VCP-VVF Practice Test 15 — 15 Questions

Question 1

An administrator is troubleshooting a vSphere 9.0 environment where a virtual machine cannot be powered on. The error message states that the VM's configuration file is locked. The administrator confirms that no other vCenter Server or ESXi host is managing this VM. Which command should the administrator run on the ESXi host to identify the process that holds the lock on the VM's .vmx file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

vmkfstools -D /vmfs/volumes/datastore/vm/vm.vmx. When a VM's .vmx file is locked, vmkfstools -D on that file reveals the lock holder's world ID and MAC address. This information helps identify the ESXi host or process holding the lock. Other commands like esxcli vm process list show running VMs but not file locks, and lsof is not available on ESXi. The vmkfstools -D command is the standard method for diagnosing VM file locks.

Answer

esxcli storage filesystem list

Answer

esxcli vm process list

Answer

lsof /vmfs/volumes/datastore/vm/vm.vmx

Question 2

An infrastructure architect is designing a high-security vSphere Foundation 9.0 environment. Which THREE architectural features contribute directly to hardening ESXi hosts and virtual machines against attacks? (Choose three.)

Accepted Answer

Trusted Platform Module (TPM) 2.0 chips providing hardware-root-of-trust measurements.. Option B is correct because TPM 2.0 chips provide a hardware root of trust that stores measurements and keys, enabling features like vSphere Trust Authority and attestation to verify ESXi host integrity against tampering. Option D is correct because UEFI Secure Boot validates the cryptographic signatures of boot loaders and kernel modules during startup, preventing unauthorized or malicious code from loading before ESXi initializes. Option E is correct because vSphere VM Encryption encrypts virtual machine disk files (VMDKs) and other VM files at rest using AES-256 via the VM Encryption Key Provider, so stolen storage cannot be read without the keys. Option A is not correct because Telnet on port 23 transmits credentials and data in cleartext, which weakens rather than hardens management access; SSH or the vSphere Client should be used instead. Option C is not correct because anonymous, unauthenticated FTP access grants unauthorized file transfer capabilities and is a well-known security misconfiguration that should be disabled.

Answer

Unencrypted Telnet management daemons running on port 23.

Answer

Permitting root access via unauthenticated anonymous FTP sessions.

Question 3

An administrator is troubleshooting a vSphere 9.0 environment where a virtual machine cannot be powered on. The error message states that the VM's configuration file is locked. The administrator confirms that no other vCenter Server or ESXi host is managing this VM. Which command should the administrator run on the ESXi host to identify the process that holds the lock on the VM's .vmx file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

%RDY. The correct counter is %RDY, which measures the percentage of time a VM was ready to run but could not be scheduled. It is the primary indicator of CPU ready time and helps determine if the VM is experiencing contention. Monitoring %RDY in esxtop is essential for diagnosing CPU scheduling delays.

Answer

%WAIT

Answer

%CSTP

Answer

%IDLE

Question 4

An administrator is investigating a performance bottleneck in a vSphere Foundation 9.0 environment using VMware Aria Operations. Which THREE metric types or analytical tools should the administrator examine to diagnose capacity and performance issues across compute, storage, and networking? (Choose three.)

Accepted Answer

The 'Troubleshooting' tab and metric correlation charts to compare latency, IOPS, ready time, and packet drops across objects.. Option B is correct because Aria Operations' Troubleshooting tab provides metric correlation charts that let the administrator overlay and compare key performance counters such as latency, IOPS, CPU ready time, and packet drops across related compute, storage, and network objects, which is exactly what is needed to localize a bottleneck. Option C is correct because the Stress and Risk badges are Aria Operations analytics that flag objects currently experiencing resource contention (Stress) and objects trending toward capacity or performance shortfalls (Risk), directly supporting capacity and performance diagnosis. Option E is correct because Capacity Remaining and Time-to-Remaining projections for CPU, memory, and datastores are core Aria Operations capacity analytics that forecast when resources will be exhausted, addressing the capacity side of the investigation. Option A does not belong because guest OS defragmentation scheduling is not an Aria Operations capability and is irrelevant to cross-domain performance analysis. Option D does not belong because Aria Operations has no built-in physical server BIOS flash utility; firmware management is handled by other tools such as vSphere Lifecycle Manager or vendor utilities.

Answer

The automated guest OS defragmentation schedule generator.

Answer

The physical server BIOS flash utility built directly into Aria Operations.

Question 5

An administrator wants to configure custom dashboards and alerts in VMware Aria Operations to monitor specific Key Performance Indicators (KPIs) for critical database virtual machines in a VVF environment. Which THREE actions can the administrator perform within Aria Operations to achieve this? (Choose three.)

Accepted Answer

Build custom alert definitions by combining symptom definitions and assigning them to policies.. Option A is correct because Aria Operations alert definitions are built by combining symptom definitions (or symptom sets) with a defined trigger, then attaching those alert definitions to policies so they apply to the right object groups, such as the critical database VMs. Option C is correct because custom dashboards in Aria Operations are assembled from widgets including metric charts, object lists, and health trees, which let the administrator visualize the specific KPIs of those database VMs. Option E is correct because custom symptom definitions are created from metric conditions and thresholds (for example, CPU demand > 90% sustained over a period), and these symptoms are the building blocks used by the alert definitions in option A. Option B is incorrect because Aria Operations is a monitoring and analytics platform; it does not patch physical server BIOS firmware through dashboard widgets. Option D is incorrect because modifying hardcoded hypervisor source code on the ESXi boot bank is neither supported nor a function of Aria Operations.

Answer

Directly patch the physical server BIOS firmware through Aria Operations dashboard widgets.

Answer

Modify the hardcoded hypervisor source code on the ESXi boot bank.

Question 6

Which interface is used to perform basic operational tasks like host shutdown, management network configuration, and service restarts on an individual ESXi host?

Accepted Answer

Direct Console User Interface (DCUI). The Direct Console User Interface (DCUI) provides direct local access for these fundamental management tasks.

Answer

vSphere Client

Answer

vCenter Management Portal

Answer

ESXi Shell

Question 7

An administrator is troubleshooting certificate management and security hardening across a VVF deployment. Which THREE practices should be followed when replacing default certificates with custom CA-signed certificates? (Choose three.)

Accepted Answer

Ensure the complete CA certificate chain (including root and intermediate CAs) is imported into the appropriate trust store.. Option C is correct because a custom CA-signed certificate is only trusted when the full issuing chain — the root CA plus any intermediate CAs — is present in the relevant trust store (e.g., the VECS TRUSTED_ROOTS store on VCSA nodes), otherwise TLS validation fails even though the leaf certificate itself is valid. Option D is correct because replacing VMCA-issued certificates requires re-issuing solution user certificates and refreshing the VMware Directory Service / Lookup Service so the new signing tokens and certificate data are propagated; otherwise services such as SSO and vCenter services cannot authenticate. Option E is correct because CSR generation via certool depends on certool.cfg, and inaccurate organization, locality, or Common Name (CN) values produce CSRs that the CA signs incorrectly or that fail hostname/identity validation when installed. Option A is wrong because Cloud Builder is used for initial deployment and configuration of VVF/VCF, not for pushing certificates to already-running production VMs. Option B is wrong because disabling vCenter security firewall rules is not part of certificate replacement and would weaken, not harden, the environment.

Answer

Use Cloud Builder to automatically push custom certificates to running production VMs.

Answer

Disable all vCenter security firewall rules during the certificate replacement process.

Question 8

An administrator is deploying a new vSphere Foundation 9.0 cluster and needs to assign licenses. Where in the vSphere Client is the license inventory managed?

Accepted Answer

Administration > Licensing. License inventory in the vSphere Client is managed under Administration > Licensing. This section allows administrators to add, assign, and manage license keys for vCenter, ESXi hosts, and other VMware products. It provides a centralized view of all licenses and their assignments. The other paths do not exist or are not related to licensing.

Answer

Lifecycle Management > Settings > Keys

Answer

Networking > Settings > License Assignment

Answer

Host > Configure > Hardware > Licensing

Question 9

An administrator is managing vSphere Foundation licenses. If the cluster grows beyond the capacity covered by the current VVF license, what happens?

Accepted Answer

The cluster will enter a non-compliant state.. vSphere Foundation licensing is capacity-based; exceeding CPU count requires additional license purchase to maintain compliance, though the system will not immediately shut down.

Answer

The vCenter service will immediately shut down.

Answer

The host will lose network connectivity.

Answer

Virtual machines will be suspended.

Question 10

An enterprise architect is planning the network architecture for a vSphere Foundation 9.0 cluster running vSAN. Which THREE network design practices are recommended for vSAN VMkernel adapters? (Choose three.)

Accepted Answer

Configure dedicated physical NIC uplinks or use Network I/O Control (NIOC) to prioritize vSAN bandwidth.. Option A is correct because vSAN traffic is latency- and bandwidth-sensitive, so VMware recommends either dedicating physical NIC uplinks to the vSAN VMkernel adapter or using Network I/O Control (NIOC) with a vSAN traffic share to guarantee and prioritize storage bandwidth over shared uplinks. Option C is correct because isolating vSAN traffic on its own VLAN or separate physical segment prevents contention and interference from other traffic types (vMotion, management, VM traffic) and improves both performance and security. Option E is correct because enabling Jumbo Frames (MTU 9000) consistently on the vSAN VMkernel adapters, vSwitches/vDS, and the entire physical switch path reduces per-packet overhead and CPU cost, improving vSAN throughput. Option B is wrong because vSAN storage traffic must remain on a trusted, low-latency internal network, never routed through public unencrypted internet gateways. Option D is wrong because disabling TCP checksum offloading on all physical NICs is not a vSAN design recommendation and would generally degrade performance rather than improve it.

Answer

Route all vSAN storage traffic through public unencrypted internet gateways.

Answer

Disable TCP checksum offloading on all ESXi host physical network adapters.

Question 11

An administrator is configuring vSphere Trust Authority (vTA) in a VVF environment. Which THREE components are essential architectural elements of vSphere Trust Authority? (Choose three.)

Accepted Answer

Attestation Service (validates host integrity state before releasing keys). The vSphere Trust Authority (vTA) architecture is built around three core elements. Option B, the Attestation Service, is correct because it is the service that verifies the integrity state of ESXi hosts (via remote attestation) before any encryption keys are released to them. Option C, the Key Provider, is correct because it manages the encryption keys and interfaces with the external KMS and the vTA components to broker key access. Option D, Trust Authority Hosts, is correct because these are dedicated, hardened ESXi hosts that run the Trust Authority components (Attestation Service and Key Provider) in the trusted cluster, separate from the workload cluster. Option A, the vRealize Log Insight forwarding daemon, is not part of the vTA architecture; it is a logging mechanism unrelated to establishing trust or key release. Option E, the Cloud Builder Orchestration Engine, is a VMware Cloud Foundation deployment/automation tool and is not an architectural component of vSphere Trust Authority.

Answer

vRealize Log Insight forwarding daemon

Answer

Cloud Builder Orchestration Engine

Question 12

An administrator is troubleshooting an ESXi host that has suffered a purple diagnostic screen (PSOD). Which THREE steps should the administrator take to analyze the root cause or prepare the data for VMware Support? (Choose three.)

Accepted Answer

Capture the register values, stack trace, and error message displayed on the PSOD screen (or via IPMI/ILO remote console).. Option A is correct because the PSOD screen itself contains the most immediate forensic evidence — the register dump, stack trace, and the specific error/cosmos panic message — which uniquely identifies the failing code path and should be captured via the physical console or an out-of-band IPMI/iLO/iDRAC remote console before rebooting. Option B is correct because PSODs are frequently caused by hardware faults (faulty DIMMs, CPU/machine-check errors) or by buggy/outdated drivers and firmware, so checking hardware health, memory status, and matching the stack signature against VMware KB articles and the HCL is a standard root-cause step. Option C is correct because generating an ESXi support bundle (via the vSphere Client, DCUI, or the vm-support command) preserves vmkernel.log, vobd.log, and core dump/panic summaries that VMware Support requires for deep analysis. Option D is wrong because Storage vMotion cannot run on a host that has crashed with a PSOD — the VMkernel is halted, so no migration operations are possible. Option E is wrong because reformatting VMFS datastores would destroy virtual machine data and is unrelated to PSOD diagnosis; PSODs are not caused by 'corrupted PSOD cache blocks' on datastores.

Answer

Run a Storage vMotion on all virtual machines while the host is in a crashed state.

Answer

Reformat all VMFS datastores on the host to clear corrupted PSOD cache blocks.

Question 13

Which TWO actions must an administrator perform to correctly configure identity and access control for VVF using vCenter Single Sign-On?

Accepted Answer

Configure group-based permissions to manage access within the vSphere inventory. Option A is correct because vCenter Single Sign-On (SSO) governs authorization through group-based permissions assigned on vSphere inventory objects (such as datacenters, clusters, and VVF/vSAN clusters), so configuring group-based permissions is the proper way to manage access within the vSphere inventory. Option B is correct because SSO must be backed by an identity source before domain or external identities can authenticate; joining vCenter Server to an Active Directory domain (or adding an OIDC provider) establishes that identity source so users and groups can be resolved and authorized. Option C is wrong because assigning the Administrator role at the root level to all domain groups grants excessive, unnecessary privileges and violates least-privilege practice. Option D is wrong because manually creating local user accounts for every domain user defeats the purpose of SSO and directory integration, which is centralized identity management. Option E is wrong because the vsphere.local domain is the internal SSO domain and cannot be disabled to force external authentication; external identity sources are added alongside it.

Answer

Assign the 'Administrator' role at the root level to all domain groups

Answer

Manually create individual local user accounts for every domain user

Answer

Disable the vsphere.local domain to force external authentication

Question 14

An administrator is reviewing vSphere alarms and notices that a host has triggered a yellow alarm regarding high memory usage. However, the host has plenty of free physical RAM. What is the likely reason for this alarm?

Accepted Answer

The consumed memory or active memory threshold configured in the alarm definition has been reached, even if unallocated physical RAM remains.. vSphere memory alarms are threshold-based on metrics like consumed memory, active memory, or memory utilization percentage — not on raw free physical RAM. A host can have plenty of unallocated RAM yet still trip a yellow alarm if the configured threshold for consumed or active memory has been crossed.

Answer

The ESXi host physical RAM is failing and must be replaced immediately.

Answer

The vCenter database has exceeded its 250GB storage limit.

Answer

The host CPU cache has overheated.

Question 15

An administrator is reviewing a cluster image compliance failure in vLCM. The error states that a specific VIB included in the vendor add-on has a dependency conflict with an independently installed driver on the ESXi host. How should the administrator remediate this conflict?

Accepted Answer

Remove the conflicting independent VIB from the image specification or update the vendor add-on to a version that resolves the dependency tree.. A vLCM compliance failure caused by a VIB dependency conflict must be resolved by changing the desired-state image: either remove the conflicting independently installed VIB from the image specification or move to a vendor add-on version whose dependency tree is compatible. vLCM remediates hosts to match the image, so the fix is to correct the image content rather than manipulate hosts directly. Once the image is corrected, remediation will bring the host into compliance.

Answer

Upgrade vCenter Server to the next major release to automatically purge conflicting VIBs.

Answer

Disable vLCM image enforcement and revert the cluster to legacy baseline mode via the ESXi command line.

Answer

Manually delete the VIB file from /var/lib/vmware/vlcmlib/ on each ESXi host using SSH.