2V0-21.23 Question 256
Single answerAn administrator wants to ensure that their ESXi 8.x hosts are securely booted to meet security compliance requirements. They have configured UEFI Secure Boot on the hardware and enabled TPM 2.0 on all the servers. What additional step should the administrator perform to fully leverage secure boot functionality in the vSphere environment?
- A
Enable the 'Secure Boot' option in the ESXi host BIOS settings
- B
Ensure that the ESXi image is signed by VMware or a trusted authority
- C
Configure key management within the vCenter Server
- D
Enable vSphere Trust Authority in the environment
Show answer and explanation
Correct answer: B
Explanation
To securely boot ESXi hosts, the ESXi image must be digitally signed by VMware or another trusted authority. This ensures that the boot files have not been tampered with and aligns with Secure Boot's purpose of verifying the integrity of the boot process. Other options, while related to security, are either pre-requisites or additional features that are not directly required for enabling Secure Boot functionality.
- A. Incorrect.
While enabling 'Secure Boot' in the BIOS is an essential pre-requisite, this step is assumed to be already completed as part of configuring UEFI Secure Boot on the hardware.
- B. Correct.
Ensuring that the ESXi image is signed by VMware or a trusted authority is a critical step for Secure Boot to verify the integrity of the boot files during startup.
- C. Incorrect.
Key management within the vCenter Server is related to managing encryption keys for encrypted virtual machines or storage, but it is not directly tied to Secure Boot functionality.
- D. Incorrect.
Enabling vSphere Trust Authority enhances host attestation and workload security but is not a mandatory step for enabling Secure Boot on ESXi hosts.