350-401 Virtual Machines and Hypervisors — Timed 30 Questions

Question 1

A network engineer is deploying a new virtualized application on a VMware vSphere cluster. The application requires dedicated CPU cores to meet licensing requirements, and the engineer must ensure that no other virtual machine can use those cores. The cluster uses VMware ESXi 7.0. Which configuration should the engineer apply to the virtual machine?

Accepted Answer

Configure CPU affinity to pin the VM to specific physical cores.. CPU affinity (option A) is the correct configuration because it explicitly binds a virtual machine's vCPUs to specific physical cores, ensuring that no other VM can use those cores. This meets the licensing requirement for dedicated CPU cores by preventing co-scheduling or sharing of those physical cores with other workloads, which CPU reservation alone does not guarantee.

Answer

Set a CPU reservation equal to the number of vCPUs.

Answer

Enable NUMA node affinity for the VM.

Answer

Configure a CPU limit equal to the number of vCPUs.

Question 2

An enterprise is migrating a legacy application from a physical server to a virtual machine on a KVM-based hypervisor. The application requires direct access to a PCIe network interface card for performance reasons. The engineer needs to provide the VM with dedicated hardware access while maintaining isolation from other VMs. Which technology should the engineer use?

Accepted Answer

Use PCI passthrough to assign the NIC directly to the VM.. PCI passthrough (Option A) is correct because it assigns the entire physical PCIe NIC directly to the VM, giving it exclusive, dedicated hardware access with full performance and no hypervisor overhead. This meets the requirement for direct access while maintaining isolation, as other VMs cannot use the same device.

Answer

Enable SR-IOV and assign a virtual function to the VM.

Answer

Configure a paravirtualized network driver (virtio).

Answer

Attach the VM to a Linux bridge using macvtap.

Question 3

A network engineer is troubleshooting performance issues on a VMware ESXi host running multiple VMs. The host has two physical CPUs, each with 8 cores (16 logical processors with Hyper-Threading enabled). One VM, configured with 8 vCPUs, experiences high CPU ready time. Other VMs on the host are idle. What is the most likely cause of the high CPU ready time?

Accepted Answer

The VM's vCPUs span multiple NUMA nodes, causing memory access delays.. The VM has 8 vCPUs, but each physical CPU has only 8 cores (16 logical processors with Hyper-Threading). Since a single NUMA node typically corresponds to one physical CPU socket, an 8-vCPU VM cannot fit entirely within one NUMA node if the VM's vCPUs exceed the number of physical cores on that socket (8 cores). The hypervisor must span the VM across both NUMA nodes, causing remote memory access and increasing CPU ready time due to NUMA latency.

Answer

Hyper-Threading is disabled on the ESXi host.

Answer

The host is overcommitted with too many vCPUs.

Answer

The VM has more vCPUs than physical cores on a single socket.

Question 4

A company is deploying a virtualized firewall on a VMware ESXi host. The firewall VM requires high network throughput and low latency. The engineer decides to use SR-IOV to assign a virtual function (VF) from a physical NIC to the VM. After configuration, the VM can communicate, but the host's management network becomes unreachable. What is the most likely cause?

Accepted Answer

The physical NIC's PF is also used for the host management network, and SR-IOV configuration disrupted it.. When SR-IOV is enabled on a physical NIC, the Physical Function (PF) is shared between the host management network and the Virtual Functions (VFs). If the PF is used for the host management network, enabling SR-IOV can disrupt the PF's driver or configuration, causing the management network to become unreachable. This is a common misconfiguration where the same NIC is used for both management and SR-IOV VFs.

Answer

The VM's VF is using the same MAC address as the host management interface.

Answer

The ESXi host requires a dedicated physical NIC for management when using SR-IOV.

Answer

The VM's VF is consuming all available bandwidth on the NIC.

Question 5

A network engineer is designing a disaster recovery solution using VMware vSphere. The engineer needs to replicate virtual machines from the primary site to a secondary site with minimal downtime. The application VMs are running on NFS datastores. The engineer plans to use vSphere Replication. What prerequisite must be met for vSphere Replication to work with NFS datastores?

Accepted Answer

The NFS datastores must be mounted on both the source and target ESXi hosts.. vSphere Replication operates at the hypervisor level, replicating VM data from the source ESXi host to the target ESXi host. For NFS datastores, the source and target hosts must each have the NFS datastore mounted because vSphere Replication reads the VM files from the source NFS mount and writes them to the target NFS mount. Without both mounts, the replication engine cannot access the source data or place the replica on the target storage.

Answer

The NFS datastores must be backed by a storage array that supports snapshot offloading.

Answer

The VMs must be configured with thick provisioning eager zeroed disks.

Answer

The NFS datastores must be part of a vSAN cluster.

Question 6

An engineer is deploying a Linux virtual machine on a KVM hypervisor. The VM needs to be connected to a virtual network that provides isolation from other VMs on the same host but allows communication with the host and external networks. The engineer creates a Linux bridge and attaches the VM's tap interface to it. However, the VM cannot reach the external network. The host has a physical NIC (eth0) connected to the corporate network. What is the missing configuration step?

Accepted Answer

Add the physical NIC (eth0) as a port to the Linux bridge.. A Linux bridge acts like a virtual switch. To allow the VM to reach the external network, the physical NIC (eth0) must be added as a port to the bridge. This bridges the VM's tap interface with the host's physical network, enabling Layer 2 connectivity to the corporate network and upstream routing.

Answer

Configure a default gateway on the VM's network interface.

Answer

Assign an IP address to the Linux bridge interface.

Answer

Enable IP forwarding and configure NAT on the host.

Question 7

A network engineer is troubleshooting a VMware vSphere cluster where a VM with a large memory footprint (256 GB) is experiencing poor performance. The host has two NUMA nodes, each with 128 GB of memory. The VM is configured with 256 GB of memory and 4 vCPUs. Performance monitoring shows high memory latency and CPU ready time. What is the most likely cause?

Accepted Answer

The VM's memory size forces it to span multiple NUMA nodes, increasing memory access latency.. The VM is configured with 256 GB of memory, but each NUMA node on the host has only 128 GB. Since a single NUMA node cannot satisfy the VM's memory allocation, the hypervisor must split the VM across both NUMA nodes. This forces memory accesses to cross the NUMA interconnect (e.g., QPI or UPI), which introduces significantly higher latency compared to local memory access, directly causing the observed high memory latency and increased CPU ready time.

Answer

The VM has too few vCPUs for the memory size.

Answer

The host is using memory ballooning to reclaim memory from other VMs.

Answer

The host's memory is overcommitted.

Question 8

An engineer is configuring a virtual machine on a Microsoft Hyper-V host. The VM runs a legacy application that requires a static MAC address. The engineer sets the MAC address in the VM settings. After the VM starts, the application cannot communicate on the network. The engineer verifies that the MAC address is not duplicated on the network. What is the most likely cause?

Accepted Answer

The static MAC address is not within the allowed range for Hyper-V virtual machines.. Hyper-V enforces a specific range for static MAC addresses assigned to virtual machines. The default allowed range is 00-15-5D-XX-XX-XX, derived from the Microsoft Organizationally Unique Identifier (OUI). If the engineer configured a MAC address outside this range (e.g., starting with a different OUI), Hyper-V will not allow the VM to use it, effectively breaking network communication even though the address is not duplicated on the network.

Answer

The VM is configured to use a dynamic MAC address, overriding the static setting.

Answer

The VM's network adapter is set to use the legacy network adapter type.

Answer

The VM is a generation 2 VM, which does not support static MAC addresses.

Question 9

A network engineer is migrating a physical server running a critical database to a virtual machine on a VMware vSphere cluster. The database requires high I/O performance and low latency. The engineer decides to use VMFS datastores with multiple extents to improve performance. After migration, the database performance is worse than on the physical server. What is the most likely reason?

Accepted Answer

VMFS datastores with multiple extents can cause I/O to span multiple LUNs, increasing latency.. VMFS datastores with multiple extents distribute data across multiple LUNs, which can cause I/O operations to span physical storage devices. This introduces additional latency due to the need for coordination across LUNs, negating the performance benefit expected from a single, contiguous LUN. For a database requiring high I/O and low latency, this spanning effect degrades performance compared to a physical server with direct-attached storage.

Answer

The VMFS datastore does not support files larger than 2 TB.

Answer

The virtual disk is configured as thin provisioned, causing write amplification.

Answer

The virtual disk is configured as thick eager zeroed, causing slow initial writes.

Question 10

A company is deploying a multi-tenant data center using VMware vSphere. The architect must ensure that each tenant’s virtual machines (VMs) are isolated at Layer 2 while sharing the same physical NICs. Which design approach best meets this requirement?

Accepted Answer

Configure a single standard virtual switch and assign each VM to a separate port group with unique VLAN IDs.. Option A is correct because configuring a standard virtual switch with separate port groups and unique VLAN IDs provides Layer 2 isolation between tenants by leveraging 802.1Q VLAN tagging. Each VM’s traffic is tagged with its assigned VLAN ID, ensuring that VMs in different port groups cannot communicate directly at Layer 2, even though they share the same physical NICs.

Answer

Deploy a separate physical NIC for each tenant and bridge them to the VMs.

Answer

Use a distributed virtual switch with VLAN trunking and assign all VMs to the same port group.

Answer

Enable promiscuous mode on the virtual switch to allow all VMs to see each other’s traffic.

Question 11

An architect is designing a virtualized service chain for a campus network using NFV. The chain must include a firewall, WAN optimizer, and IPS. The architect needs to minimize latency by placing VNFs on the same hypervisor host. Which design consideration is most important?

Accepted Answer

Ensure all VNFs are pinned to the same NUMA node on the hypervisor host.. Option A is correct because pinning all VNFs to the same NUMA node on the hypervisor host minimizes inter-NUMA memory access latency, which is critical for achieving low-latency packet processing in an NFV service chain. When VNFs are placed on different NUMA nodes, memory accesses must traverse the QPI/UPI interconnect, adding significant latency. By co-locating the firewall, WAN optimizer, and IPS on the same NUMA node, the architect ensures that all packet processing stays within the same memory domain, reducing latency to the minimum possible on that host.

Answer

Use a Type 2 hypervisor to reduce overhead.

Answer

Place each VNF on a separate physical host to avoid resource contention.

Answer

Enable DPDK on the virtual switch to accelerate packet processing.

Question 12

A network team is planning to migrate from a Type 2 hypervisor to a Type 1 hypervisor for their production VMs. They need to understand the architectural impact. Which statement correctly describes a key difference between Type 1 and Type 2 hypervisors?

Accepted Answer

Type 1 hypervisors run directly on the physical hardware, while Type 2 hypervisors run on top of a host operating system.. Option A is correct because Type 1 hypervisors (bare-metal) run directly on the physical hardware without an underlying operating system, providing direct access to hardware resources and better performance. Type 2 hypervisors (hosted) run as an application on top of a host operating system, which introduces additional overhead and resource contention. This architectural difference is fundamental to understanding virtualization performance and isolation in production environments.

Answer

Type 1 hypervisors require a host OS for device drivers, while Type 2 hypervisors include their own drivers.

Answer

Type 2 hypervisors are always more secure than Type 1 because of the additional OS layer.

Answer

Type 1 hypervisors cannot support hardware passthrough, but Type 2 can.

Question 13

An enterprise is deploying a KVM-based virtualization platform for network functions. The architect must choose a networking model that allows VNFs to communicate with minimal overhead and supports VLAN trunking. Which virtual networking component should be used?

Accepted Answer

Linux bridge with VLAN tagging enabled on the bridge interface.. A Linux bridge with VLAN tagging enabled on the bridge interface is the correct choice because it provides a standard Layer 2 forwarding path with native 802.1Q VLAN trunking support, allowing VNFs to communicate with minimal overhead. Unlike more complex solutions, the Linux bridge operates in kernel space with low latency and does not require additional userspace processing, making it ideal for KVM-based NFV deployments where performance and simplicity are key.

Answer

macvtap in bridge mode, which bypasses the Linux bridge.

Answer

Open vSwitch with DPDK for maximum performance.

Answer

Host-only networking with NAT to isolate VNFs.

Question 14

A data center architect is designing a virtualized environment for a latency-sensitive application. The application requires dedicated CPU cores and memory to avoid performance degradation. Which hypervisor feature should be configured to meet this requirement?

Accepted Answer

Enable CPU pinning and memory reservation for the VM.. Option A is correct because CPU pinning binds a VM's virtual CPUs to specific physical cores, ensuring dedicated processing resources and preventing CPU contention from other VMs. Memory reservation guarantees that the specified amount of physical memory is always available to the VM, eliminating the risk of memory swapping or ballooning that would introduce latency. Together, these features provide the deterministic performance required for latency-sensitive applications in a virtualized environment.

Answer

Use a shared storage solution to reduce I/O latency.

Answer

Configure the VM with a large vNUMA node to spread memory access.

Answer

Enable memory overcommitment to maximize utilization.

Question 15

A company is deploying Cisco CSR1000v virtual routers in a KVM environment. The architect needs to ensure high availability by allowing VMs to move between physical hosts without service interruption. Which feature must be supported by the hypervisor and storage?

Accepted Answer

Live migration with shared storage (e.g., NFS or iSCSI).. Live migration (also known as VM migration) allows a running virtual machine to move between physical hosts with zero downtime. For this to work in a KVM environment with Cisco CSR1000v routers, the hypervisor must support live migration, and the storage must be shared (e.g., NFS or iSCSI) so that the VM's disk image remains accessible from both source and destination hosts. Without shared storage, the VM's disk state cannot be preserved during migration, causing service interruption.

Answer

Cold migration with local storage only.

Answer

Storage vMotion without shared storage.

Answer

Using a distributed virtual switch without shared storage.

Question 16

An architect is designing a virtualized environment for network functions that require direct access to physical NICs for performance. The hypervisor must support PCI passthrough. Which hypervisor type is best suited for this requirement?

Accepted Answer

Type 1 hypervisor (e.g., VMware ESXi or KVM).. A Type 1 hypervisor (bare-metal) runs directly on the hardware and has direct access to physical resources, including PCIe devices. It supports PCI passthrough (e.g., Intel VT-d or AMD IOMMU), which allows a virtual machine to directly access a physical NIC without hypervisor intervention, maximizing performance for network functions. VMware ESXi and KVM are common Type 1 hypervisors that implement this capability.

Answer

Type 2 hypervisor (e.g., VirtualBox or VMware Workstation).

Answer

Container runtime (e.g., Docker).

Answer

Bare-metal server without virtualization.

Question 17

A network team is deploying a virtualized WAN optimization appliance. The appliance must be able to process traffic at line rate on a 10 Gbps link. The hypervisor host has multiple physical NICs. Which design choice will best ensure the VM can achieve the required throughput?

Accepted Answer

Assign the VM a virtual function (VF) using SR-IOV on the physical NIC.. SR-IOV (Single Root I/O Virtualization) allows a physical NIC to present multiple virtual functions (VFs) directly to a VM, bypassing the hypervisor's virtual switch. This reduces CPU overhead and latency, enabling the VM to achieve near line-rate throughput on a 10 Gbps link by allowing direct hardware access for data plane traffic.

Answer

Use a standard virtual switch with a single vCPU for the VM.

Answer

Enable jumbo frames on the virtual switch only.

Answer

Configure the VM with multiple vNICs and use NIC teaming.

Question 18

An architect is planning a virtualized infrastructure for a branch office that will host a Cisco ISRv router and a local DHCP server. The architect wants to minimize management overhead and ensure the VMs can be easily backed up. Which hypervisor deployment model is most appropriate?

Accepted Answer

Deploy a Type 1 hypervisor on the branch server and manage VMs via a centralized vCenter or similar tool.. A Type 1 hypervisor (bare-metal) runs directly on the server hardware, providing near-native performance for the Cisco ISRv router and DHCP server. Centralized management via vCenter or similar tools reduces administrative overhead and enables efficient VM backup and recovery, meeting the architect's requirements for minimal management overhead and easy backup.

Answer

Use a Type 2 hypervisor on a desktop PC at the branch.

Answer

Run the ISRv and DHCP server as containers on the same host.

Answer

Install the ISRv directly on physical hardware without virtualization.

Question 19

Examine the following partial configuration on a Cisco IOS-XE device:

interface GigabitEthernet0/1
 ip address 10.1.1.1 255.255.255.0
 ip ospf hello-interval 5
 ip ospf dead-interval 20
!

What is the effect of this configuration?

Accepted Answer

The router will send OSPF hello packets every 5 seconds and declare a neighbor dead after 20 seconds of no hello.. Option A is correct because the `ip ospf hello-interval 5` command sets the OSPF hello interval to 5 seconds, and the `ip ospf dead-interval 20` command sets the dead interval to 20 seconds. These per-interface commands override the default hello interval of 10 seconds and dead interval of 40 seconds for broadcast networks, allowing the router to send hello packets every 5 seconds and declare a neighbor dead after 20 seconds of no hello reception.

Answer

The router will send OSPF hello packets every 10 seconds and declare a neighbor dead after 40 seconds, overriding the configuration.

Answer

The configuration is invalid because the dead interval must be exactly four times the hello interval.

Answer

The router will not form OSPF adjacencies because the hello and dead intervals are not default.

Question 20

Consider the following configuration snippet:

router bgp 65000
 bgp router-id 192.168.1.1
 neighbor 10.0.0.2 remote-as 65001
 neighbor 10.0.0.2 timers 10 30
!

What is the effect of the 'timers 10 30' command under the BGP neighbor?

Accepted Answer

It sets the keepalive interval to 10 seconds and the hold time to 30 seconds for neighbor 10.0.0.2 only.. Option B is correct because the 'timers 10 30' command under the BGP neighbor configuration mode sets the keepalive interval to 10 seconds and the hold time to 30 seconds specifically for that neighbor (10.0.0.2). This per-neighbor timer configuration overrides any global BGP timers set under the router bgp process, allowing granular control over individual BGP sessions.

Answer

It sets the keepalive interval to 10 seconds and the hold time to 30 seconds for all BGP neighbors.

Answer

It sets the BGP keepalive interval to 30 seconds and the hold time to 10 seconds for neighbor 10.0.0.2.

Answer

It configures the BGP session to use a keepalive of 10 seconds and a hold time of 30 seconds, but only if the neighbor supports it.