VCP-VCF Administrator 2024 Question 37
Single answerYou are a VMware Cloud Foundation Administrator tasked with securing your environment by replacing self-signed certificates with CA-signed certificates. During the process, you decide to use the VMware Cloud Foundation Certificate Authority (VMCA) to generate and manage certificates for the components. What step must you take to ensure the certificate replacement process is successful?
- A
Generate a Certificate Signing Request (CSR) for each component and submit it to the VMCA.
- B
Import the root certificate of the VMCA into all workload VMs running in the environment.
- C
Replace only the vCenter Server certificates, as other components will automatically update their certificates.
- D
Ensure that the SDDC Manager's certificate is replaced first before replacing certificates for other components.
Show answer and explanation
Correct answer: D
Explanation
When configuring certificate management in VMware Cloud Foundation, it is critical to start by replacing the SDDC Manager's certificate. This establishes trust across the environment and allows subsequent certificate replacements for other components to proceed without issues. Skipping this step can lead to trust errors and a misaligned security posture.
- A. Incorrect.
Generating a Certificate Signing Request (CSR) is required when using an external CA, not the VMCA. The VMCA can generate and manage certificates without requiring a CSR for each component.
- B. Incorrect.
Importing the root certificate of the VMCA into workload VMs is not necessary for the certificate replacement process to succeed. This action is only needed if workload VMs require trust in the VMCA's certificates.
- C. Incorrect.
Replacing only the vCenter Server certificates is insufficient. All components within the VMware Cloud Foundation environment must have their certificates replaced to ensure consistent security.
- D. Correct.
The SDDC Manager's certificate must be replaced first because it is the central management component. This ensures that subsequent certificate replacements for other components, such as vCenter Server and NSX, are trusted and aligned with the updated security model.