VCP-VVF Practice Test 22 — 15 Questions

Question 1

An infrastructure architect is designing a secure vSphere Foundation 9.0 environment and needs to enforce a strict zero-trust posture for ESXi host shells. Which standard configuration should be applied to ESXi local and remote shells?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable ESXi Shell (TSM) and SSH (TSM-SSH) services by default, enabling them only temporarily during active troubleshooting.. Best practice security hardening dictates that SSH (TSM-SSH) and the ESXi Shell (TSM) should be disabled when not actively in use, and idle timeout intervals should be enforced.

Answer

Configure SSH to permit root login using unencrypted password authentication over the public internet.

Answer

Replace the ESXi shell binary with an unauthenticated Telnet daemon.

Answer

Grant permanent shell access to all domain user accounts.

Question 2

An administrator is planning the storage architecture for ESXi boot devices in a vSphere Foundation 9.0 cluster. According to modern design standards, which boot option is recommended for enterprise reliability and supportability?

Accepted Answer

Mirrored M.2 NVMe or SATA SSD devices (such as Dell BOSS cards or equivalent hardware RAID 1).. SD cards and USB drives have deprecated support or face reliability concerns; enterprise M.2 NVMe drives or BOSS cards (Boot Optimized Storage Solution) are the modern standard.

Answer

Network booting via PXE without any local storage media on the host.

Answer

Single unpartitioned USB flash drives plugged directly into internal motherboard ports.

Answer

Unprotected mechanical 2.5-inch SAS hard disk drives.

Question 3

A Supervisor cluster is showing a 'Degraded' status in the Workload Management dashboard. Which service should you inspect first to troubleshoot the control plane status?

Accepted Answer

vmware-wcp. The 'vmware-wcp' service is responsible for the Workload Control Plane and its health is directly related to Supervisor status.

Answer

vsan-health

Answer

eam

Answer

vpxd

Question 4

An administrator is tasked with updating the ESXi hypervisor version and driver firmware across a cluster of 16 hosts uniformly. Which native tool in vSphere Foundation should be utilized to create a unified image-based baseline for cluster compliance and remediation?

Accepted Answer

vSphere Lifecycle Manager (vLCM). vSphere Lifecycle Manager (vLCM) is the native tool in vSphere Foundation (and vSphere 7+) that uses desired-state image-based baselines to manage ESXi hypervisor and firmware/driver versions uniformly across a cluster. It replaces the legacy VUM approach by allowing a single image to define the exact ESXi version, firmware add-ons, and drivers, then remediates all hosts in the cluster to match that image.

Answer

VMware Update Manager (VUM) legacy client

Answer

VMware Aria Operations for Networks

Answer

vRealize Automation orchestrator workflows

Question 5

An administrator needs to check the current build number and update version of an ESXi 9.0 host. Where can the administrator easily view this information in the vSphere Client?

Accepted Answer

Select the ESXi host in the inventory and view the Summary tab.. ESXi host version and build numbers are displayed on the host's Summary tab in the vSphere Client.

Answer

Navigate to vSphere HA -> Cluster Summary.

Answer

Check the virtual machine guest operating system properties.

Answer

Open vCenter Administration -> License Management.

Question 6

Which administrative role in vSphere has the most privileges by default?

Accepted Answer

Administrator. The Administrator role has full access to all objects and settings.

Answer

Resource Pool Administrator

Answer

No Cryptographic Administrator

Answer

Read Only

Question 7

An administrator is configuring a new vSphere Foundation cluster and needs to enable Workload Management. What is the prerequisite for the storage policy used by the Supervisor cluster?

Accepted Answer

The storage policy must be associated with a compatible datastore (e.g., vSAN).. The Supervisor control plane needs a storage policy to ensure that its internal components are placed on supported datastores, typically vSAN.

Answer

The storage policy must be a standard VMFS policy.

Answer

The storage policy must be applied to all existing VMs in the cluster.

Answer

The storage policy must be defined with tags.

Question 8

An enterprise environment using vSphere Foundation requires strict regulatory compliance. Which THREE features can be leveraged to secure virtual machines and data at rest or in transit? (Choose three.)

Accepted Answer

Encrypted vMotion to secure virtual machine data in transit during migration. Option B (Encrypted vMotion) is correct because it encrypts the VM's memory and state data as it travels over the network during a live migration, protecting data in transit against interception. Option C (UEFI Secure Boot for VMs) is correct because it validates the boot loader and kernel signatures against trusted certificates, preventing unauthorized or tampered boot loaders from executing at VM startup. Option E (VM Encryption) is correct because it uses the vSphere encryption framework with a KMS to encrypt VM files, disks, and memory state at rest, satisfying data-at-rest protection requirements. Option A is incorrect because Fault Tolerance provides continuous availability via a secondary shadow VM, not encryption, and it does not encrypt physical NICs. Option D is incorrect because Storage DRS anti-affinity rules control placement of VMs across datastores for availability/performance, not encryption of storage pools.

Answer

Fault Tolerance dual-shadow replication to encrypt physical network cards

Answer

Storage DRS anti-affinity rules to encrypt storage pools

Question 9

An administrator is configuring vSphere HA admission control in a cluster using the 'Percentage of cluster resources reserved' policy. The cluster has 4 hosts with identical capacity, and the administrator sets the failure tolerance to 1 host (FTT = 1). What percentage should the administrator configure for CPU and memory reserves?

Accepted Answer

25 percent. With 4 hosts and a failure tolerance of 1 host, the cluster must reserve resources equivalent to one host's capacity to handle a single host failure. Since all hosts are identical, reserving 1 out of 4 hosts means 25% of cluster resources must be reserved for CPU and memory. This ensures that if one host fails, the remaining three hosts have enough capacity to run all VMs.

Answer

100 percent

Answer

50 percent

Answer

20 percent

Question 10

When utilizing vSphere Lifecycle Manager (vLCM) to manage a cluster, which THREE tasks can be performed to maintain ESXi hosts?

Accepted Answer

Managing firmware updates via integration with hardware support managers. Option A is correct because vLCM integrates with hardware support managers (HSMs) from vendors such as Dell, HPE, and Lenovo to manage firmware updates for ESXi hosts in the cluster, ensuring firmware compliance alongside software. Option C is correct because vLCM supports installing vendor-provided hardware support packages, known as add-ons, which extend the base ESXi image with vendor-specific drivers and components. Option E is correct because the core function of vLCM is to apply a desired image (a single ESXi base image plus components and add-ons) to all hosts in the cluster, ensuring consistent and declarative host state. Option B is incorrect because deploying virtual machines is a workload operation handled by vCenter/ESXi, not a host lifecycle maintenance task of vLCM. Option D is incorrect because manually configuring Distributed Switch uplinks is a networking configuration task, not part of vLCM's image and firmware management capabilities.

Answer

Deploying virtual machines to the cluster

Answer

Configuring Distributed Switch uplinks manually

Question 11

An administrator is configuring vCenter Server Identity Provider settings in vSphere Foundation 9.0. They receive an error stating that the metadata XML file provided by the external IdP cannot be parsed. What is the most likely cause?

Accepted Answer

The IdP metadata XML contains malformed XML syntax or an unsupported SAML schema declaration.. The error explicitly states the metadata XML file cannot be parsed, which points to a problem with the file's content itself. SAML IdP metadata must be well-formed XML that conforms to the SAML 2.0 metadata schema; malformed syntax (unclosed tags, invalid characters) or an unsupported schema/namespace declaration will cause vCenter's parser to reject it immediately. Disk space, ESXi build version, and NTP offset would produce different symptoms (storage alerts, compatibility errors, or signature/timestamp validation failures), not an XML parse error.

Answer

The vCenter Server has insufficient disk space in the root partition.

Answer

The ESXi hosts are running an outdated build of vSphere 8.0.

Answer

The NTP time synchronization offset between vCenter and the IdP exceeds 3 seconds.

Question 12

An administrator is troubleshooting a storage connectivity failure on an ESXi host utilizing software iSCSI. Which THREE configurations or troubleshooting steps are required to ensure correct iSCSI multipathing and connectivity? (Choose three.)

Accepted Answer

Ensure that physical switch ports and ESXi uplinks support multipathing and that no firewall rules block iSCSI TCP port 3260.. Option B is correct because software iSCSI multipathing depends on the physical network fabric: the physical switch ports and ESXi uplinks must be able to carry multiple paths, and the ESXi firewall must permit the iSCSI traffic on TCP port 3260, which is the standard iSCSI target port. Option D is correct because with the software iSCSI adapter, VMkernel port binding must be explicitly configured so that each dedicated IP storage VMkernel adapter is bound to the software iSCSI adapter; without correct binding, multipathing and path failover will not work properly. Option E is correct because the iSCSI initiator must have valid target addresses configured through dynamic or static discovery, and those target IPs must be reachable from the host, typically verified with ping or vmkping from the correct VMkernel interface. Option A is not relevant because EVC is a vSphere/VM feature for CPU compatibility during vMotion, not an iSCSI target array setting. Option C is incorrect because iSCSI datastores use the VMFS filesystem, not FAT32, and FAT32 is not a supported VMFS datastore format.

Answer

Configure Enhanced vMotion Compatibility (EVC) on the iSCSI target array.

Answer

Ensure that all iSCSI datastores are formatted with FAT32 to maximize block allocation speed.

Question 13

An administrator needs to collect log files from an ESXi 9.0 host to attach to a support ticket with VMware Global Support Services. What is the standard procedure to generate and download this collection using the vSphere Client?

Accepted Answer

Right-click the ESXi host in the vSphere Client inventory, select 'Export System Logs' (Generate Support Bundle), and download the resulting archive.. Generating a support bundle from the ESXi host or vCenter Server right-click menu creates a compressed archive containing all essential host logs, configuration files, and diagnostic outputs.

Answer

Navigate to vCenter Administration -> License Management and click 'Export Support Bundle'.

Answer

Run 'esxcli system logs export' via the host console.

Answer

Open the VM settings for the host and select 'Download Core Dump'.

Question 14

When troubleshooting certificate trust issues in VVF, which THREE components might require manual certificate replacement or refreshing?

Accepted Answer

Solution User certificates. In a vSphere (VVF) environment, certificate trust issues commonly involve the Solution User certificates (option C), which are used by services such as vCenter Single Sign-On, vSphere Client, and other management components for authentication and must be replaced or refreshed if they expire or become untrusted. The Machine SSL certificate (option D) secures communication between vCenter Server and its clients/ESXi hosts, and replacing or refreshing it is a standard remediation when trust breaks. The STS signing certificate (option E) is used by the Security Token Service to sign SAML tokens; if it is expired or untrusted, authentication fails and it must be replaced or refreshed. Option A (vSphere Client browser cache) is not a certificate component and clearing it does not replace or refresh certificates, and option B (ESXi Host hardware BIOS password) is unrelated to certificate trust and is a hardware/firmware credential, not a certificate.

Answer

vSphere Client browser cache

Answer

ESXi Host hardware BIOS password

Question 15

An administrator is configuring a new vSphere Distributed Switch (VDS) in a VVF environment and wants to ensure that network traffic for vSphere vMotion is isolated from other traffic types. Which VDS feature should be utilized?

Accepted Answer

Create a dedicated Distributed Port Group configured on a separate VLAN ID specifically for vMotion traffic.. To isolate vMotion traffic on a vSphere Distributed Switch, the administrator should create a dedicated distributed port group with its own VLAN ID and assign the vMotion VMkernel adapter to that port group. This separates vMotion traffic at Layer 2 from management, vSAN, and VM traffic, which is the standard best practice for traffic isolation. The other options either do not isolate vMotion or address unrelated features.

Answer

Enable Private VLANs (PVLANs) on the physical switch uplinks only without port groups.

Answer

Configure IPFIX netflow sampling on the default management port group.

Answer

Enable Network I/O Control (NIOC) and set the vMotion share level to Low.