VCP-DCV Hard Questions — 25 Difficult Questions

Question 1

A vSphere administrator is designing a network for a cluster of ESXi hosts. Each host has four 10GbE uplinks. The cluster will host mission-critical VMs that require maximum throughput and redundancy. The administrator plans to use Network I/O Control (NIOC) and a vSphere Distributed Switch (vDS). Which configuration best ensures consistent network performance for all VMs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a single vDS with all four uplinks, enable NIOC, and set shares and reservations for each traffic type.. NIOC enables per-traffic-type resource management using shares, reservations, and limits, ensuring that mission-critical VMs receive consistent network throughput even under contention. Combining all four uplinks into a single vDS maximizes aggregate bandwidth and provides redundancy through teaming policies, while NIOC prioritizes traffic flows to prevent VMkernel or management traffic from starving VM traffic.

Answer

Configure a single vDS with all four uplinks and enable NetFlow for monitoring.

Answer

Create two separate vDS, each with two uplinks, and separate VM traffic from VMkernel traffic.

Answer

Configure a single vDS with all four uplinks and use Route based on IP hash teaming.

Question 2

A vSphere administrator is deploying a vSphere Distributed Switch (vDS) version 7.0. The environment has ESXi hosts with hardware version 7.0. The administrator needs to ensure that the vDS supports Network I/O Control version 3 (NIOCv3). What must be true for NIOCv3 to function correctly?

Accepted Answer

All hosts must be running ESXi 7.0 or later.. NIOCv3 is a feature introduced with vSphere 7.0 that provides granular bandwidth allocation and reservation for network traffic. For NIOCv3 to function correctly, all ESXi hosts attached to the vDS must be running ESXi 7.0 or later because the feature relies on kernel-level enhancements and the vSphere Network Resource Management (vNRM) agent that are only present in that version. Hosts on earlier versions lack the necessary drivers and scheduling capabilities, causing NIOCv3 to be unavailable or non-functional.

Answer

The vDS must be configured with Route based on IP hash teaming.

Answer

All hosts must have the vDS in Link Aggregation Control Protocol (LACP) mode.

Answer

The vDS must have a Network Resource Pool configured.

Question 3

During a security audit, it is discovered that a vCenter Server instance is using the default self-signed certificate. The company policy requires all certificates to be signed by an internal enterprise CA. An administrator has imported the CA chain into the VMware Endpoint Certificate Store (VECS) and generated a Certificate Signing Request (CSR). After receiving the signed certificate from the CA, which additional step is required to complete the certificate replacement?

Accepted Answer

Import the signed certificate into the appropriate VECS store and run the certificate-manager utility to update the services.. After the signed certificate is received from the CA, it must be imported into the appropriate VECS store (e.g., the machine SSL certificate store). Then, the certificate-manager utility (located at /usr/lib/vmware-vmca/bin/certificate-manager) must be run to update all vCenter services to use the new certificate. Option A is incorrect because generating a new CSR after replacement is unnecessary. Option B is incorrect because restarting the vCenter Management Agent only affects that single service, not all services that need the new certificate. Option D is incorrect because the certificate-manager utility is used for CA-signed certificates, not certool (which is for self-signed certificates).

Answer

Replace the default certificate in the VECS store with the CA-signed certificate and then generate a new CSR.

Answer

Restart the vCenter Management Agent (vma) service.

Answer

Run the certificate manager tool (certool) to generate a new self-signed certificate.

Question 4

An administrator is using vSphere Lifecycle Manager (vLCM) to manage a cluster with an image. The administrator needs to check the compliance of the cluster against the desired image and then remediate the hosts. Which two actions are required to accomplish this? (Choose two.)

Accepted Answer

Remediate the cluster to apply the image.. To ensure a cluster complies with its desired image, the administrator must first run a compliance check to identify non-compliant hosts. Then, remediation applies the image to those hosts. These two actions are the core of the vLCM image management workflow. Baselines, image export, and service restarts are not part of this process.

Answer

Attach a baseline to the cluster.

Answer

Export the image to a JSON file.

Answer

Restart the vLCM service on vCenter Server.

Question 5

A company has a vSphere 7.0 cluster with 6 ESXi hosts connected to a Dell EMC PowerStore array using iSCSI. They are using VMFS6 datastores. After a recent firmware upgrade on the array, they notice that performance on one datastore has degraded significantly. The datastore is used by several high-I/O VMs. The administrator runs 'esxcli storage core path list' and sees that all paths to that datastore are active but with varying latency. The PSP is set to Round Robin with IOPS limit of 1000. The SATP is VMW_SATP_ALUA. The storage administrator confirms that the array is in active-active mode. What should the administrator do to improve performance?

Accepted Answer

Increase the Round Robin IOPS limit to 10000.. The Round Robin PSP with an IOPS limit of 1000 is causing the ESXi host to switch paths too frequently, which can lead to higher latency due to path thrashing and suboptimal use of the array's active-active ALUA mode. Increasing the Round Robin IOPS limit to 10000 reduces the frequency of path switches, allowing each path to handle more I/Os before switching, which improves performance for high-I/O workloads on VMFS6 datastores.

Answer

Enable the array's QoS policy and configure the datastore for VAAI.

Answer

Change the PSP to Most Recently Used (MRU) to reduce path thrashing.

Answer

Change the SATP to VMW_SATP_DEFAULT_AA and reconfigure the iSCSI initiator.

Question 6

A company runs a critical e-commerce platform on a vSphere 7 cluster with ESXi hosts connected to a vSAN datastore. The environment uses vSphere Trust Authority (vTA) and VM encryption with an external KMS. Recently, after a successful vTA attestation, one of the VMs (WebServer-01) failed to power on with the error: 'Unable to decrypt the encrypted virtual machine upon re-registration. Reason: The KMS server is unreachable.' The administrator verifies that other encrypted VMs on the same host power on successfully. The KMS cluster consists of two servers: KMS-01 and KMS-02, both accessible from the management network. The administrator checks the VM's configuration and finds that it uses a custom storage policy with encryption. What is the most likely cause of this specific VM's failure?

Accepted Answer

The VM's encryption key was retrieved from a different KMS server that is now unavailable, and the key ID in the VM's metadata points to that KMS server.. The error 'Unable to decrypt the encrypted virtual machine upon re-registration. Reason: The KMS server is unreachable' indicates that the ESXi host cannot contact the KMS server to retrieve the VM's encryption key. Since other encrypted VMs on the same host power on successfully, the host can reach the KMS cluster, but this specific VM's encryption key may have been issued by a different KMS server (e.g., an older or alternative KMS) that is now unavailable. The key ID stored in the VM's metadata points to that unreachable server, causing the failure. Option A is incorrect because if the vCenter KMS cluster configuration were deleted, all VMs would be affected. Option B is incorrect because modifying the storage policy does not change the existing encryption key; the VM remains encrypted with its original key. Option C is incorrect because vTA attestation is separate from KMS key retrieval; the error message is specific to KMS unavailability.

Answer

The vCenter Server's KMS cluster configuration has been deleted, affecting all VMs but not this one.

Answer

The storage policy used by the VM has been modified and no longer includes encryption.

Answer

The vTA attestation process failed for the VM's host, but the error message is misleading.

Question 7

Refer to the exhibit. An administrator attempts to reclaim unused space on a VMFS datastore using esxcli storage vmfs unmap, but the command fails. Based on the logs and documentation, what is the most likely cause?

Accepted Answer

The storage LUN is thick-provisioned and does not support UNMAP.. The vmkernel log shows the UNMAP command failed with ILLEGAL REQUEST, sense 0x5 0x20 0x0, which indicates an invalid command. The vendor documentation states that UNMAP is only supported when thin provisioning is enabled on the LUN. The LUN is likely thick-provisioned, so the array rejects the UNMAP command.

Answer

The reclaim-unit parameter is set too low, causing the array to reject the command.

Answer

The ESXi host does not have sufficient permissions to issue UNMAP commands.

Answer

The VMFS datastore is not formatted with a supported block size.

Question 8

A vSphere administrator is troubleshooting a performance issue on a cluster with vSphere DRS enabled. The administrator notices that all VMs are on the same host despite DRS being fully automated. What is the most probable cause?

Accepted Answer

The host with all VMs has a higher DRS migration threshold.. DRS migration thresholds are configured at the cluster level (1–5), not per host. When the threshold is set to a high value (e.g., 4 or 5), DRS is conservative and less likely to migrate VMs, even if load is imbalanced. This explains why all VMs remain on a single host despite fully automated DRS. Option B's wording is technically inaccurate (thresholds are per cluster, not per host), but it correctly identifies the root cause.

Answer

DRS automation level is set to 'Manual'.

Answer

The cluster has DRS set to manual mode.

Answer

The vMotion network is not configured.

Question 9

An administrator has a vLCM-managed cluster with a desired image that includes a custom VIB from a third party. After remediation, one host shows 'Compliant' but the custom VIB is missing. What is the most likely cause?

Accepted Answer

The custom VIB was not included in the baseline.. If the desired image in vLCM actually includes the custom VIB, the host would be non-compliant if the VIB is missing. Therefore, the most likely cause is that the administrator mistakenly believes the VIB was included, but it was not part of the desired image. This results in a compliant host without the VIB.

Answer

The host has a host profile that overrides the vLCM image.

Answer

The host's acceptance level is set to 'CommunitySupported' but the VIB requires 'PartnerSupported'.

Answer

The custom VIB is not available in the VMware online depot.

Question 10

An administrator is troubleshooting a performance issue where a VM is not receiving the expected CPU resources. The VM is a member of a resource pool with a CPU Shares value of 2000. The host has two other resource pools: one with 1000 shares and another with 500 shares. All resource pools are competing for CPU. The VM's reservation is set to 2 GHz, and the host has 8 GHz available. What is the minimum CPU allocation the VM is guaranteed?

Accepted Answer

2 GHz. The VM's reservation of 2 GHz guarantees that the host will reserve at least that amount of CPU capacity for the VM, regardless of contention or share values. Shares only affect the distribution of excess resources beyond reservations, not the guaranteed minimum. Since the host has 8 GHz available, the reservation is fully satisfiable, so the VM is guaranteed 2 GHz.

Answer

4 GHz (based on share ratio)

Answer

8 GHz (all host CPU)

Answer

0 GHz (no guarantee without reservation)

Question 11

Which TWO actions are required to enable encrypted vSphere vMotion for all virtual machines in a cluster?

Accepted Answer

Set the vMotion encryption policy to 'Encrypt all data' in the cluster settings.. Setting the vMotion encryption policy to 'Encrypt all data' enforces encryption for all vMotion migrations in the cluster, using TLS 1.2 and host-based certificates. Option D is incorrect because Active Directory domain membership is not required; vMotion encryption works with the default host certificates as long as the hosts trust each other's certificates, which is achieved by default in a cluster. A KMS (Option B) is not needed for vMotion encryption, only for VM-level encryption. Storage DRS (Option C) is unrelated. Option E, 'Encrypt when supported', does not enforce encryption for all VMs; it only encrypts when both source and target hosts support it, which may not apply to all migrations.

Answer

Configure a Key Management Server (KMS) for the cluster.

Answer

Enable Storage DRS on the cluster.

Answer

Ensure all ESXi hosts in the cluster are joined to the same Active Directory domain.

Answer

Set the vMotion encryption policy to 'Encrypt when supported' in the cluster settings.

Question 12

Refer to the exhibit. An administrator checks the status of a distributed switch port and sees no errors or drops. However, virtual machines on this port cannot communicate with the default gateway at 192.168.200.1. What is the most likely cause?

Accepted Answer

The port is configured with Allowed VLANs 100, 200, 300, which is a trunk configuration, but the virtual machine expects an access port on VLAN 200.. The exhibit shows the port has Allowed VLANs: 100, 200, 300. This is unusual because a port should typically be assigned to a single VLAN (access port) or carry multiple VLANs (trunk port). If the port is set to allow multiple VLANs but the virtual machine expects a specific VLAN, packets may be misconfigured. However, the most likely cause is that the port is configured as a trunk port (allows multiple VLANs) when it should be an access port for VLAN 200. This can cause the virtual machine to receive traffic from other VLANs or not tag its own traffic correctly.

Answer

The port has no allowed MAC addresses, which may cause filtering.

Answer

The MTU is set to 1500, which is standard and should work fine.

Answer

The link speed is 10 Gbps, which is sufficient.

Question 13

Refer to the exhibit. An administrator observes high latency on a VMFS datastore. Based on the vdbench and esxtop output, which component is most likely causing the latency?

Accepted Answer

The virtual machine or application is causing high latency due to inefficient I/O patterns.. The esxtop output shows KAVG (kernel latency) of 2.5 ms and GAVG (guest latency) of 8.2 ms. The total latency (QAVG) is 10.7 ms, but the reported datastore latency is 12 ms. The high GAVG relative to KAVG indicates latency at the guest/application level, not at the storage array. The vdbench test shows 12 ms average latency, which matches the guest-level latency. The issue is likely due to application I/O patterns or queue depth, not the storage backend.

Answer

The storage array is overloaded, causing high queue depth (DAQLEN=32).

Answer

The VMFS datastore is fragmented, causing increased seek times.

Answer

The ESXi host's HBA queue depth is insufficient, causing queuing on the host.

Question 14

Which TWO storage performance best practices should be followed when scaling a vSphere environment using shared storage? (Choose two.)

Accepted Answer

Enable Storage I/O Control (SIOC) on datastores to manage I/O latency.. Option B is correct because Storage I/O Control (SIOC) lets vSphere enforce per-datastore I/O latency thresholds and fairly share I/O among virtual machines when a shared datastore becomes congested, which is a recommended best practice for scaling shared storage. Option C is correct because configuring multiple paths to the shared LUN and using the round-robin path selection policy (PSP) enables multipathing, increases aggregate bandwidth, and provides path failover for better performance and availability at scale. Option A is not a general performance best practice; Raw Device Mapping in physical compatibility mode is used mainly for clustering or SAN-specific requirements and can limit vSphere features. Option D is not a scaling best practice for shared storage because vSphere Flash Read Cache is a host-local read cache and does not address shared-storage scalability. Option E is incorrect because VMFS-3 is an obsolete version with datastore size and scalability limits compared with VMFS-5/VMFS-6, and it does not reduce seek time.

Answer

Use Raw Device Mapping in physical compatibility mode for virtual machines.

Answer

Deploy vSphere Flash Read Cache to reduce read latency.

Answer

Use VMFS-3 for large datastores to reduce seek time.

Question 15

A company uses an external Platform Services Controller (PSC) in a vSphere 6.7 environment. They plan to upgrade to vSphere 7.0. Which security-related consideration is most important?

Accepted Answer

The external PSC is deprecated; it must be converged into the vCenter Server.. In vSphere 7.0, external Platform Services Controllers (PSC) are deprecated and must be converged into the vCenter Server during upgrade. This convergence simplifies management and improves security by reducing the attack surface. The upgrade process requires a topology change to embedded PSC.

Answer

The external PSC will automatically convert to an embedded PSC during upgrade.

Answer

The SSL certificates for the PSC must be reissued from a new CA.

Answer

The STS certificates need to be replaced with custom ones immediately after upgrade.

Question 16

A large financial organization has a vSphere cluster with 10 ESXi hosts (8.x) connected to a pair of Nexus 9000 switches via two 10G LACP link aggregation groups (LAGs) per host. Each host has a vSphere Distributed Switch (vDS 7.0.3) with two LAGs (LAG1: vmnic0, vmnic1; LAG2: vmnic2, vmnic3). The vDS has three port groups: Production (VLAN 100-200), DMZ (VLAN 300), and Storage (VLAN 400). The port groups use LACP with load balancing 'Route based on IP hash'. Recently, the network team changed the physical switch port channels from mode 'active' to 'passive' on the downstream ports connected to host #3, without informing the virtualization team. Within hours, VMs on host #3 experience intermittent connectivity; some can communicate but others cannot, and vMotion between host #3 and other hosts fails with a network unreachable error. iSCSI storage traffic from host #3 is also unstable. The administrator verifies that the vDS LACP configuration on host #3 still expects 'active' mode. Which of the following actions is the most effective to restore full functionality while maintaining LACP?

Accepted Answer

Remove and recreate the LAGs on host #3's vDS after verifying the physical switch's LACP configuration.. The root cause is a mismatch between the vDS LACP mode (active) and the physical switch's LACP mode (passive). Simply recreating the LAGs after verifying the switch configuration ensures both sides agree on the LACP mode, restoring proper negotiation and traffic flow. This maintains the existing LACP-based load balancing and avoids disrupting the rest of the cluster.

Answer

Change the LACP mode on host #3's vDS from 'active' to 'passive' for both LAGs.

Answer

Disable LACP on host #3's vDS and use static EtherChannel instead.

Answer

Replace the vDS with multiple standard switches and use active/standby failover.

Question 17

An administrator is troubleshooting SSH connectivity to an ESXi host from a management workstation at 10.10.10.2. The SSH session is established, but the administrator cannot ping the host's IP 10.10.10.1. Based on the exhibit, what is the most likely cause?

Accepted Answer

ICMP traffic is blocked by the ESXi firewall.. The administrator can establish an SSH session, which proves that the ESXi host's SSH service is running and that TCP port 22 is reachable from the management workstation. However, the inability to ping the host's IP address (10.10.10.1) indicates that ICMP echo requests are being blocked. By default, the ESXi firewall blocks ICMP traffic, so the most likely cause is that ICMP is filtered by the host firewall.

Answer

The default gateway is not set correctly.

Answer

The SSH service is not running on the host.

Answer

The management workstation is on a different VLAN.

Question 18

Refer to the exhibit. The ESXi host has three VMkernel interfaces. A vMotion operation fails with a routing error. Which is the most likely cause?

Accepted Answer

The vMotion VMkernel interface is on vmk2, but no route exists for the vMotion destination network.

Answer

The vMotion VMkernel interface uses DHCP.

Answer

The vMotion VMkernel interface is on vmk1, but the default gateway points to vmk0.

Answer

The vMotion VMkernel interface is on vmk0, but the gateway is incorrect.

Question 19

Refer to the exhibit. An administrator configured beacon probing for network failure detection on the Production port group. However, virtual machines are experiencing intermittent connectivity. What is the most likely reason?

Accepted Answer

There are only two uplinks, and beacon probing requires at least three uplinks.. Beacon probing requires at least three uplinks to function correctly. The exhibit shows only two uplinks (vmnic1 and vmnic2) are active. With two uplinks, beacon probing cannot reliably detect failures because there are not enough beacons to determine which link is down. This can cause false positives and connectivity issues.

Answer

The VLAN ID 200 is not allowed on the physical switch trunks.

Answer

The DVS version 7.0.0 does not support beacon probing.

Answer

The load balancing policy is set to Route based on IP hash, which is incompatible with beacon probing.

Question 20

Refer to the exhibit. An administrator configures Storage DRS for a datastore cluster. The cluster has datastores with varying performance. Which statement about Storage DRS behavior is correct?

Accepted Answer

Storage DRS will generate recommendations but will not perform migrations automatically.. Storage DRS in VMware vSphere can operate in manual mode, where it generates recommendations for migrations but does not automatically perform them. The exhibit likely shows the automation level set to Manual, so Storage DRS will only provide recommendations.

Answer

Storage DRS will automatically migrate VMs when utilization exceeds 80%.

Answer

Storage DRS will only balance based on space, ignoring I/O metrics.

Answer

Storage DRS will balance datastores every 8 hours regardless of thresholds.