3V0-23.25 Exam Dumps | A Compliance Auditor is validating that a VCF Workload Domain meets the "Continuous Key Rotation" requirements

<< Prev Question Next Question >>

Question 33/60

A Compliance Auditor is validating that a VCF Workload Domain meets the "Continuous Key Rotation" requirements of a strict financial standard (e.g., SOX/PCI).
The auditor examines the vCenter logs surrounding the Data-in-Transit (DiT) configuration.
```
[Log Analysis: vpxd.log]
2026-11-20T12:00:00Z INFO vpxd - [DiT] Rekey interval expired (1440 minutes).
2026-11-20T12:00:01Z INFO vpxd - [DiT] Ephemeral session keys successfully renegotiated between
[esx-03] and [esx-05].
2026-11-20T12:00:02Z INFO vpxd - [DiT] Old key buffer purged.
```
How does the DiT key rotation architecture satisfy compliance without relying on external KMS administrators? (Select all that apply.)

A. DiT keys are automatically persisted to the vCenter database as backup material before deletion, ensuring forensic accountability.

B. Key rotation occurs instantly at the packet layer; the DOM Client creates a new key for every single
4KB block written.

C. The RekeyInterval can be aggressively modified via API (e.g., to 60 minutes) to meet stricter compliance rules, without causing any disruption to the active storage traffic.

D. The ESXi hosts must temporarily pause cluster write operations (Congestion) for 30 seconds to synchronize the new symmetric keys.

E. The default "Rekey Interval" for DiT is 1440 minutes (24 hours). The ESXi hosts automatically perform a new Diffie-Hellman handshake every day to create a completely new session key, making brute-force decryption of historical traffic impossible.

Question 33/60

LEAVE A REPLY

Download PDF File