VCP-VVF Practice Test 17 — 15 Questions

Question 1

An administrator is replacing certificates in a vSphere Foundation 9.0 environment and needs to verify the status of the VMware Certificate Authority (VMCA). Which CLI command executed via SSH on the vCenter Server Appliance checks the VMCA service status?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

service-control --status vmware-vmca. vCenter services are managed using the service-control command-line utility. Checking VMCA status involves querying the vmware-stssvc or vmca services using service-control.

Answer

certool --query-status

Answer

vpxd -check-vmca-status

Answer

esxcli vmca status get

Question 2

An administrator is configuring log forwarding from vSphere Foundation 9.0 ESXi hosts to a centralized SIEM system. The requirement is to ensure all security audit logs and authentication events are securely transmitted over TLS. Which configuration utility and protocol setting must be applied?

Accepted Answer

Configure the `Syslog.global.logHost` advanced setting on each ESXi host to specify the remote collector address using the `tls://:` syntax.. ESXi logging is configured via advanced system settings. To forward logs securely over TLS, Syslog.global.logHost must be configured with the appropriate TLS protocol string.

Answer

Configure SNMPv3 trap destinations in vCenter Server inventory under the host's Alert Definitions.

Answer

Deploy an external Log Insight agent virtual appliance and map it using Host Profiles security policies.

Answer

Modify the `/etc/rsyslog.conf` file directly on the ESXi host filesystem and restart the syslog daemon.

Question 3

An administrator needs to check the current license capacity and expiration date for a vSphere Foundation deployment. Which dashboard or tool provides a consolidated view of all software licenses across the SDDC?

Accepted Answer

vCenter Server Administration > Licensing dashboard. License inventory and usage tracking are centrally managed in vCenter Server under Administration > Licensing.

Answer

ESXi host Summary tab under Hardware Details

Answer

vSphere Lifecycle Manager Compliance Overview

Answer

VMware Aria Operations License Usage report widget

Question 4

Which THREE steps are required when configuring identity federation for vSphere with an OIDC provider?

Accepted Answer

Input the Discovery Endpoint URL. Configuring OIDC requires client ID, secret, and discovery endpoints.

Answer

Enable SSL verification

Answer

Assign a global administrator role

Question 5

You are deploying a new Supervisor Cluster in VVF. Which component is required to facilitate communication between the vSphere infrastructure and the Tanzu Kubernetes Grid services?

Accepted Answer

vSphere Distributed Switch. The vSphere Distributed Switch (VDS) is required for the Supervisor to provide network connectivity for the control plane and worker nodes.

Answer

Standard vSwitch

Answer

NSX Edge Node

Answer

vSAN File Service

Question 6

An administrator is troubleshooting a certificate validation error between vCenter Server and an ESXi host in a vSphere Foundation 9.0 cluster. The host shows a status of 'Not Responding' and connection tests reveal that the custom CA certificate installed on vCenter is not trusted by the host's local SSL store. How can the administrator resolve this certificate trust issue without reinstalling the host?

Accepted Answer

Select the disconnected ESXi host in the inventory, navigate to Actions > Certificate > Renew Certificate to push the valid trust chain from vCenter.. When custom certificates are used, the ESXi host must trust the VMCA or custom root CA. The administrator can regenerate or push the correct thumbprint/certificate to the host via the vSphere Client (Actions > Connection > Renew Certificate).

Answer

Run the command `esxcli system settings advanced set -o /Security/TrustSelfSigned -i 1` via SSH.

Answer

Disconnect the host from vCenter, remove it from the inventory, and deploy a new OVA of the host.

Answer

Log in to the ESXi Direct Console User Interface (DCUI), select Reset System Configuration, and reboot.

Question 7

An administrator is preparing to deploy the Supervisor cluster within a vSphere cluster for VVF Workload Management. Which TWO prerequisites must be met prior to initiating the Supervisor configuration wizard? (Choose two.)

Accepted Answer

The underlying cluster must be configured with a vSphere Distributed Switch (vDS).. Supervisor requires a vSphere Distributed Switch (vDS) and a content library containing the required Kubernetes OVA templates.

Answer

Storage policies must be disabled across all datastores in the cluster.

Answer

NSX must be uninstalled from all transport nodes in the cluster.

Answer

The ESXi hosts must be licensed with vSphere Standard edition only.

Question 8

An administrator is configuring vSphere Trust Authority (vTA) within a vSphere Foundation 9.0 environment to protect encrypted virtual machines. Which THREE components are required to successfully deploy and operate vSphere Trust Authority? (Choose three.)

Accepted Answer

Attestation Service (to verify the hardware and software integrity of ESXi hosts). vSphere Trust Authority requires a trusted cluster (running the encrypted workloads), a primary key provider or KMIP-compliant external key manager, and a dedicated attestation service architecture.

Answer

VMware Cloud Foundation SDDC Manager appliance for automated key rotation

Answer

An external Microsoft Active Directory Certificate Authority for issuing ESXi TPM quotes

Question 9

An administrator needs to configure an automated alert in VCF Operations that triggers whenever a virtual machine experiences high memory pressure (ballooning or swapping). Where are symptom definitions and alert thresholds customized in VCF Operations?

Accepted Answer

Administration -> Policies -> Policy Library -> Edit active Policy -> Symptom Definitions.. Symptom definitions and alert thresholds in VCF Operations are managed within Policies under Administration -> Policies.

Answer

vCenter Server -> Alarms -> Custom Alarms -> Memory Pressure.

Answer

SDDC Manager -> Monitoring -> Alert Policies.

Answer

NSX Manager -> System -> Fabric -> Alarms.

Question 10

An administrator needs to verify the health status and cluster state of NSX Manager nodes in a VVF deployment. Where in the NSX Manager UI is this information located?

Accepted Answer

System -> Fabric -> Nodes -> NSX Managers (or Cluster Management).. NSX Manager cluster node health, status, and appliance metrics are viewed under System -> Fabric -> Nodes or System -> Appliances / Cluster.

Answer

vCenter -> Monitor -> NSX Cluster Health.

Answer

SDDC Manager -> Infrastructure -> NSX Health.

Answer

Cloud Builder -> Appliance Status.

Question 11

An administrator is configuring certificate replacement for NSX Manager in a VVF environment using the NSX API. They generate a CSR, have it signed by the enterprise CA, and import it using the API. However, NSX services fail to trust the new certificate. What step was likely omitted during the import process?

Accepted Answer

Importing the intermediate and root CA certificates into the NSX Trust Store and assigning the certificate to the API/NODE service.. When importing a signed certificate into NSX Manager via API or UI, the administrator must ensure that the corresponding private key was included or properly paired, and that the chain includes the intermediate and root CA certificates imported into the NSX trust store.

Answer

Updating the NSX Manager DNS pointer record in Active Directory.

Answer

Restarting the vCenter inventory service to push the trust bundle to NSX.

Answer

Running the certificate-manager utility on the ESXi host command line.

Question 12

An administrator is troubleshooting a failure during an automated VVF cluster expansion in SDDC Manager. The task fails while attempting to configure the new ESXi host's Distributed Switch uplinks. Which log file on SDDC Manager should the administrator examine first to diagnose the API payload failure?

Accepted Answer

/var/log/vmware/vcf/sddc-manager/sddc-manager.log. SDDC Manager operations log API calls and workflow executions in /var/log/vmware/vcf/sddc-manager/sddc-manager.log or related service log directories.

Answer

/var/log/vmware/nsx-manager/cluster.log

Answer

/var/log/vmware/loudmouth.log

Answer

/var/log/vmware/vpxd.log

Question 13

An administrator is configuring vSphere HA on a VVF cluster and wants to ensure that critical virtual machines are restarted with higher priority than non-critical virtual machines during a host failure. Where is this configured?

Accepted Answer

Cluster -> Configure -> vSphere Availability -> VM Restart Priority.. vSphere HA VM restart priority is configured under Cluster -> Configure -> vSphere Availability -> VM Restart Priority.

Answer

VCF Operations -> Policies -> High Availability Rules.

Answer

SDDC Manager -> Cluster Settings -> HA Policy.

Answer

Virtual Machine -> Edit Settings -> VM Options -> Boot Options.

Question 14

An administrator is replacing default VMCA-signed certificates with custom Certificate Authority (CA) signed certificates on a vCenter 9.0 instance using the vSphere Certificate Manager utility. During the process, the utility fails while generating the Certificate Signing Request (CSR). What is the primary cause of this failure?

Accepted Answer

The configuration file (certool.cfg) contains incorrect or missing mandatory parameters.. The certificate manager utility relies on the configuration values defined in the certool.cfg file. Incorrect parameters or special characters in fields such as organization, locality, or country code will cause the CSR generation to fail.

Answer

Port 443 is blocked by a local firewall on the ESXi management vmkernel interface.

Answer

The root CA certificate has expired on the external enterprise CA server.

Answer

The vCenter Appliance Management Interface (VAMI) service is stopped.

Question 15

An administrator is configuring log forwarding from NSX Manager to an external SIEM using secure TLS syslog. The syslog server rejects the connection due to an untrusted certificate presented by NSX. How can the administrator resolve this certificate validation error on NSX Manager?

Accepted Answer

Import the syslog server's CA certificate into the NSX Manager Trust Store via System -> Certificates -> Certificate Authority.. When configuring secure syslog (TLS) on NSX Manager, NSX must trust the syslog server's CA certificate. The administrator must import the syslog server's CA certificate into the NSX Manager trust store.

Answer

Disable TLS verification in the SDDC Manager log forwarding policy settings.

Answer

Run the Certificate Manager utility on the vCenter appliance to push the root CA to NSX.

Answer

Modify the ESXi advanced setting 'Syslog.global.sslTrust' via Host Profiles.