2V0-21.23 Question 450
Select 2You are tasked with securing virtual machine migration traffic in your VMware vSphere environment. To achieve this, you need to configure vMotion encryption properties. Which of the following configurations will ensure that vMotion traffic is encrypted while maintaining compatibility with existing hosts that do not support encryption? (Choose two.)
- A
Enable 'Required' encryption mode for vMotion on all virtual machines.
- B
Set vMotion encryption mode to 'Opportunistic' on the vSphere cluster.
- C
Upgrade all ESXi hosts to the latest version to support encrypted vMotion.
- D
Ensure that VMkernel adapters used for vMotion are configured on an isolated network.
- E
Set vMotion encryption mode to 'Disabled' for improved performance.
Show answer and explanation
Correct answers: B, D
Explanation
To secure vMotion traffic while maintaining compatibility, the 'Opportunistic' mode is the best choice as it encrypts traffic when supported by both hosts but does not force encryption, avoiding compatibility issues. Additionally, configuring VMkernel adapters for vMotion on an isolated network enhances traffic security and aligns with best practices.
- A. Incorrect.
This option forces encryption for vMotion traffic, but it will cause compatibility issues with hosts that do not support encryption. It is not suitable in the given scenario where compatibility is required.
- B. Correct.
The 'Opportunistic' encryption mode encrypts vMotion traffic if supported by both the source and destination hosts, while maintaining compatibility with hosts that do not support encryption.
- C. Incorrect.
Upgrading all ESXi hosts is a good long-term strategy, but it is not a configuration step for vMotion encryption. Additionally, the scenario does not state that an upgrade is possible.
- D. Correct.
Configuring VMkernel adapters on an isolated network enhances security by ensuring that vMotion traffic is not exposed to unsecured networks. While not directly related to encryption, it is a recommended practice for securing vMotion traffic.
- E. Incorrect.
Disabling vMotion encryption entirely would negate the security benefit, making this option unsuitable for the scenario.