VCP-VCF Administrator 2024 Question 205
Select 3As a VMware Cloud Foundation administrator, you are tasked with securing an ESXi host in your environment. The security audit team has flagged that the ESXi host is not compliant with the organization's hardening guidelines. Which of the following actions should you take to secure the ESXi host?
- A
Enable lockdown mode for the ESXi host.
- B
Disable SSH access unless absolutely required.
- C
Configure the ESXi host to use self-signed certificates for secure communication.
- D
Ensure only required services are running on the ESXi host.
- E
Allow root access via the ESXi Shell for administrative purposes.
Show answer and explanation
Correct answers: A, B, D
Explanation
Securing an ESXi host requires adhering to VMware's security best practices, including enabling lockdown mode, minimizing unnecessary services, and reducing access points such as SSH. These measures help in reducing the attack surface and ensuring compliance with hardening guidelines. Using trusted certificates and limiting root access are also critical steps in maintaining a secure environment.
- A. Correct.
Enabling lockdown mode restricts access to the ESXi host and ensures that only authorized users and services can interact with it, which is a key security measure.
- B. Correct.
Disabling SSH access reduces the attack surface of the ESXi host, as SSH can be exploited if not properly secured. It should only be enabled temporarily when needed for troubleshooting.
- C. Incorrect.
Using self-signed certificates is not a recommended practice in a production environment because they are less secure than certificates issued by a trusted Certificate Authority (CA).
- D. Correct.
Ensuring that only required services are running minimizes the attack surface and reduces the risk of exploitation of unused services.
- E. Incorrect.
Allowing root access via the ESXi Shell is a security risk and goes against best practices. Root access should be restricted and used only when absolutely necessary through secure methods.