2V0-21.23 Question 448
Single answerYou are tasked with migrating an encrypted virtual machine (VM) to a different ESXi host while maintaining its encryption and ensuring compliance with security policies. The source and destination hosts are managed by vCenter Server and are configured with the same Key Management Server (KMS). What is a critical step you need to perform before initiating the migration?
- A
Ensure the destination ESXi host is registered with the same KMS as the source host.
- B
Disable encryption on the virtual machine before initiating the migration.
- C
Enable vSphere vMotion encryption for the migration.
- D
Export the encryption keys manually and import them into the destination ESXi host.
Show answer and explanation
Correct answer: A
Explanation
When migrating an encrypted virtual machine, it is critical to ensure that the source and destination ESXi hosts are registered with the same KMS. This allows the destination host to access the encryption keys needed to decrypt and encrypt the VM data during the migration process. Without this step, the migration will fail due to encryption key unavailability. Other options, such as disabling encryption or manually exporting keys, are either unnecessary or violate best practices for maintaining VM security.
- A. Correct.
Correct. The destination ESXi host must be registered with the same KMS as the source host to ensure the encryption keys are available for the encrypted VM during and after the migration.
- B. Incorrect.
Incorrect. Disabling encryption on the VM would compromise its security and is not required for migration. This step contradicts best practices for encrypted VMs.
- C. Incorrect.
Incorrect. While enabling vSphere vMotion encryption is a best practice for secure migrations, it is not a critical step specific to migrating an encrypted VM. The primary requirement is ensuring the destination host has access to the same KMS.
- D. Incorrect.
Incorrect. Encryption key management is handled automatically by vSphere when the hosts are registered with the same KMS. There is no need to manually export and import encryption keys.