VCP-VCF Administrator 2024 Question 213
Select 3You are an administrator managing a VMware Cloud Foundation environment. Your organization requires all sensitive workloads to be encrypted at the host level to meet compliance standards. Which steps must you take to enable and ensure proper functionality of host-based encryption for securing these workloads?
- A
Enable vSphere Native Key Provider (vSphere NKP) or configure an external Key Management Server (KMS).
- B
Verify that the ESXi hosts in the cluster support hardware-assisted encryption.
- C
Enable vSAN encryption, as it is mandatory for enabling host-based encryption.
- D
Encrypt the required virtual machines individually by enabling VM Encryption.
- E
Assign the 'No Cryptography Administrator' role to all administrators to prevent unauthorized access.
Show answer and explanation
Correct answers: A, B, D
Explanation
Host-based encryption in VMware Cloud Foundation requires a key management system to manage encryption keys and hardware support for encryption. Additionally, workloads are secured through VM Encryption, which must be enabled for each virtual machine. While vSAN encryption and specific administrative roles may enhance security, they are not prerequisites for implementing host-based encryption for workloads.
- A. Correct.
Correct: A key management system, such as vSphere Native Key Provider or an external KMS, is necessary to manage encryption keys, which is essential for host-based encryption.
- B. Correct.
Correct: Host-based encryption requires hardware-assisted encryption support, such as Intel AES-NI or AMD equivalent, to function properly.
- C. Incorrect.
Incorrect: vSAN encryption is not mandatory for host-based encryption. VM Encryption and host-based encryption are separate features, and enabling vSAN encryption is not required to secure workloads with host-based encryption.
- D. Correct.
Correct: Virtual machines must be individually encrypted by enabling VM Encryption to ensure that the workloads are secured using host-based encryption.
- E. Incorrect.
Incorrect: The 'No Cryptography Administrator' role restricts access to encryption-related tasks but is not required to enable host-based encryption for workloads.