An administrator is configuring an existing VM to use a virtual Trusted Platform Module (vTPM). What additional step must be taken to support Secure Boot?

To enable Secure Boot on an AHV guest VM, the VM must be configured to use UEFI firmware instead of the legacy BIOS. When you select UEFI boot for a VM in Prism, the underlying virtual machine hardware model is automatically set to q35, as the i440fx (legacy) machine type does not support UEFI. While vTPM is a related security feature, Secure Boot is fundamentally dependent on the UEFI firmware and the corresponding q35 machine type.

A. A CD-ROM drive is not a prerequisite for either vTPM or Secure Boot functionality; it is standard virtual hardware but unrelated to these security features.
C. Secure Boot is a feature of the UEFI specification and is not available with legacy BIOS firmware. Enabling it requires UEFI, not BIOS.
D. A vTPM is a virtualized device and does not require or use a physical hardware TPM on the host via pass-through.

1. Nutanix University. (2023). Nutanix Hybrid Cloud Fundamentals Course. Module: AHV Virtual Machine Management. "Secure Boot for guest VMs requires UEFI boot, which is supported on the q35 machine type."

2. Nutanix. (2023). AHV Administration Guide v6.7. Section: "VM Security Management" > "Creating a VM with UEFI Boot". The guide states, "To enable Secure Boot for a VM, you must configure the VM to use the UEFI firmware." The UI automatically selects the q35 machine type when UEFI is chosen.