VCP-DCV Hard Questions — 25 Difficult Questions

Question 1

A company uses vSphere with Tanzu to run container workloads. The security team requires that all container traffic between namespaces be encrypted. What is the best approach to achieve this?

Accepted Answer

Deploy NSX-T and enable the Network Encryption feature for East-West traffic.. NSX-T's Network Encryption feature provides encryption for East-West traffic between namespaces, meeting the security requirement. Option A is incorrect because the NSX Container Plugin has been deprecated and is not the best approach. Option B is incorrect as vSAN encryption only protects data at rest, not in transit. Option D is incorrect because while Calico can encrypt traffic, it lacks the native integration and centralized management that NSX-T offers with vSphere with Tanzu.

Answer

Use the NSX Container Plugin with IPsec to encrypt traffic.

Answer

Enable vSAN encryption to encrypt data at rest and assume it covers in-transit traffic.

Answer

Install a third-party CNI like Calico with IPsec enabled.

Question 2

A vSphere administrator is planning a Storage DRS implementation for a datastore cluster containing multiple VMFS datastores. The VMs have various I/O patterns. Some VMs should always remain together on the same datastore. Which configuration should be used?

Accepted Answer

Create a VM-to-VM affinity rule in the datastore cluster.. Storage DRS affinity rules allow you to keep VMs together (VM-to-VM affinity) or separate (anti-affinity). To ensure VMs remain together, a VM-to-VM affinity rule is required. Option B is incorrect because Storage DRS does not support per-host datastore affinity rules; rules are at the datastore cluster level. Option C is incorrect because Storage I/O Control manages I/O prioritization, not VM placement. Option D is incorrect because a VM-to-VM anti-affinity rule would separate the VMs, not keep them together.

Answer

Set individual datastore affinity rules on each host.

Answer

Apply Storage I/O Control with high shares to the VMs.

Answer

Create a VM-to-VM anti-affinity rule in the datastore cluster.

Question 3

A vSphere cluster using vSAN is experiencing high latency for some VMs. The administrator checks the vSAN skyline health and finds that all disk groups are healthy. Which additional step should the administrator take to diagnose the issue?

Accepted Answer

Check the vSAN performance service for object latency breakdown.. The vSAN Performance Service provides granular, real-time and historical metrics for vSAN objects, including latency breakdowns at the VM, disk group, and physical disk levels. Since the skyline health check shows all disk groups as healthy, the next logical step is to use the Performance Service to pinpoint whether the high latency is due to congestion on a specific object, such as a VM virtual disk or a particular disk group component, rather than a hardware failure.

Answer

Verify that the vSAN network is configured with jumbo frames.

Answer

Enable vSAN encryption to improve performance.

Answer

Increase the number of disk groups on each host.

Question 4

A company has a vSphere environment with 20 ESXi hosts and 500 VMs. The security team mandates that all administrative access to vCenter Server must be through a single, highly restricted account with multi-factor authentication (MFA). The account must be used for both the vSphere Client and API integrations. Which step should the administrator take?

Accepted Answer

Integrate vCenter Server with an external identity provider (e.g., ADFS, Okta) that supports MFA, and use a service account with MFA for API access.. Integrating vCenter Server with an external identity provider (IdP) such as ADFS or Okta allows the use of a single service account that supports multi-factor authentication (MFA) for both the vSphere Client and API integrations. This approach meets the security mandate by centralizing authentication through an IdP that enforces MFA, while also supporting OAuth 2.0 token-based API access, which is required for modern vSphere API integrations. The built-in administrator account cannot be directly configured with MFA in a way that satisfies both interactive and API access requirements without external integration.

Answer

Configure the built-in administrator account to require smart card authentication.

Answer

Create a new local account and configure it as a member of the Administrators group, then enforce MFA via a third-party tool on the vCenter Server OS.

Answer

Disable the built-in administrator account and create a new local account with the same privileges.

Question 5

An administrator attempts to expand a VMFS datastore by increasing the LUN size, but the expand option is grayed out. What could be the reason?

Accepted Answer

The LUN is shared with another datastore. If the LUN is shared with another datastore, it cannot be expanded because a LUN can belong to only one datastore. Block size does not affect expansion; RDMs are not used for VMFS; rescan is unrelated to the grayed-out option.

Answer

The datastore is using block size 2 MB

Answer

The host is not rescanned

Answer

The datastore is on a RDM

Question 6

A company operates a large vSphere environment with 32 ESXi hosts, each featuring 2 sockets, 12 cores per socket (2.6 GHz), and 256 GB RAM. The environment runs a mix of VMs, including several critical database VMs with 16 vCPUs and 128 GB RAM configured. After migrating these database VMs from an older cluster to a new cluster with identical hardware specifications, administrators observe significant performance degradation. vCenter performance charts show high memory ballooning and elevated CPU ready time for these VMs, while overall host utilization remains moderate (CPU 40%, RAM 60%). The new cluster's hosts have two NUMA nodes per socket (each NUMA node spans 6 cores and 64 GB RAM). The older cluster had hosts with a single NUMA node per socket. The administrator confirms that the VMs are running on hosts with sufficient free resources and that no other VMs are contending heavily. What is the most likely cause, and what should the administrator do to resolve the issue?

Accepted Answer

Enable vNUMA for the database VMs to align with the physical NUMA topology.. The performance degradation is caused by a vCPU-to-NUMA topology mismatch. The database VMs have 16 vCPUs, but each NUMA node in the new cluster has only 6 cores. Without vNUMA enabled, the VM scheduler treats the guest as a single large NUMA domain, causing cross-NUMA memory accesses and high memory ballooning. Enabling vNUMA exposes the physical NUMA topology to the guest OS, allowing it to optimize memory locality and reduce overhead.

Answer

Reduce the number of vCPUs for the database VMs from 16 to 8.

Answer

Disable Hyper-Threading on the new cluster hosts.

Answer

Increase the memory reservation for each database VM to prevent ballooning.

Question 7

An administrator creates a DRS rule to separate two VMs (VM1 and VM2) using a 'Should' rule (separate VMs). After the rule is created, VM1 is manually vMotioned to a host that already runs VM2. What is the expected behavior?

Accepted Answer

VM1 remains on the host and a compliance violation is logged.. With a 'Should' rule (separate VMs), DRS does not enforce the rule; it only logs a compliance violation if VMs run on the same host. Manual vMotion overrides DRS, so VM1 will remain on the host with VM2 and a violation is logged. Option A correctly describes this behavior. 'Must' rules would enforce separation, but 'Should' rules are advisory only.

Answer

DRS automatically migrates VM1 to a compliant host.

Answer

The target host is placed into maintenance mode.

Answer

VM1 is powered off to prevent performance issues.

Question 8

Refer to the exhibit. An administrator has configured a vSphere host to use Round Robin (RR) PSP for a specific ALUA storage device. However, after a storage array failover, the host is not detecting the new active paths correctly. Which configuration change should be made to ensure proper path failover behavior?

Accepted Answer

Enable explicit_transition by setting it to 1 in the SATP device config.. The exhibit shows the device is using TPGS (Target Port Group Support) with ALUA. The output shows that implicit_transition is set to 0, meaning the host does not automatically react to ALUA state changes. To ensure proper failover, explicit_transition should be enabled (set to 1), which allows the host to query the array for path state changes. Additionally, setting useANO=1 in PSP config can help by enabling Asymmetric Namespace Access, but the key issue is the implicit_transition setting.

Answer

Change the SATP to VMW_SATP_DEFAULT_AA.

Answer

Set the PSP to VMW_PSP_FIXED and designate a preferred path.

Answer

Increase the IOPS limit for the RR PSP to 10000.

Question 9

Which TWO troubleshooting steps should an administrator take when a host fails to remediate and shows 'compliance error: host firmware mismatch' in a vLCM cluster? (Choose two.)

Accepted Answer

Check the compliance status in the vSphere Client cluster monitor.. Correct options are C and D. Checking the compliance status in the vSphere Client cluster monitor allows the administrator to see detailed compliance information for the host, including specific mismatches. Reviewing the software FCoE, VLAN, and driver versions in the cluster image is a troubleshooting step to identify component mismatches that could cause firmware errors. Option A is incorrect because removing and re-adding a host does not address the underlying firmware mismatch. Option B is incorrect because manually upgrading all hosts is unnecessary and not a targeted troubleshooting step. Option E is incorrect because disabling the cluster image and using a baseline group would change the management approach but does not resolve the compliance error related to firmware mismatch in a vLCM cluster.

Answer

Remove the host from the cluster and re-add it.

Answer

Manually upgrade all hosts to the latest ESXi version.

Answer

Disable the cluster image and use a baseline group instead.

Question 10

Which THREE factors should be considered when planning a rolling upgrade of ESXi hosts in a vSphere cluster from version 7.0 to 8.0 using vLCM?

Accepted Answer

Check the compatibility of third-party VIBs with ESXi 8.0.. For a rolling upgrade of ESXi hosts from 7.0 to 8.0 using vLCM, you must check the compatibility of third-party VIBs with ESXi 8.0 (A). Additionally, the vCenter Server must be upgraded to 8.0 before upgrading ESXi hosts because vCenter manages the cluster (B). The VUM rollback feature, which is available in vLCM, should be configured to allow revert in case of failure (D). Option C is incorrect because hardware compatibility must be verified via the VMware Compatibility Guide (HCL), not assumed just because it is a major release. Option E is incorrect because vSphere DRS should be enabled to allow automated VM migration during host maintenance, not disabled.

Answer

Assume that all server hardware is supported by ESXi 8.0 since it is a major release.

Answer

Disable vSphere DRS to prevent VM migration during host maintenance.

Question 11

A vSphere administrator is using vSphere Lifecycle Manager images to manage a cluster. The administrator wants to add a new custom component (a driver) to the cluster image. Which THREE steps are required to successfully add the component? (Choose three.)

Accepted Answer

Download the component offline bundle from the vendor.. Options A, C, and D are correct. A: Download the component offline bundle from the vendor. C: Upload the component to the vLCM depot. D: Add the component to the image definition in vLCM. B is incorrect because you do not need to create a new software depot; the vLCM depot already exists and you upload the bundle to it. E is incorrect because validation is not a required step to add the component; it can be performed later as part of image compliance checking.

Answer

Create a new software depot on the vCenter Server.

Answer

Validate the component against the current image.

Question 12

An administrator has configured jumbo frames on a VDS and all physical switches. Virtual machines on different hosts can ping each other but cannot transfer files larger than 1500 bytes. What is the most likely cause?

Accepted Answer

The virtual machine's operating system MTU is set to 1500.. Jumbo frames require the entire network path, including the virtual machine's operating system, to support the larger MTU. If the VM OS MTU is left at 1500, packets larger than 1500 bytes will be fragmented by the OS or dropped, preventing large file transfers. Option A is incorrect because the problem states physical switches and the VDS are configured for jumbo frames, but the physical NICs must also be configured; however, the question does not indicate they are misconfigured, and the issue is more likely the VM OS. Option B is incorrect because TCP offload engines typically handle segmentation and checksum, not fragmentation due to MTU mismatch. Option C is incorrect because VMkernel adapters are for management and vMotion traffic, not VM data traffic; VM data uses the VM's own network stack.

Answer

The physical NICs are not configured for jumbo frames.

Answer

The TCP/IP offload engine is causing fragmentation.

Answer

The VMkernel adapters are not configured with MTU 9000.

Question 13

A vSphere administrator manages a cluster of 50 ESXi hosts using vLCM with image-based management. The cluster includes hosts from two different hardware vendors. The administrator needs to ensure firmware updates are consistently applied across all hosts. What is the best practice for this scenario?

Accepted Answer

Create separate cluster images for each hardware vendor and apply to respective hosts.. Different hardware vendors require different firmware, and vLCM image-based management supports creating separate cluster images per hardware type to ensure the correct firmware is applied to each host. Option A is wrong because baseline groups are deprecated and not the best practice for firmware updates. Option B is wrong because a single cluster image cannot contain multiple firmware sets for different vendors. Option D is wrong because manually updating firmware with vendor tools is not standardized and defeats the purpose of centralized lifecycle management via vLCM.

Answer

Use baseline groups to manage firmware separately.

Answer

Create a single cluster image that includes firmware for both vendors.

Answer

Manually update firmware using vendor tools, then use vLCM for ESXi updates.

Question 14

During a period of high network contention, management traffic is starved while NFS traffic gets the most bandwidth. Which configuration change would best address the issue?

Accepted Answer

Set a reservation for management traffic.. Setting a reservation for management traffic guarantees a minimum amount of bandwidth, ensuring that management traffic does not get starved even under high network contention. Option A (increasing management shares) improves relative priority but does not guarantee bandwidth. Option B (increasing the NFS limit) would allocate more bandwidth to NFS, worsening the problem. Option D (enabling traffic shaping on the management port group) affects only outbound traffic on a standard switch and does not use NIOC (Network I/O Control), which is needed for reservation-based guarantees. Option E (removing the vMotion reservation) may free up bandwidth but does not guarantee management traffic receives a minimum.

Answer

Increase management shares to 100.

Answer

Increase the NFS limit to 1000 Mbps.

Answer

Enable traffic shaping on the management port group.

Answer

Remove the reservation from vMotion.

Question 15

A vSphere environment uses VMCA for certificate management. An administrator needs to replace the certificate for vCenter Server with a custom CA-signed certificate. The custom CA root certificate must be trusted by all ESXi hosts. Which method should the administrator use to distribute the custom CA root certificate to ESXi hosts?

Accepted Answer

Create a host profile containing the custom CA root certificate and apply it to the ESXi hosts. Using a host profile to apply the custom CA root certificate ensures consistent, policy-driven deployment across all ESXi hosts, leveraging vCenter's host profile functionality. Option A is incorrect: restarting the rhttpproxy service with a new configuration does not distribute certificates; it only restarts the proxy service. Option B is incorrect: while vCenter can manage machine SSL certificates, it does not automatically push root CA certificates to ESXi hosts; the administrator must explicitly import the root CA into the ESXi trust store, which is not done automatically by vCenter. Option C is incorrect: manually uploading via SCP is not scalable and is not the recommended method for managing certificate trust across multiple hosts; host profiles provide a centralized, automated approach.

Answer

Restart the rhttpproxy service on each ESXi host with a new configuration

Answer

Import the root CA certificate into vCenter Server and it will automatically push to hosts

Answer

Manually upload the root CA certificate to each ESXi host via SCP

Question 16

A company runs a critical e-commerce platform on a vSphere 7 cluster with ESXi hosts connected to a vSAN datastore. The environment uses vSphere Trust Authority (vTA) and VM encryption with an external KMS. Recently, after a successful vTA attestation, one of the VMs (WebServer-01) failed to power on with the error: 'Unable to decrypt the encrypted virtual machine upon re-registration. Reason: The KMS server is unreachable.' The administrator verifies that other encrypted VMs on the same host power on successfully. The KMS cluster consists of two servers: KMS-01 and KMS-02, both accessible from the management network. The administrator checks the VM's configuration and finds that it uses a custom storage policy with encryption. What is the most likely cause of this specific VM's failure?

Accepted Answer

The VM's encryption key was retrieved from a different KMS server that is now unavailable, and the key ID in the VM's metadata points to that KMS server.. The error 'Unable to decrypt the encrypted virtual machine upon re-registration. Reason: The KMS server is unreachable' indicates that the ESXi host cannot contact the KMS server to retrieve the VM's encryption key. Since other encrypted VMs on the same host power on successfully, the host can reach the KMS cluster, but this specific VM's encryption key may have been issued by a different KMS server (e.g., an older or alternative KMS) that is now unavailable. The key ID stored in the VM's metadata points to that unreachable server, causing the failure. Option A is incorrect because if the vCenter KMS cluster configuration were deleted, all VMs would be affected. Option B is incorrect because modifying the storage policy does not change the existing encryption key; the VM remains encrypted with its original key. Option C is incorrect because vTA attestation is separate from KMS key retrieval; the error message is specific to KMS unavailability.

Answer

The vCenter Server's KMS cluster configuration has been deleted, affecting all VMs but not this one.

Answer

The storage policy used by the VM has been modified and no longer includes encryption.

Answer

The vTA attestation process failed for the VM's host, but the error message is misleading.

Question 17

A vSphere administrator configures a VVol datastore on a Pure Storage array. The administrator creates a storage policy with a custom tag. After attaching the policy to a VM, the VM remains uncompliant. What is the most likely cause?

Accepted Answer

The storage array does not support the capability specified in the policy.. VVol storage policies rely on capabilities advertised by the array through VASA. If the array does not support the specific capability or tag used in the policy, the VM will be uncompliant. Option A is correct because the custom tag in the storage policy is not supported by the Pure Storage array. Option B is incorrect: VVol datastores require VASA certification; if the array were not VASA-compliant, it could not host a VVol datastore at all. Option C is incorrect because Storage DRS is unrelated to VVol policy compliance. Option D is incorrect because VVol datastores can use either iSCSI or NFS protocols, and the protocol does not affect compliance.

Answer

The storage array is not VASA-compliant.

Answer

The datastore cluster is not configured for Storage DRS.

Answer

The VVol datastore is using NFS protocol instead of iSCSI.

Question 18

Refer to the exhibit. An administrator runs the 'esxcli storage core device list' command and sees the output. The storage array is an active-passive array with ALUA. The current path selection policy is set to Fixed with no preferred path. What is the consequence of this configuration?

Accepted Answer

I/O may be sent to a non-optimized path, causing higher latency. With an active-passive ALUA array, the Fixed path selection policy without a preferred path means the host may not switch to the optimized active path for a given LUN. Since no preferred path is set, the host can select any available path, potentially sending I/O through a non-optimized passive path. This results in higher latency as the array must redirect I/O through the partner controller. Option C correctly identifies this consequence. Option A is incorrect because Fixed policy does not load-balance; it uses a single path unless it fails. Option B is wrong because ALUA is supported and the host can use multiple paths but only one is active. Option D is irrelevant as VMDKs can be used on any path.

Answer

The I/O is load-balanced across all four paths

Answer

ALUA is not supported, so the host will use only one path

Answer

The device cannot be used for VMDKs, only for RDM

Question 19

Refer to the exhibit. An administrator observes high latency on a VMFS datastore. Based on the vdbench and esxtop output, which component is most likely causing the latency?

Accepted Answer

The virtual machine or application is causing high latency due to inefficient I/O patterns.. The esxtop output shows KAVG (kernel latency) of 2.5 ms and GAVG (guest latency) of 8.2 ms. The total latency (QAVG) is 10.7 ms, but the reported datastore latency is 12 ms. The high GAVG relative to KAVG indicates latency at the guest/application level, not at the storage array. The vdbench test shows 12 ms average latency, which matches the guest-level latency. The issue is likely due to application I/O patterns or queue depth, not the storage backend.

Answer

The storage array is overloaded, causing high queue depth (DAQLEN=32).

Answer

The VMFS datastore is fragmented, causing increased seek times.

Answer

The ESXi host's HBA queue depth is insufficient, causing queuing on the host.

Question 20

Refer to the exhibit. An administrator attempts to reclaim unused space on a VMFS datastore using esxcli storage vmfs unmap, but the command fails. Based on the logs and documentation, what is the most likely cause?

Accepted Answer

The storage LUN is thick-provisioned and does not support UNMAP.. The vmkernel log shows the UNMAP command failed with ILLEGAL REQUEST, sense 0x5 0x20 0x0, which indicates an invalid command. The vendor documentation states that UNMAP is only supported when thin provisioning is enabled on the LUN. The LUN is likely thick-provisioned, so the array rejects the UNMAP command.

Answer

The reclaim-unit parameter is set too low, causing the array to reject the command.

Answer

The ESXi host does not have sufficient permissions to issue UNMAP commands.

Answer

The VMFS datastore is not formatted with a supported block size.