VCP-VVF Practice Test 16 — 15 Questions

Question 1

An administrator is configuring certificate management for a vSphere Foundation 9.0 environment. They want to replace the machine SSL certificate of an ESXi host using custom certificates issued by an enterprise Microsoft Certificate Authority. Which tool or interface can be used to generate the CSR and install the custom certificate on an ESXi host?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The vSphere Client under Host > Configure > Security > Certificates, or via esxcli. ESXi host certificates can be managed directly through the vSphere Client under Host > Configure > Certificate, or via PowerCLI / esxcli commands.

Answer

The vSphere Certificate Manager command-line utility on vCenter Server

Answer

VMware Aria Operations Administration > Certificates menu

Answer

The vCenter Appliance Management Interface (VAMI) under the Host Certificates tab

Question 2

An administrator is configuring vSphere Trust Authority (vTA) in a VVF environment. Which THREE components are essential architectural elements of vSphere Trust Authority? (Choose three.)

Accepted Answer

Attestation Service (validates host integrity state before releasing keys). vSphere Trust Authority consists of Attestation Service, Key Provider, and Trusted Hosts (Trust Authority Hosts).

Answer

vRealize Log Insight forwarding daemon

Answer

Cloud Builder Orchestration Engine

Question 3

An administrator observes that log forwarding to a centralized server is not working. Where should they check the log settings in the vCenter Server Appliance?

Accepted Answer

Port 5480 > Administration > Syslog. The vCenter Server Appliance Management Interface (VAMI) is the correct place to configure remote logging.

Answer

SSH > /etc/syslog.conf

Answer

vSphere Client > Configure > Logging

Answer

vSphere Client > Administration > Log Browsing

Question 4

An administrator is troubleshooting certificate management and security hardening across a VVF deployment. Which THREE practices should be followed when replacing default certificates with custom CA-signed certificates? (Choose three.)

Accepted Answer

Ensure the complete CA certificate chain (including root and intermediate CAs) is imported into the appropriate trust store.. Custom certificate replacements require ensuring complete CA chains are trusted, generating valid CSRs with correct certool parameters, and updating all dependant solution users.

Answer

Use Cloud Builder to automatically push custom certificates to running production VMs.

Answer

Disable all vCenter security firewall rules during the certificate replacement process.

Question 5

Which vSphere feature ensures that virtual machines are automatically restarted on a remaining host if a host fails?

Accepted Answer

vSphere HA. vSphere HA monitors host health and restarts VMs if a failure is detected.

Answer

vSphere DRS

Answer

vMotion

Answer

Fault Tolerance

Question 6

An administrator is managing cluster updates using vSphere Lifecycle Manager (vLCM) in vSphere Foundation 9.0. Which TWO actions can vLCM perform during cluster image remediation? (Choose two)

Accepted Answer

Install missing software components, drivers, and vendor addons specified in the cluster image.. vLCM remediates clusters by checking compliance against images, installing missing components, updating firmware via vendor addons, and putting hosts into maintenance mode.

Answer

Directly repartition the local ESXi datastore filesystems to increase VMFS capacity.

Answer

Downgrade the vCenter Server Appliance operating system version.

Answer

Automatically upgrade the underlying physical server BIOS without vendor firmware addons.

Question 7

An administrator needs to renew an expiring CA-signed SSL certificate on vCenter Server 9.0 using the vSphere Certificate Manager utility. Which option within the utility automates the generation of certificate signing requests (CSRs) and replaces all certificates?

Accepted Answer

Option 1: Replace VMCA root certificate with custom CA certificate and replace all certificates. The vSphere Certificate Manager utility (accessible via SSH on vCenter) provides a menu-driven interface. Option 1 or Option 2 typically handles generating CSRs and replacing VMCA-signed certificates with custom CA-signed certificates.

Answer

Option 5: Publish all current machine SSL certificates to the active directory trust store

Answer

Option 3: Reset all certificates to default VMware Certificate Authority (VMCA) certificates

Answer

Option 8: Export existing private keys and certificates for offline backup

Question 8

An administrator needs to apply a license key to a new vSphere Foundation deployment. Where should this task be performed in the vSphere Client?

Accepted Answer

Administration > Licensing > Licenses. Licensing in vSphere Foundation is managed globally through the vCenter Server Administration menu.

Answer

Global Inventory Lists > vCenter Servers > Licensing

Answer

Host and Clusters > Configure > Licensing

Answer

Workload Management > Licensing

Question 9

An administrator is managing user permissions in vSphere Foundation 9.0. Which TWO practices are recommended when assigning roles and permissions? (Choose two)

Accepted Answer

Assign permissions to Active Directory/OpenID groups rather than individual user accounts.. Best practices for RBAC include assigning permissions to Active Directory groups rather than individual users, and assigning roles at the highest appropriate inventory level to minimize management overhead.

Answer

Assign permissions to individual users at the virtual machine level for every single VM.

Answer

Modify the built-in Administrator role directly to add custom security auditing privileges.

Answer

Grant all developers the global Administrator role to ensure zero operational friction.

Question 10

An administrator is utilizing vSphere Lifecycle Manager (vLCM) in vSphere Foundation 9.0 to manage ESXi host updates across a cluster. The cluster is configured with a single software image. The administrator attempts to remediate the cluster, but pre-checks report that a third-party ESXi IOVP driver installed on the hosts is not compatible with the target ESXi version. What is the correct procedure to remediate this issue?

Accepted Answer

Update the vLCM cluster image specification to include a compatible vendor add-on or updated component version that supports the target ESXi release.. When using vLCM image-based management, all components (ESXi base image, vendor add-ons, and firmware/drivers) must be compatible. Incompatible drivers must be updated or removed via the vLCM image specification before remediation.

Answer

Bypass the vLCM pre-check by enabling override mode in the vSphere Client advanced settings.

Answer

Revert the cluster to a manual baseline configuration and disable vSphere Lifecycle Manager.

Answer

Uninstall the third-party driver manually using ESXCLI on each host, then perform an upgrade using legacy Update Manager baselines.

Question 11

An administrator is auditing identity and access management in a vSphere Foundation 9.0 environment. Which THREE authentication or identity sources are natively supported for integration with vCenter Single Sign-On (vCenter SSO)? (Choose three)

Accepted Answer

OpenLDAP directory services. vCenter SSO natively supports Active Directory, OpenID Connect (OIDC) identity providers, and LDAP/LDAPS directories as identity sources.

Answer

Local operating system user accounts on each individual ESXi host

Answer

Proprietary relational database tables accessed via direct SQL queries

Question 12

An administrator is auditing access control in a vSphere Foundation 9.0 environment. A specific security team member needs read-only access to all vSphere objects, but must be restricted from viewing sensitive virtual machine guest OS metrics and console data. How should the administrator accomplish this?

Accepted Answer

Create a custom role with specific privileges removed, and assign it to the user at the appropriate inventory object level.. Permissions in vCenter Server are assigned by combining an inventory object, a role containing specific privileges, and a principal (user/group). To restrict console and sensitive data, the administrator must clone the Read-Only role, remove privileges such as Virtual Machine > Interaction > Console interaction and Guest operations, and assign it to the user.

Answer

Assign the built-in Read-Only role at the vCenter root level and use advanced settings to hide guest metrics.

Answer

Assign the Administrator role and rely on Active Directory group policy objects to restrict guest OS access.

Answer

Modify the global permissions table in the Platform Services Controller database to filter out VM console privileges.

Question 13

An administrator is configuring dashboards in VMware Aria Operations for vSphere Foundation. Which TWO widget types are commonly used to display metric trends over time? (Choose two)

Accepted Answer

Area Chart / Line Chart widgets (or Metric Chart configured for lines). Trend data over time is best displayed using chart widgets such as Metric Chart or Super Metric charts.

Answer

Scoreboard widget

Answer

Temperature Map widget

Answer

Topology widget

Question 14

An administrator needs to configure alarm actions in vCenter Server 9.0 so that when a virtual machine experiences high CPU utilization (>90% for 15 minutes), an email notification is sent and a script is automatically executed on a management server. Where must the administrator configure this alarm?

Accepted Answer

Select the vCenter Server or VM in the inventory, navigate to Configure > Alarm Definitions, create a new alarm, and define actions under the Actions tab.. Custom alarms and their associated actions (such as sending emails or running scripts) are configured on the specific inventory object or at the vCenter root under Configure > Alarm Definitions.

Answer

Open vCenter Server > Administration > Advanced Settings and modify the alarm.action.script parameters.

Answer

Navigate to vRealize Log Insight (Aria Operations for Logs) and create a webhook alert for CPU metrics.

Answer

Configure an alert rule inside the vSphere Lifecycle Manager settings panel.

Question 15

An administrator is configuring automated alerting in vSphere Foundation 9.0 when a datastore reaches 85% capacity utilization. After setting up the alarm, test simulations do not trigger the email notification. Upon checking the vCenter event logs, no corresponding event was generated. What is the most likely root cause?

Accepted Answer

The vCenter Server statistics collection level for storage metrics is set too low (e.g., Level 1), preventing the collection of detailed datastore usage metrics.. Storage alarms rely on Storage DRS or datastore polling intervals. If datastore capacity alarms are not enabled or if the statistic collection level for storage is set too low in vCenter Server settings, metrics and corresponding events are not generated.

Answer

Datastore capacity alarms can only be triggered by Aria Operations, not native vCenter alarm definitions.

Answer

SMTP settings must be configured directly within each ESXi host's advanced configuration parameters.

Answer

The ESXi firewall is blocking outgoing SMTP traffic on port 25 from the vCenter management interface.