VCP-VCF Administrator 2024 Question 212
Select 3You are tasked with ensuring the security of virtual machine workloads in a VMware Cloud Foundation environment. A critical VM contains sensitive financial data and must be encrypted. However, the organization wants to ensure the encryption process does not disrupt existing VM operations. Which steps should you follow to secure the VM using Virtual Machine Encryption?
- A
Enable vSphere Native Key Provider (NKP) or configure an external KMS in vCenter Server.
- B
Power off the virtual machine before enabling encryption to avoid operational disruptions.
- C
Use the VM's Edit Settings option in vCenter Server to enable encryption on the virtual disks.
- D
Ensure the user performing the encryption has sufficient privileges, such as Cryptographic Operations and Modify VM Configuration.
- E
Migrate the VM to an encrypted vSAN datastore to enable encryption automatically.
Show answer and explanation
Correct answers: A, C, D
Explanation
To secure workloads using Virtual Machine Encryption in VMware Cloud Foundation, administrators must first configure a key management solution (KMS) or enable the vSphere Native Key Provider. The encryption process is applied through the VM's settings in vCenter Server, and the user performing these tasks must have appropriate privileges. It is not necessary to power off the VM, and encryption of a VM is independent of the datastore's encryption status.
- A. Correct.
Correct. A key management solution (KMS) or vSphere Native Key Provider must be configured before enabling Virtual Machine Encryption. This step is mandatory for managing encryption keys.
- B. Incorrect.
Incorrect. Virtual machines do not need to be powered off to enable encryption. Encryption can be applied while the VM is powered on, ensuring no disruption to operations.
- C. Correct.
Correct. Encryption is enabled using the Edit Settings option in vCenter Server, where administrators can encrypt the VM's virtual disks or other components.
- D. Correct.
Correct. The user must have specific privileges, including Cryptographic Operations and Modify VM Configuration, to perform Virtual Machine Encryption.
- E. Incorrect.
Incorrect. Migrating a VM to an encrypted vSAN datastore does not automatically enable Virtual Machine Encryption. VM and datastore encryption are separate processes.