VMware · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An administrator is managing a vSphere Foundation environment and needs to place an ESXi host into Maintenance Mode without powering off the virtual machines running on it. Which DRS setting must be configured to ensure these virtual machines are automatically migrated to other hosts in the cluster?
Disabled DRS
Partially Automated DRS
Fully Automated DRS
Fully Automated DRS performs its own migration recommendations and executes them, so evacuating VMs off the host on entering Maintenance Mode happens without manual intervention. Partially Automated only generates recommendations requiring approval, which would leave VMs powered on and block the task.
Manual DRS
An administrator is configuring storage I/O control (SIOC) on a datastore shared by multiple clusters in a vSphere Foundation environment. During peak hours, a batch processing VM overwhelms the datastore with IOPS. Which SIOC configuration prevents this VM from starving other critical workloads?
Increase the datastore congestion threshold percentage from 30ms to 50ms.
Configure a hard IOPS limit on the specific virtual machine disks causing contention.
A hard IOPS limit caps the batch VM's disk throughput, directly preventing it from consuming datastore queue depth and starving other workloads. This satisfies the constraint of stopping one VM overwhelming shared storage during peak hours, unlike shares or reservations which only guarantee minimums.
Disable Storage DRS on the shared datastore cluster.
Assign a higher disk share value to the batch processing virtual machine.
A vSphere administrator notices that a high-priority virtual machine is experiencing CPU contention on an eight-socket ESXi host. The virtual machine is configured with 16 vCPUs and the host has physical NUMA nodes containing 8 cores each. Which configuration step will best mitigate performance degradation caused by remote memory accesses?
Resize the virtual machine to 8 vCPUs to match the physical NUMA node size.
Resizing to 8 vCPUs aligns the virtual machine with a single physical NUMA node of 8 cores, so all vCPU memory accesses remain local. This eliminates remote memory access latency across nodes, directly mitigating the contention and degradation described on the eight-socket host.
Configure CPU shares to High for the affected virtual machine.
Increase the reservation on the virtual machine's memory settings to maximum.
Enable hyperthreading globally on the ESXi host cluster.
An administrator needs to monitor the real-time resource utilization of a specific virtual machine in the vSphere Client. Which tab in the vSphere Client should the administrator select to view live CPU and memory performance charts?
Configure tab
Permissions tab
Monitor tab
The Monitor tab provides real-time performance charts for a selected virtual machine, including live CPU and memory utilisation. This directly satisfies the requirement to view current resource usage in the vSphere Client, since the Monitor tab hosts the Performance sub-tab where these live metrics are rendered.
Summary tab
An administrator is setting up a new virtual machine and needs to attach a persistent raw disk device. Which disk provisioning type should the administrator select during the virtual machine creation wizard?
Raw Device Mapping (RDM)
An RDM presents a physical LUN directly to the VM as a mapped device, providing persistent raw disk access with metadata in a pointer file, which is exactly the provisioning type needed to attach a persistent raw disk device.
Thick Provision Lazy Zeroed
Thin Provision
Thick Provision Eager Zeroed
An administrator needs to take a snapshot of a critical database virtual machine before applying a patch. Which option should be selected to ensure that memory state is NOT included in the snapshot file?
Power off the virtual machine prior to snapshotting
Enable quiescing on the virtual machine settings
Deselect 'Snapshot virtual machine memory'
Deselecting the memory tickbox produces a crash-consistent snapshot containing only the VM's disk state and configuration. The .vmsn memory file is omitted, so no RAM contents are captured, reducing snapshot size and avoiding quiescing of running memory.
Select 'Disable Guest Customization'
Want more Vmware Vsphere Foundation Fundamentals practice?
Practice this domainAn administrator needs to configure centralized log forwarding from ESXi hosts to an external syslog server in a VVF environment. Where in the vSphere Client should the administrator configure the syslog collector settings for an ESXi host?
vCenter -> Administration -> Deployment -> Syslog Gateway.
Host -> Configure -> Advanced System Settings -> Syslog.global.logHost.
Syslog.global.logHost is the advanced system setting that defines the remote syslog collector target per ESXi host. Configuring it under Host, Configure, Advanced System Settings directs the host's log traffic to the external syslog server, meeting the centralised forwarding requirement.
SDDC Manager -> Infrastructure -> Log Forwarding.
Cluster -> Settings -> vSphere Availability -> Logging.
An administrator wants to configure an alarm in vSphere 9.0 to trigger an email notification when a datastore's free space drops below 15%. After creating the alarm definition and specifying the trigger condition, no emails are received when the threshold is breached. What is the most likely missing configuration?
The datastore was formatted with VMFS-5 instead of VMFS-6.
The ESXi firewall is blocking outbound TCP port 443 to the mail server.
SNMP traps must be enabled on the physical switch interconnecting the management network.
The vCenter mail server (SMTP) settings have not been defined in vCenter Server settings.
Alarm actions cannot deliver email unless vCenter has a configured SMTP server; without it, the alarm triggers but notification silently fails. Defining the mail sender settings in vCenter Server settings is the prerequisite the administrator omitted.
An administrator is utilizing vSphere Lifecycle Manager (vLCM) in VVF 9.0 to manage ESXi host compliance and image updates across a cluster. The cluster image compliance check reports an error indicating that a vendor hardware addon is incompatible with the selected ESXi base image version. How should the administrator resolve this issue?
Manually edit the vpxd configuration file on vCenter to bypass hardware compatibility checks for the cluster.
Select a vendor add-on version that explicitly supports the target ESXi base image version from the software depot.
The vendor add-on must be compatible with the chosen ESXi base image; selecting an add-on version explicitly supporting that base image resolves the compliance error. vLCM validates image compatibility against the depot, so matching versions satisfies the constraint.
Disable vSphere High Availability (HA) on the cluster before initiating the image compliance remediation.
Switch the cluster back to a baseline-based update method and apply legacy patch baselines.
An administrator is replacing default VMCA-signed certificates with custom Certificate Authority (CA) signed certificates on a vCenter 9.0 instance using the vSphere Certificate Manager utility. During the process, the utility fails while generating the Certificate Signing Request (CSR). What is the primary cause of this failure?
Port 443 is blocked by a local firewall on the ESXi management vmkernel interface.
The root CA certificate has expired on the external enterprise CA server.
The configuration file (certool.cfg) contains incorrect or missing mandatory parameters.
The vSphere Certificate Manager reads certool.cfg to build the CSR, so incorrect or missing mandatory parameters such as country, organisation or FQDN cause generation to fail before any certificate is requested from the custom CA.
The vCenter Appliance Management Interface (VAMI) service is stopped.
An administrator is deploying VMware vSphere Foundation 9.0 using the Cloud Builder appliance. During the environment bring-up validation phase, the precheck fails due to an insufficient number of IP addresses assigned to the ESXi management network pool. Which action must the administrator take to resolve this validation failure?
Reboot the Cloud Builder appliance to clear cached allocation tables from previous failed validation runs.
Bypass the IP validation phase by editing the Cloud Builder local deployment service configuration properties.
Deploy an external DHCP server on the management VLAN to dynamically lease addresses to the ESXi hosts.
Modify the JSON specification file to expand the IP address pool range with valid unused IP addresses and restart prechecks.
Expanding the ESXi management network pool in the JSON specification directly satisfies the precheck's requirement for sufficient addresses. Cloud Builder validates the spec against the deployment topology, so adding valid unused IPs and re-running prechecks resolves the insufficiency without altering the physical network.
An administrator is configuring Active Directory authentication for ESXi hosts directly via the Host Client. After entering the domain credentials and joining the domain, users in the domain are still unable to log into the ESXi host. What step was missed during the configuration?
Enabling Network Time Protocol (NTP) synchronization across all domain controllers.
Restarting the vCenter Server service to synchronize the Active Directory forest schema.
Assigning specific roles and permissions to the Active Directory users or groups on the ESXi host's Permissions tab.
Joining the domain only lets ESXi resolve and authenticate directory accounts; it grants no access by itself. Permissions must be added on the host's Permissions tab, assigning roles to the AD users or groups, otherwise authentication succeeds but authorisation fails.
Modifying the Active Directory Group Policy Object (GPO) to allow remote desktop connections.
Want more Deploy Configure And Operate Vvf practice?
Practice this domainAn enterprise is designing a multi-site vSphere Foundation 9.0 architecture leveraging stretched clustering. What is the maximum supported Round Trip Time (RTT) network latency for synchronous vSAN storage replication between primary and secondary data centers?
500 milliseconds or less
100 milliseconds or less
5 milliseconds or less
Stretched vSAN clusters require synchronous replication, which is bounded by round-trip latency. VMware supports a maximum RTT of 5 milliseconds between sites; beyond this, writes cannot commit within tolerance and the stretched configuration is unsupported.
25 milliseconds or less
An enterprise architect is integrating vSphere Foundation 9.0 with an external hardware security module (HSM) cluster using KMIP. Which architectural standard ensures that vCenter Server securely establishes keys for VM encryption without exposing cleartext credentials?
Mutual TLS (mTLS) certificate authentication combined with KMIP-compliant key exchange.
Mutual TLS authenticates both vCenter Server and the KMIP HSM cluster with certificates, so key material is exchanged over an encrypted channel without cleartext credentials, satisfying the stem's requirement for secure key establishment for VM encryption.
IPsec transport mode tunnels terminated on the ESXi management vmkernel interface.
OAuth 2.0 token exchange via the vCenter Lookup Service.
LDAP over SSL (LDAPS) binding using shared secret service accounts.
A systems architect is reviewing the hardware compatibility list (HCL) for a vSphere Foundation 9.0 cluster upgrade. The target servers utilize a modern SmartNIC (DPU) architecture. Which architectural benefit does offloading network and storage virtualization tasks to the DPU provide?
Eliminating the requirement for shared external storage arrays by converting the DPU into a vSAN witness node.
Enabling zero-latency synchronous replication across unlimited geographic distances.
Reclaiming host CPU cycles by offloading infrastructure tasks such as distributed firewalling, encapsulation, and crypto processing to the DPU hardware.
DPU offload moves distributed firewalling, encapsulation and crypto processing off the host x86 cores onto dedicated SmartNIC hardware. This directly reclaims host CPU cycles for tenant workloads, satisfying the architect's stated benefit of the DPU architecture rather than merely adding bandwidth.
Automating the physical switch firmware deployment via LLDP integration.
An administrator is preparing to deploy vCenter Server 9.0 in a high-availability architecture. What is the fundamental prerequisite regarding DNS for the vCenter Server Appliance (VCSA) deployment?
Static ARP entries mapped on all upstream core routing devices.
Configured Forward (A) and Reverse (PTR) DNS records corresponding to the VCSA FQDN.
vCenter Server services, certificate generation, and SSO depend on resolving the VCSA FQDN in both directions. Forward (A) records alone allow name-to-IP resolution, but the installer and clustered services also require matching Reverse (PTR) records, so both must exist before deployment.
Network Time Protocol (NTP) disabled during the initial installation wizard.
Active Directory domain controller roles installed directly onto the appliance OS.
An administrator is designing a multi-tenant vSphere Foundation 9.0 environment and needs to enforce strict isolation of management traffic, vMotion, and tenant workloads at Layer 2. Which feature should be used on a Distributed Switch to enforce this requirement?
Network I/O Control (NIOC) shares and reservation limits.
ESXi firewall rule adjustments via the Host Client.
Cross-vCenter vMotion encrypted transport tunnels.
Private VLANs (PVLANs) configured with isolated and community secondary VLAN IDs.
PVLANs enforce Layer 2 isolation at the port level: isolated secondary VLANs block all peer traffic, while community VLANs permit communication only within the group. This satisfies the strict multi-tenant separation requirement, since standard VLANs alone cannot prevent traffic between ports on the same subnet.
When designing a vSphere Foundation 9.0 standard virtual switch (vSwitch) topology for a dual-port 25GbE network adapter configuration, what is the best practice for redundancy and bandwidth utilization?
Connect each uplink to a completely different vCenter Server instance to achieve high availability.
Disable spanning tree on the ESXi vSwitch properties panel.
Designate one uplink as Active and the second uplink strictly as Standby to prevent packet duplication.
Configure both uplinks as active and assign them to an appropriate load-balancing algorithm such as Route Based on Physical NIC Load.
Route Based on Physical NIC Load monitors each uplink's utilisation and dynamically rebalances flows when a link becomes saturated. This satisfies the dual-port 25GbE requirement by keeping both uplinks active for aggregate bandwidth while providing failover.
Want more IT Architectures Technologies Standards practice?
Practice this domainDuring a routine check in vSphere Client, an administrator notices that ESXi host network packet drops are incrementing rapidly on a distributed virtual switch (vDS) uplink. Which esxcli command should the administrator execute via SSH to inspect the physical network adapter statistics and check for frame errors or buffer overflows?
esxcli network ip interface list
esxcli vmswitch vds dvportgroup list
esxcli network nic stats get -n vmnicX
The esxcli network nic stats get command reports per-adapter statistics for a named vmnic, including receive and transmit errors, drops and buffer overflows. That directly satisfies the requirement to inspect physical uplink frame errors, which switch-level commands cannot expose.
esxcli hardware pnic list
An administrator notices that vSphere DRS is failing to migrate virtual machines automatically to balance cluster load. Upon checking the cluster configuration, DRS is enabled and set to Fully Automated. What is a likely cause preventing DRS from executing migrations?
Enhanced vMotion Compatibility (EVC) mode is set to a baseline higher than the host CPUs.
Conflicting VM-to-Host or VM-to-VM affinity rules that prevent placement on the targeted balanced hosts.
Affinity rules constrain placement, so a VM-to-Host or VM-to-VM rule can veto the migration DRS would otherwise perform, leaving the cluster unbalanced despite Fully Automated mode. This matches the stem's symptom of enabled DRS without automatic migrations.
HA admission control is disabled in the cluster.
The vCenter inventory service database is missing the DRS license key.
An administrator is using VMware Aria Operations integrated with vSphere Foundation 9.0 to troubleshoot a performance bottleneck. The dashboard highlights a badge score called 'Stress'. What does the Stress badge indicate for a virtual machine?
It represents the hardware temperature and thermal load of the physical host running the VM.
It indicates the extent to which the virtual machine has consumed its allocated resources over time relative to its historical demand and current spikes.
The Stress badge quantifies how heavily a virtual machine has consumed its allocated resources over time, factoring both historical demand and current spikes. This satisfies the scenario's need to identify a performance bottleneck, since sustained high consumption relative to allocation signals contention. It reflects capacity pressure rather than instantaneous utilisation alone.
It calculates the risk of a hardware failure based on S.M.A.R.T. disk errors.
It shows the percentage of CPU ready time caused strictly by host-level overcommitment.
A newly deployed virtual machine is unable to communicate with other VMs on the same vSphere Distributed Switch (vDS), although it shares the same port group. What is the most common misconfiguration to check on the vDS port group settings?
Ensure that NetFlow is enabled on the distributed switch uplinks.
Verify the VLAN ID configured on the distributed port group matches the physical switch trunk configuration for that network.
A VLAN ID mismatch between the distributed port group and the physical switch trunk drops tagged traffic, isolating the VM from peers on the same port group. Verifying VLAN ID alignment directly addresses the stem's same-vDS connectivity failure.
Confirm that Link Aggregation Control Protocol (LACP) is disabled on all host physical adapters.
Check whether the port group is configured with static binding instead of ephemeral binding.
When reviewing vSphere HA settings, an administrator notices that host monitoring is disabled. What is the immediate functional consequence of disabling host monitoring in a vSphere HA cluster?
vSphere DRS is automatically disabled across all cluster nodes.
vSphere HA will not automatically detect host failures or restart virtual machines when a host goes down.
Host monitoring drives the HA agent's heartbeat exchange and network partition detection. With it disabled, ESXi hosts are no longer declared failed, so the master host never triggers the restart of affected virtual machines on surviving hosts, leaving workloads down until manually recovered.
Virtual machine guest operating systems will experience unresponsiveness due to lack of VMware Tools heartbeats.
ESXi management agents (sfcb and hostd) will restart every 60 seconds.
An administrator configures a vSphere Distributed Switch (vDS) with NetFlow to monitor traffic patterns. After enabling NetFlow on a port group, no flow records appear in the external collector. What is a common reason for this behavior?
NetFlow is only supported on standard virtual switches, not distributed switches.
NetFlow requires all ESXi hosts in the cluster to be rebooted before flow generation begins.
Virtual machines must have VMware Tools uninstalled to enable NetFlow packet inspection.
The NetFlow collector IP address or UDP collector port is incorrectly configured on the vDS settings, or the sampling rate is set improperly.
NetFlow exports flow records to the collector address and UDP port defined in the vDS settings; a wrong IP, port or sampling rate means records never reach the external collector. This directly explains the absent flow records described in the stem.
Want more Troubleshoot And Optimize practice?
Practice this domainThe vendor does not publish an exact question count for the VCP-VVF. Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Vmware Vsphere Foundation Fundamentals, Deploy Configure And Operate Vvf, IT Architectures Technologies Standards, Troubleshoot And Optimize. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official VMware VCP-VVF exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.