VMware VCP6-DCV 2V0-621D Questions & Answers

• Question 201:

  An administrator with global administrator privileges creates a custom role but fails to assign any privileges to it. Which two privileges would the custom role have? (Choose two.)

  A. System.View

  B. System.Anonymous

  C. System.User

  D. System.ReadOnly

  Correct Answer: AB

  When you add a custom role and do not assign any privileges to it, the role is created as a Read Only role with three system-defined privileges: System.Anonymous, System.View, and System.Read. Reference: https://pubs.vmware.com/vsphere-51/index.jsp?topic= %2Fcom.vmware.vsphere.security.doc%2FGUID-93B962A7-93FA-4E96-B68F- AE66D3D6C663.html

• Question 202:

  When attempting to log in with the vSphere Web Client, users have reported the error:

  Incorrect Username/Password

  The administrator has configured the Platform Services Controller Identity Source as:

  Type. Active Directory as an LDAP Server Domain: vmware.com Alias: VMWARE Default Domain: Yes Which two statements would explain why users cannot login to the vSphere Web Client? (Choose two.)

  A. Users are typing the password incorrectly.

  B. Users are in a forest that has 1-way trust.

  C. Users are in a forest that has 2-way trust.

  D. Users are logging into vCenter Server with incorrect permissions.

  Correct Answer: AB

  The possible explanation for this error might be that the users are typing password incorrectly or they are in a forest with has only 1-way trust. You need 2-way trust to get the credentials accepted.

• Question 203:

  In which two vsphere.local groups should an administrator avoid adding members? (Choose two.)

  A. SolutionUsers

  B. Administrators

  C. DCAdmins

  D. ExternalPDUsers

  Correct Answer: AB

  The vsphere.local domain includes several predefined groups. Assign users to one of those groups to be able to perform the corresponding actions.

  For all objects in the vCenter Server hierarchy, permissions are assigned by pairing a user and a role with the object. For example, you can select a resource pool and give a group of users read privileges to that resource pool by giving them the corresponding role. For some services that are not managed by vCenter Server directly, privileges are determined by membership to one of the vCenter Single Sign-On groups. For example, a user who is a member of the Administrator group can manage

  vCenter Single Sign-On. A user who is a member of the CAAdmins group can manage the VMware Certificate Authority, and a user who is in the LicenseService.Administrators group can manage licenses. Reference: https://pubs.vmware.com/vsphere-60/index.jsp?topic= %2Fcom.vmware.vsphere.security.doc%2FGUID-87DA2F34- DCC9-4DAB-8900-1BA35837D07E.html

• Question 204:

  Strict Lockdown Mode has been enabled on an ESXi host.

  Which action should an administrator perform to allow ESXi Shell or SSH access for users with administrator privileges?

  A. Grant the users the administrator role and enable the service.

  B. Add the users to Exception Users and enable the service.

  C. No action can be taken, Strict Lockdown Mode prevents direct access.

  D. Add the users to vsphere.local and enable the service.

  Correct Answer: B

  Reference: https://pubs.vmware.com/vsphere-60/index.jsp?topic= %2Fcom.vmware.vsphere.security.doc%2FGUID-F8F105F7-CF93-46DF-9319- F8991839D265.html

• Question 205:

  An administrator wants to provide users restricted access. The users should only be able to perform the following tasks:

  Create and consolidate virtual machine snapshots Add/Remove virtual disks Snapshot Management

  Which default role in vCenter Server would meet the administrator's requirements for the users?

  A. Virtual machine user

  B. Virtual machine power user

  C. Virtual Datacenter administrator

  D. VMware Consolidated Backup user

  Correct Answer: B

  Virtual Machine Power User is a sample role that grants a user access rights only to virtual machines; can alter the virtual hardware or create snapshots of the VM. Reference: http://blog.pluralsight.com/vmware-access-control-101-roles-andpermissions

• Question 206:

  An administrator would like to use the VMware Certificate Authority (VMCA) as an Intermediate Certificate Authority (CA). The first two steps performed are:

  Replace the Root Certificate

  Replace Machine Certificates (Intermediate CA)

  Which two steps would need to be performed next? (Choose two.)

  A. Replace Solution User Certificates (Intermediate CA)

  B. Replace the VMware Directory Service Certificate (Intermediate CA)

  C. Replace the VMware Directory Service Certificate

  D. Replace Solution User Certificates

  Correct Answer: AC

  You can replace the VMCA root certificate with a third-party CA-signed certificate that includes VMCA in the certificate chain. Going forward, all certificates that VMCA generates include the full chain. You can replace existing certificates with newly generated certificates. This approach combines the security of third-party CA-signed certificate with the convenience of automated certificate management.

  Reference: http://pubs.vmware.com/vsphere-60/index.jsp?topic= %2Fcom.vmware.vsphere.security.doc%2FGUID-5FE583A2-3737-4B62- A905-5BB38D479AE0.html

• Question 207:

  An administrator needs to create an Integrated Windows Authentication (IWA) Identity Source on a newly deployed vCenter Server Appliance (VCSA). Which two actions will accomplish this? (Choose two.)

  A. Use a Service Principal Name (SPN) to configure the Identity Source.

  B. Use a Domain administrator to configure the Identity Source.

  C. Join the VCSA to Active Directory and configure the Identity Source with a Machine Account.

  D. Create a computer account in Active Directory for the VCSA and configure the Identity Source.

  Correct Answer: AC

  Using a machine account when configuring an Active Directory identity source for vCenter Server requires that the Windows system be joined to the domain. If the system is not joined to the domain, SSO cannot leverage the machine account

  to create the identity source and perform its function as the secure token service user.

  To resolve this issue in VCVA 5.5, use only the Use SPN option.

  Reference: http://kb.vmware.com/selfservice/microsites/search.do? language=en_USandcmd=displayKC andexternalId=2058919

• Question 208:

  Which two roles can be modified? (Choose two.)

  A. Administrator

  B. Network Administrator

  C. Datastore Consumer

  D. Read-Only

  Correct Answer: BC

  It is a common knowledge that you cannot modify Administrator role and grant whatever privileges you like. Same is the case with read-only. This role is created solely for ready only purposes. So you are left with two viable options ?Network administrator and Datastore consumer both of which can be modified to add or delete privileges according to your specifications.

• Question 209:

  Which Advanced Setting should be created for the vCenter Server to change the expiration policy of the vpxuser password?

  A. VimPasswordExpirationInDays

  B. VimExpirationPasswordDays

  C. VimPassExpirationInDays

  D. VimPasswordRefreshDays

  Correct Answer: A

  vCenter Server creates the vpxuser account on each ESX/ESXi host that it manages. The password for each vpxuser account is auto-generated when an ESX/ESXi host is added. The password is updated by default every 30 days.

  To modify default password settings:

  Connect vSphere Client to vCenter Server.

  Click Administration > vCenter Server Settings > Advanced Settings. Scroll to the parameter VirtualCenter.VimPasswordExpirationInDays and change the value from the default.

  Reference: http://kb.vmware.com/selfservice/microsites/search.do? language=en_USandcmd=displayKC andexternalId=1016736

• Question 210:

  Which three options are available for replacing vCenter Server Security Certificates? (Choose three.)

  A. Replace with Certificates signed by the VMware Certificate Authority.

  B. Make VMware Certificate Authority an Intermediate Certificate Authority.

  C. Do not use VMware Certificate Authority, provision your own Certificates.

  D. Use SSL Thumbprint mode.

  E. Replace all VMware Certificate Authority issued Certificates with self-signed Certificates.

  Correct Answer: ABC

  There are three options for replace vCenter server security certificates. You can replace it with certificates signed by VMware certificate authority; you can make the VMCA an intermediate certificate authority. Likewise, you can provision your own certificates.