VCP-DCV Practice Test 2 — 25 Questions

Question 1

An administrator is troubleshooting a failed attempt to add an ESXi host to a vCenter Server domain. The error message states: 'The host's certificate has been tampered with or is invalid.' What is the most likely cause?

Accepted Answer

The ESXi host's certificate thumbprint does not match the thumbprint stored in vCenter Server.. The error 'The host's certificate has been tampered with or is invalid' occurs when the ESXi host presents a certificate whose thumbprint does not match the thumbprint that vCenter Server has stored for that host. This mismatch can happen if the host's certificate was replaced (e.g., due to a reinstall or manual rotation) without updating the vCenter Server's trusted store. vCenter Server verifies the host's identity by comparing the SHA-1 or SHA-256 thumbprint of the presented certificate against its stored record; a mismatch triggers this specific error.

Answer

The vCenter Server's account lockout policy has been triggered.

Answer

The ESXi host's SSH keys have been rotated.

Answer

The ESXi host's certificate has expired.

Question 2

Which TWO statements are true regarding vSphere Lifecycle Manager (vLCM) clusters? (Choose two.)

Accepted Answer

vLCM can manage vSAN clusters using a single image.. Option A is correct because vLCM can manage vSAN clusters using a single image, which ensures that all hosts in the cluster run the same software version and driver/firmware combinations, including vSAN-specific components. This simplifies lifecycle management by eliminating the need for separate baselines and reduces compatibility issues.

Answer

vLCM only supports clusters with identical hardware.

Answer

vLCM can only remediate hosts that are part of a cluster.

Answer

vLCM requires vCenter Server to be in Enhanced Linked Mode.

Question 3

A company has a vSphere environment with 20 ESXi hosts and 500 VMs. The security team mandates that all administrative access to vCenter Server must be through a single, highly restricted account with multi-factor authentication (MFA). The account must be used for both the vSphere Client and API integrations. Which step should the administrator take?

Accepted Answer

Integrate vCenter Server with an external identity provider (e.g., ADFS, Okta) that supports MFA, and use a service account with MFA for API access.. Option B is correct because integrating vCenter Server with an external identity provider (IdP) such as ADFS or Okta allows the use of a single service account that supports multi-factor authentication (MFA) for both the vSphere Client and API integrations. This approach meets the security mandate by centralizing authentication through an IdP that enforces MFA, while also supporting OAuth 2.0 token-based API access, which is required for modern vSphere API integrations. The built-in administrator account cannot be directly configured with MFA in a way that satisfies both interactive and API access requirements without external integration.

Answer

Configure the built-in administrator account to require smart card authentication.

Answer

Create a new local account and configure it as a member of the Administrators group, then enforce MFA via a third-party tool on the vCenter Server OS.

Answer

Disable the built-in administrator account and create a new local account with the same privileges.

Question 4

Which THREE factors should be considered when sizing a host cluster for a VDI environment with 1000 desktops? (Choose three.)

Accepted Answer

Storage IOPS capacity for boot storms.. Storage IOPS capacity for boot storms is critical because when 1000 desktops boot simultaneously (e.g., at start of shift), they generate a massive burst of read I/O. If the storage array cannot handle the peak IOPS, desktops will experience slow boot times or timeouts. Proper sizing must account for both steady-state IOPS and the boot storm peak, often using flash storage or caching to absorb the load.

Answer

vMotion compatibility between hosts.

Answer

NUMA alignment of virtual desktops.

Question 5

An administrator wants to ensure that VMs running latency-sensitive applications are placed on hosts that minimize CPU scheduling delays. Which DRS setting should be configured?

Accepted Answer

Set DRS migration threshold to the most aggressive setting.. DRS migration threshold controls how aggressively DRS moves VMs to balance load. Setting it to the most aggressive level (1) minimizes CPU scheduling delays by proactively migrating VMs to hosts with lower CPU ready times, ensuring latency-sensitive applications have immediate access to CPU resources without waiting for scheduling cycles.

Answer

Enable vSphere HA with admission control.

Answer

Enable Distributed Power Management (DPM).

Answer

Enable Enhanced vMotion Compatibility (EVC).

Question 6

A vSphere administrator is troubleshooting a VM that is experiencing excessive disk latency. The VM is on a datastore accessed via NFS over a 1GbE network. The host shows high network utilization. Which action should be taken to improve performance?

Accepted Answer

Upgrade the network link to 10GbE or enable multiple NICs with teaming.. The VM is experiencing excessive disk latency due to high network utilization on the 1GbE link. Since NFS storage traffic is entirely network-bound, upgrading to 10GbE or enabling multiple NICs with teaming increases the available bandwidth, reduces congestion, and directly addresses the root cause of the latency. This is the most effective action because the bottleneck is at the network layer, not the storage protocol or VM configuration.

Answer

Enable Storage I/O Control on the datastore.

Answer

Convert the datastore from NFS to VMFS.

Answer

Increase the memory reservation for the VM.

Question 7

A company has a cluster with DRS set to Fully Automated. A VM named VM1 has a reservation of 4 GHz and a limit of 8 GHz on a host with 10 GHz available. The VM is running a batch job that requires as much CPU as possible. The administrator notices that the VM's CPU usage never exceeds 4 GHz. What is the most likely reason?

Accepted Answer

The VM has a CPU limit set to 4 GHz via a resource pool or VM override.. Option C is correct because a CPU limit explicitly caps the maximum CPU usage a VM can consume, regardless of available resources. In this scenario, the VM has a reservation of 4 GHz and a limit of 8 GHz on the host, but the administrator observes usage never exceeding 4 GHz, indicating a more restrictive limit is applied via a resource pool or VM override. This overrides the host-level limit, effectively capping the VM at 4 GHz, which matches the observed behavior.

Answer

The CPU reservation is preventing the VM from using more than the reserved amount.

Answer

The CPU shares are too low, causing the VM to be starved.

Answer

DRS is not migrating the VM to a host with more resources.

Question 8

A company runs a large vSphere environment with multiple clusters using vSAN. The performance team observes that some VMs are experiencing high latency on reads. The vSAN cluster is configured with 5 hosts, each having one cache tier (NVMe) and one capacity tier (SATA SSD). The VMs are all-flash storage policies. What should the administrator check first?

Accepted Answer

Check the vSAN cache hit ratio and verify that the cache tier size is adequate.. High read latency in an all-flash vSAN environment often indicates that the cache tier is being overwhelmed or is undersized. The cache hit ratio directly measures how often read requests are served from the fast NVMe cache versus the slower SATA SSD capacity tier. A low cache hit ratio means the capacity tier is handling too many reads, causing latency. Checking this ratio is the first diagnostic step before making configuration changes.

Answer

Disable deduplication and compression on the vSAN datastore.

Answer

Reconfigure the disk groups to use multiple cache devices.

Answer

Increase the network bandwidth between hosts.

Question 9

A vSphere administrator is planning to upgrade a vSphere 7.0 U2 cluster to vSphere 8.0 U1. The cluster is managed by a vCenter Server 7.0 U2. The administrator wants to use vSphere Lifecycle Manager (vLCM) to manage the upgrade. What must the administrator do first?

Accepted Answer

Upgrade vCenter Server to version 8.0 U1.. vLCM relies on the vCenter Server to orchestrate and push images to ESXi hosts. Since the vCenter Server version must be equal to or higher than the target ESXi version, upgrading vCenter Server to 8.0 U1 first is a prerequisite. Without this, vLCM cannot manage the ESXi 8.0 U1 image because the older vCenter lacks the necessary APIs and compatibility.

Answer

Enable vLCM on the cluster and set the desired image to ESXi 8.0 U1.

Answer

Upgrade one ESXi host to 8.0 U1 manually to test compatibility.

Answer

Create a baseline for ESXi 8.0 U1 in vLCM.

Question 10

An administrator is using vLCM to manage a cluster with 4 ESXi hosts. After a remediation, two hosts show a compliance status of 'Non-Compliant' with the message 'Firmware is not compatible with the selected image'. What is the most likely cause?

Accepted Answer

The cluster does not have a Hardware Support Manager configured.. The correct answer is D because vLCM relies on a Hardware Support Manager (HSM) to validate firmware compatibility against the selected ESXi image. Without an HSM configured, vLCM cannot check firmware versions, so it flags hosts as 'Non-Compliant' with the message 'Firmware is not compatible with the selected image' even if the firmware is actually compatible. This is a common misconfiguration when using vLCM with vSAN or other hardware-dependent clusters.

Answer

The selected image includes a firmware component that is not compatible with the hosts.

Answer

The firmware update requires a different ESXi version and was skipped.

Answer

The hosts were put into maintenance mode during remediation and autopassivation failed.

Question 11

An administrator is troubleshooting a vLCM cluster where remediation fails with 'Host cannot be updated due to missing VIB'. The desired image includes the VIB. Which THREE actions should the administrator take?

Accepted Answer

Verify that the software depot URL is accessible from vCenter.. Option A is correct because vLCM retrieves VIBs from a software depot URL configured in the desired image. If vCenter cannot reach that URL (e.g., due to network issues, firewall rules, or DNS resolution failure), the remediation process will fail with 'missing VIB' even though the VIB is listed in the image specification. Verifying accessibility ensures the depot is reachable via HTTP/HTTPS and that the repository metadata can be downloaded.

Answer

Ensure that the host firmware is up to date.

Answer

Check if a baseline is attached that conflicts.

Question 12

An administrator sees the above error in the vLCM remediation history. What is the most likely cause?

Accepted Answer

The vCenter Server cannot reach the VMware depot.. The error shown in the vLCM remediation history indicates a failure to download the desired image components. vLCM relies on the vCenter Server to fetch VIBs and software depots from the VMware online depot (or a local depot). If the vCenter Server cannot reach the VMware depot due to network issues, proxy misconfiguration, or firewall blocks (e.g., port 443 to *.vmware.com), the remediation will fail with a download error, not a validation or acceptance-level error.

Answer

The desired image validation failed before remediation.

Answer

The host's acceptance level does not allow the VIB.

Answer

The host firmware is incompatible with the VIB.

Question 13

A company has a vLCM-managed cluster with a desired image that includes ESXi 8.0 U1 and multiple VIBs. After remediating, one host fails with an error: 'Failed to retrieve VIBs from depot'. What is the most likely cause?

Accepted Answer

The vCenter Server does not have internet access to the VMware depot.. The error 'Failed to retrieve VIBs from depot' indicates that vCenter Server cannot reach the depot from which the VIBs are sourced. In a vLCM-managed cluster using a desired image, the image specification includes VIBs that may be hosted on the VMware online depot or a local depot. If vCenter Server lacks internet access to the VMware depot, it cannot download the required VIBs, causing the remediation to fail. This is the most likely cause because the error is specifically about retrieval, not validation or compatibility.

Answer

The cluster has a baseline attached that conflicts with the desired image.

Answer

The image validation failed due to incompatible VIBs.

Answer

The host firmware is not compatible with the selected VIBs.

Question 14

An administrator is troubleshooting a situation where a virtual machine cannot be powered on. The error message indicates insufficient permissions. The VM is in a folder named 'Production' and the administrator has been assigned a custom role with 'Virtual machine > Power On' permission at the folder level. However, the VM is also in a resource pool. What additional permission is most likely missing?

Accepted Answer

Resource > Assign virtual machine to resource pool permission on the resource pool. To power on a virtual machine that resides in a resource pool, the user must have the 'Resource > Assign virtual machine to resource pool' permission on that resource pool. Even though the user has 'Virtual machine > Power On' at the folder level, the VM's association with the resource pool introduces an additional authorization check. Without this resource pool permission, the power-on operation fails with an insufficient permissions error.

Answer

Network > Assign network permission on the network

Answer

Datastore > Allocate space permission on the datastore

Answer

Virtual machine > Configuration permission on the VM

Question 15

A security audit reveals that an ESXi host has been compromised due to an attacker gaining root access via the DCUI. The host is configured with a default DCUI password. Which security best practice should have been implemented to prevent this?

Accepted Answer

Configure the DCUI lockdown mode to 'Normal'. DCUI Lockdown Mode 'Normal' disables direct root access via the Direct Console User Interface (DCUI) by requiring authentication through vCenter Single Sign-On (SSO). This prevents an attacker from using the default or weak DCUI password to gain root access, as the root account is no longer accepted for DCUI login. The mode still allows authorized vCenter administrators to access the host via the DCUI using their SSO credentials, maintaining manageability while eliminating the root password attack vector.

Answer

Disable the DCUI service

Answer

Set a strong password for the root account

Answer

Disable SSH access

Question 16

An administrator is troubleshooting a vLCM cluster where a host fails to remediate with the error: 'Host does not meet the requirements of the selected image'. The host is running ESXi 7.0 U3 and the desired image is ESXi 8.0 U1. What should the administrator check first?

Accepted Answer

Verify that the host is in maintenance mode before remediation.. Option D is correct because vLCM requires the host to be in maintenance mode before applying a new image, especially when upgrading across major ESXi versions (e.g., 7.0 U3 to 8.0 U1). The error 'Host does not meet the requirements of the selected image' typically occurs when the host is not in maintenance mode, as vLCM cannot stage or reboot the host to apply the new image while VMs are running. Placing the host in maintenance mode ensures that all VMs are migrated or powered off, allowing the remediation process to proceed without disruption.

Answer

Verify that all VIBs in the image are compatible with ESXi 7.0 U3.

Answer

Ensure that the host has internet access to download the image.

Answer

Check that the vCenter Server version is at least 8.0.

Question 17

A vSphere administrator needs to ensure that all HTTPS traffic to ESXi hosts is encrypted using TLS 1.2. Where should the administrator configure the minimum TLS version?

Accepted Answer

Host Advanced Settings (Config.HostAgent.plugins.vimsvc.auth.minTLSVersion). Option A is correct because the minimum TLS version for ESXi host HTTPS traffic is configured via the host advanced setting `Config.HostAgent.plugins.vimsvc.auth.minTLSVersion`. This setting directly controls the TLS protocol version used by the ESXi host's HTTP services, including the vSphere Client and API endpoints, ensuring only TLS 1.2 or higher is accepted.

Answer

Security Profile in the vSphere Client

Answer

vCenter Server Appliance (VAMI) web interface

Answer

ESXi Firewall rules

Question 18

A vSphere environment uses Active Directory for authentication. The administrator notices that users from a specific AD group cannot log in to the vCenter Server, although other AD users can. The group is added to vCenter Server with the correct permissions. What is the most likely cause?

Accepted Answer

The domain of the group is not configured as an identity source in vCenter Single Sign-On. The most likely cause is that the domain of the group is not configured as an identity source in vCenter Single Sign-On. Even if the group is added with correct permissions in vCenter Server, vCenter SSO must be able to authenticate users against the domain. Without the domain listed as an identity source, vCenter cannot validate the credentials of users from that group, causing authentication failures for all users in that domain.

Answer

The users are not members of the vCenter Single Sign-On domain

Answer

The user accounts have expired passwords

Answer

The group is nested within another group

Question 19

An administrator wants to use vLCM to manage a cluster with 10 ESXi hosts. After enabling vLCM, what is the first step to ensure all hosts are running the same desired image?

Accepted Answer

Define a desired state image for the cluster.. With vLCM, the first step after enabling it on a cluster is to define a desired state image. This image specifies the exact ESXi version, firmware, and driver versions that all hosts in the cluster must match. Without defining this image, vLCM has no target configuration to validate or enforce against the hosts.

Answer

Remediate the cluster immediately to apply the default image.

Answer

Place all hosts into maintenance mode.

Answer

Create a host upgrade baseline and attach it to the cluster.

Question 20

Match each vSphere component to its primary function.

Accepted Answer

vCenter Server: Centralized management platform for vSphere environments. The correct matches: vCenter Server is the centralized management platform; ESXi is the hypervisor; vSphere vMotion enables live migration; vSphere HA provides high availability. Common confusions include mixing up management functions with migration or HA features.

Answer

vCenter Server: Live migration of VMs without downtime

Answer

ESXi: High availability by restarting VMs on failed hosts