation Bundles) are signed with a trusted certificate.
Show answer and explanation
Correct answers: A, C, E
Explanation
Secure Boot for ESXi hosts ensures that only signed and trusted components are loaded during the boot process. Enabling UEFI firmware is mandatory because Secure Boot is a feature of UEFI. Additionally, the ESXi image must be signed with a VMware digital certificate, and any third-party VIBs must also be signed with trusted certificates to maintain the chain of trust. While TPM 2.0 enhances security and is recommended, it is not a required component for Secure Boot itself. Disabling Secure Boot would defeat the entire purpose of the security mechanism.
- A. Correct.
Ensuring UEFI firmware is enabled is a prerequisite for Secure Boot, as Secure Boot is a UEFI feature. Without UEFI firmware, Secure Boot cannot be configured.
- B. Incorrect.
While TPM 2.0 enhances security and is recommended for vSphere environments, it is not strictly required to enable Secure Boot on ESXi hosts.
- C. Correct.
The ESXi image must be signed with a VMware digital certificate to allow the boot loader to verify its integrity as part of the Secure Boot process.
- D. Incorrect.
Disabling Secure Boot in the BIOS settings would prevent Secure Boot from functioning, which is contrary to the goal of the scenario.
- E. Correct.
All third-party VIBs must be signed with a trusted certificate to ensure the integrity and authenticity of additional components loaded during the boot process. Otherwise, Secure Boot will fail.