An administrator wants to enable Windows Defender Credential Guard. What must be enabled when creating the VM?

Windows Defender Credential Guard is a security feature that uses Virtualization-Based Security (VBS) to isolate secrets and credentials. A primary prerequisite for enabling VBS on a guest virtual machine running on Nutanix AHV is that the VM must be configured with UEFI firmware. UEFI provides the modern boot environment and security features, such as Secure Boot, that are necessary for VBS to function correctly. Creating the VM with the older Legacy BIOS will not meet the firmware requirements for Credential Guard.

A. Live Migration: This is a cluster feature for VM mobility between hosts without downtime and is not a prerequisite for enabling a guest OS security feature.
C. HA: High Availability is a cluster-level resiliency feature that restarts VMs on a healthy host after a failure; it is unrelated to guest OS VBS requirements.
D. Legacy BIOS: This is the older firmware standard that lacks the necessary capabilities, such as Secure Boot, which are required to enable VBS and Credential Guard.

1. Nutanix University - Nutanix Certified Associate (NCA) v6.5: The courseware section on "Creating and Managing Virtual Machines" specifies that modern guest OS security features, including Virtualization-Based Security (VBS), require the VM to be configured with UEFI boot.

2. AHV Administration Guide v6.5 - Creating a VM (AHV): In the "Boot Configuration" section for VM creation, the documentation states, "Virtualization-based security (VBS) uses the hypervisor to help protect the guest OS. To enable VBS, you must configure the VM to use UEFI boot." This directly links UEFI as a mandatory setting for VBS-based features like Credential Guard.

3. Nutanix Security Guide v6.5 - Guest VM Security: This guide details the requirements for enabling security features within guest VMs. In the section discussing VBS, it explicitly lists UEFI firmware as a prerequisite for the virtual machine.