I85PREP
⌘ K
Dell VxRail Operate study materials
Dell VxRail Operate study resources

Dell VxRail Operate: VxRail Security, Access Control, and Compliance

Dell VxRail Operate · Work through your exam, one topic at a time.

All guide sections

VxRail Security, Access Control, and Compliance

Security questions test ownership boundaries: which accounts VxRail manages, how access is brokered through vCenter SSO, what must be encrypted and audited, and where compliance evidence comes from.

Identity and access

  • VxRail Manager and each ESXi host have local root credentials; VxRail Manager stores and can rotate host root passwords, so changing an ESXi root password directly in the DCUI desynchronises it from VxRail Manager.
  • Day-to-day administration runs through vCenter SSO accounts and roles; the VxRail plugin honours vCenter permissions. Prefer AD/LDAP-backed SSO with mapped roles over shared local accounts.
  • Reserve local accounts for break-glass use, and disable SSH and the ESXi Shell outside support windows.

Certificates and hardening

  • VxRail Manager and the plugin rely on vCenter-issued certificates; expiry breaks plugin access, deployment and upgrades. Track expiry and replace via the supported procedure rather than regenerating certificates ad hoc.
  • Harden per Dell's VxRail security configuration guidance: password complexity and lockout, TLS-only access, session timeouts, removal of unused services.
  • vSAN encryption requires an external KMIP key management server; vSphere VM encryption with vTPM or the Native Key Provider covers other workloads.

Audit and compliance

  • Forward VxRail Manager and vCenter events to syslog/SIEM and retain locally for chain of evidence.
  • Secure Connect Gateway/CloudIQ connectivity is outbound; proxy and document it where policy requires.
  • Compliance evidence: configuration reports, vSAN encryption status, audit logs, and documented change control for upgrades.

Worked example

An auditor asks for encryption at rest on all VMDKs in the cluster. Reasoning: vSAN encryption is cluster-wide, protects the datastore, and needs a reachable KMS at all times - if the KMS is unavailable and keys are not cached, the datastore becomes inaccessible. If the customer cannot run KMIP, the alternative is vSphere VM encryption with the Native Key Provider, which protects VMDKs but not vSAN's own on-disk structures. Stating that trade-off is the mark-earning answer.

Traps that cost marks

  • Rotating an ESXi root password manually instead of through VxRail Manager.
  • Letting platform or STS certificates expire and blaming vCenter.
  • Assuming vSAN encryption works without an external KMS.