Question 640
During an NVIDIA AI factory acceptance, engineers observe: A tenant host administrator can still flash the BlueField firmware even though the project mandates zero-trust DPU management separation. Which repair addresses the principal defect?
Explanation
Correct Answer
Prioritize Apply supported BlueField host-restriction settings from the authorized Arm or BMC management side rather than changing unrelated components. In this case Zero-trust DPU operation limits certain host-side privileged paths so an untrusted host cannot override the DPU control plane; a meaningful operational test shows A host attempt to change restricted firmware or port ownership fails while the authorized DPU manager succeeds.
Incorrect Answers
The option would apply to “A GPU server's DPU has an approved high-speed physical link but no functioning OOB path for emergency firmware recovery”. The appropriate intervention is Document and test the BlueField management path through its authorized Arm or controller access independently of data traffic. This question instead requires “Apply supported BlueField host-restriction settings from the authorized Arm or BMC management side”.
This option serves the scenario “A BlueField upgrade finishes on the host OS but its Arm environment and NIC firmware remain at a different unsupported release”. Therefore Use the validated BlueField software and firmware compatibility process across host, Arm environment and adapter components. The present scenario is distinguished by “Apply supported BlueField host-restriction settings from the authorized Arm or BMC management side”.
This alternative addresses the separate case “A security engineer assumes BlueField telemetry and control counters can always be read from the host after enabling zero-trust restrictions”. The appropriate intervention is Collect protected metrics from the authorized BlueField-side management interfaces with documented host limitations. The deciding requirement here is “Apply supported BlueField host-restriction settings from the authorized Arm or BMC management side”.