VCP-VCF Administrator 2024 Question 210
Select 3An organization uses VMware Cloud Foundation and wants to secure its workloads and infrastructure by enabling encryption. As part of this initiative, they need to ensure that all virtual machine (VM) data is encrypted at rest and that the encryption keys are managed securely. Which steps must the Cloud Foundation Administrator take to achieve this?
- A
Enable vSphere VM Encryption and configure a Key Management Server (KMS) in vCenter Server.
- B
Manually encrypt each VM disk by logging into the guest OS and using a third-party encryption tool.
- C
Ensure the ESXi hosts are configured to trust the Key Management Server (KMS).
- D
Enable encryption for the vSAN datastore to encrypt data at rest for all VMs stored on it.
- E
Use vSphere Native Key Provider (NKP) instead of an external KMS to manage encryption keys in a secure and simpler manner.
Show answer and explanation
Correct answers: A, C, D
Explanation
To secure workloads and infrastructure using encryption in VMware Cloud Foundation, administrators need to enable vSphere VM Encryption, configure and trust a Key Management Server (KMS), and optionally enable vSAN datastore encryption for data at rest. These features work together to ensure that VM data and infrastructure components are secured using robust encryption mechanisms. Manually encrypting VM disks or relying solely on vSphere Native Key Provider (NKP) does not fully meet these requirements.
- A. Correct.
Correct: Enabling vSphere VM Encryption and configuring a Key Management Server (KMS) in vCenter Server is a core step to ensure VM data is encrypted at rest.
- B. Incorrect.
Incorrect: Manually encrypting each VM disk within the guest operating system is not a VMware-recommended or scalable solution for securing workloads using VMware Cloud Foundation.
- C. Correct.
Correct: ESXi hosts must trust the Key Management Server (KMS) to manage and access encryption keys securely.
- D. Correct.
Correct: Enabling vSAN datastore encryption ensures all VM data stored in the datastore is encrypted at rest, an important step for securing workloads.
- E. Incorrect.
Incorrect: While vSphere Native Key Provider (NKP) can simplify key management, it does not replace the need for a KMS and does not meet all security requirements for encryption in a Cloud Foundation environment.