VMware Professional VMware Security - 2V0-81.20 Exam Questions [2026]

QUESTION NO: 1
What are two valid time limit selections when creating a Last Seen compliance policy in Workspace ONE UEM? (Choose two.)

A. Weeks B. Months C. Days D. Hours E. Minutes

Correct Answer: C,E

QUESTION NO: 2
In a Workspace ONE environment, what is the maximum number of days a Windows Feature Update (Windows 10 1703 and above) can be deferred?

A. 365 B. 90 C. 30 D. 7

Correct Answer: A

QUESTION NO: 3
An administrator has deployed a new NSX Distributed Firewall rule that allows only TLS 1.2 and TLS 1.3 HTTPS connections. The new rule is working, but TLS 1.0 and TLS 1.1 connections are still occurring.
What step is required to enforce the TLS policy restriction?

A. Configure a Context Profile and select a FQDN attributes. B. Configure a Context Profile and select TLS 1.2 and 1.3 attributes. C. Configure a Context Profile and select HTTPS and HTTP attributes. D. Configure a Context Profile and select DNS-TCP and DNS-UDP attributes.

Correct Answer: A

QUESTION NO: 4
Which three options are used to automate patch remediation based on CVEs for Windows devices using Workspace ONE Intelligence? (Choose three.)

A. Use Workspace ONE UEM console to approve patches. B. Create automated remediation based on CVE vulnerabilities. C. Create Automated remediation based on Risk score. D. Create a dashboard to track CVE remediation. E. Identify vulnerable devices across the entire environment based on CVE information.

Correct Answer: B,D,E

QUESTION NO: 5
A company has deployed a new application. Users are complaining they cannot connect. The administrator suspects there is an issue with the Distributed Firewall (DFW).
What three steps can be taken to troubleshoot the DFW? (Choose three.)

A. The administrator should configure vRealize Log Insight using the Insight agent as the type and review the DFW rule logs in vRealize Log Insight. B. The administrator should configure vRealize Log Insight using syslog as the type and review the DFW rule logs in vRealize Log Insight. C. The administrator should confirm if the DFW rule is set to log, and then look on the hypervisor where the VMs reside and look at logs at /var/log/dfwpktlogs.log. D. The administrator should verify firewall rules exist to permit traffic and verify the hit counters are increasing. E. The administrator should confirm that SLOT 2, which is used by the DFW, is configured under the vNICs of the VMs.

Correct Answer: B,C,D

QUESTION NO: 6
Which two are features of a hybrid cloud model for networking and security when using NSX-T Data Center and VMware NSX Cloud? (Choose two.)

A. NSX Data Center supports Layer 2 VPN between an NSX Edge and a Direct Connect Gateway. B. NSX Data Center supports secure, encrypted user access to private corporate applications (SSL VPN). C. NSX Data Center supports remote sites (IPsec VPN) with optional VPN gateways or hardware routers from other vendors. D. NSX Data Center provides consistent logical networking and security across protected and recovery sites. E. NSX Data Center and VMware NSX Cloud stretch Layer 2 domains between public clouds using the Geneve overlay.

Correct Answer: C,D

QUESTION NO: 7
Which three tasks are completed during the installation of NSX-T Data Center Workflow for vSphere? (Choose three.)

A. create transport zones and set type to VXLAN and VLAN; create host transport nodes and standard or enhanced N-VDS/VDS as needed B. install NSX Tier-0 or Tier-1 gateways, then create an NSX Edge cluster C. install NSX Edges, then create an NSX Edge cluster D. create transport zones and set type to Overlay and VLAN; create host transport nodes and standard or enhanced N-VDS/VDS as needed E. install the NSX Manager, configure a compute manager, deploy additional NSX Manager nodes to form a cluster

Correct Answer: C,D,E

QUESTION NO: 8
When creating an NSX-T Data Center Firewall rule to prevent all communication between same scope objects, what must be true of the first firewall rule?

A. The source and destination are the same. B. The firewall action would be rejected. C. The port will be 443. D. The logging would be on.

Correct Answer: D