VCP-VCF Administrator 2024 Question 206
Select 3You are tasked with securing an ESXi host in a VMware Cloud Foundation environment. The host is currently accessible using the root account over SSH, and it has an unnecessary service running. Which of the following actions should you take to secure the ESXi host?
- A
Disable SSH access for the root account.
- B
Enable the ESXi shell for administrative convenience.
- C
Stop and disable unnecessary services on the ESXi host.
- D
Set a strong password policy for ESXi user accounts.
- E
Configure the firewall to allow unrestricted access to all management interfaces.
Show answer and explanation
Correct answers: A, C, D
Explanation
Securing an ESXi host involves reducing its attack surface and enforcing strong security practices. Disabling SSH access for the root account, stopping unnecessary services, and enforcing a strong password policy are critical steps to enhance host security. However, enabling the ESXi shell unnecessarily or configuring the firewall to allow unrestricted access can increase the risk of unauthorized access and compromise the host's security.
- A. Correct.
Disabling SSH access for the root account adds a layer of security by requiring the use of named user accounts and privilege escalation, reducing the risk of unauthorized access.
- B. Incorrect.
Enabling the ESXi shell is not recommended unless absolutely necessary, as it increases the attack surface. It should remain disabled unless troubleshooting is required.
- C. Correct.
Stopping and disabling unnecessary services reduces the number of potential attack vectors on the host and improves security.
- D. Correct.
Setting a strong password policy ensures that passwords are complex and less likely to be compromised, enhancing the security of ESXi user accounts.
- E. Incorrect.
Configuring the firewall to allow unrestricted access weakens security by exposing the host to potential threats. Firewalls should be configured to allow only necessary and restricted access.