Free OCE-H sample questions

Correct answer: Virtual Machine > Provisioning > Customize

The vCenter Server user that Horizon uses for instant clones needs Virtual machine > Provisioning privileges, including Customize, Clone virtual machine, Deploy template and Read customization specifications, along with inventory, configuration and snapshot privileges. Global > Settings, Host > System Management and Guest Operations > Execute are not the required privilege for guest customization.

Correct answer: Port 389 is already in use by another application on the server.

The Horizon Connection Server installs a lightweight directory service (ADAM/LDS) which listens on standard LDAP ports (389 for standard, 636 for SSL). If another service (like a local AD Domain Controller role or another LDAP tool) is binding to port 389, the ADAM instance creation will fail.

Correct answer: Blast (TCP/UDP 8443 client to UAG, TCP/UDP 22443 UAG to agent) or PCoIP (TCP/UDP 4172).

Authentication and brokering use HTTPS 443, so they succeed. The display protocol session then opens: Blast Extreme uses TCP/UDP 8443 from client to UAG and TCP/UDP 22443 from UAG to the agent; PCoIP uses TCP/UDP 4172 on both legs. If these flows are blocked, the user sees a black screen until the session times out.

Correct answer: Manually delete the stale VM record from vCenter and the AD computer account, then perform a 'Remove' operation on the stuck VM in Horizon Console.

The fault means vCenter already has an object with the name Horizon is trying to create, usually a stale VM left from an earlier failed operation. Remove the stale VM in vCenter (and its stale AD computer account), then remove the stuck machine in Horizon Console so provisioning can retry with the name.

Correct answer: The SMB File Server hosting the DEM Config/Profile shares.

During a logon storm, thousands of users simultaneously request their profile configuration files (DEM) and profile archives. If the backend SMB file server cannot handle the IOPS or network throughput, the 'Profile Load' phase will stall, causing the symptoms described.

Correct answer: The Connection Server, via Kerberos authentication.

With Log in as current user in Horizon Client for Windows, the credentials the user gave when logging in to the client system are used to authenticate to the connection broker (Connection Server) and to the remote desktop using Kerberos, so no further authentication is needed. The Connection Server must have Accept logon as current user enabled; NTLM can be configured through Horizon Client GPOs. UAG, the Omnissa Access Connector and the Horizon Agent do not perform this AD authentication.

Correct answer: Restricted Entitlements (Tags)

Connection Server restrictions (restricted entitlements) use tags: tag the internal Connection Servers (e.g., "Internal") in Horizon Console, then select that tag in the pool's or global entitlement's Connection Server restrictions. The resource is then only accessible through Connection Servers with that tag. vdmadmin -Q is unrelated (it manages kiosk-mode client accounts).

Correct answer: Disable the Connection Server in the Horizon Console.

In Horizon Console, select Settings > Servers, select the instance on the Connection Servers tab and click Disable. A disabled Connection Server instance stops users from logging in through it, and users who are already logged in to their desktops and applications are not affected; in a replicated pod, whether users can log in through another instance depends on your network topology. vdmadmin has no 'Drain' state for Connection Servers. Stopping the Omnissa Horizon Connection Server service also stops the Framework, Message Bus, Security Gateway and Web services, which disrupts tunneled sessions. Removing the server from the load balancer only affects traffic that arrives through the load balancer and is not the Horizon control for this task.