VCP-VVF Practice Test 23 — 15 Questions

Question 1

An infrastructure architect is designing a multi-site vSphere Foundation 9.0 environment with stretched clusters. Which THREE challenges or requirements must be accounted for in a stretched cluster design? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Redundant, high-bandwidth inter-site ISL (Inter-Switch Links) for vMotion and storage traffic.. Option A is correct because a stretched cluster requires redundant, high-bandwidth inter-site links (ISLs) to carry vMotion, vSAN, and other inter-host traffic between sites while tolerating a single link failure. Option C is correct because the vSAN witness must reside in a third, independent failure domain (a witness site) so it can break ties and maintain quorum if either data site fails, without being affected by a failure common to both. Option D is correct because vSAN stretched clusters enforce strict RTT latency limits between the two data sites—typically no more than 5 ms round-trip—since synchronous writes and metadata operations must complete across sites. Option B is wrong because eliminating all network gateways is neither feasible nor required; gateways are still needed for routing and external connectivity. Option E is wrong because converting VM disks to read-only ISO files is not a stretched-cluster requirement and would make the VMs unusable.

Answer

Complete elimination of all network gateways across the entire enterprise.

Answer

Converting all virtual machine disks into read-only ISO files.

Question 2

An IT architect is planning network security for a vSphere Foundation 9.0 environment. They want to ensure that inter-VM traffic within the same virtual network is inspected and filtered by distributed firewall rules without having to hairpin traffic out to a physical firewall appliance. Which architectural feature should be deployed?

Accepted Answer

NSX Distributed Firewall (DFW). VMware NSX Distributed Firewall (DFW) inspects traffic directly at the vnic level of each virtual machine within the ESXi kernel, enforcing micro-segmentation without physical hairpinning.

Answer

Physical top-of-rack access control lists (ACLs).

Answer

Storage I/O Control traffic shaping rules.

Answer

vCenter Server Appliance software firewall.

Question 3

An administrator is deploying a new vSphere Foundation 9.0 cluster. Which component provides centralized lifecycle management, image-based cluster updates, and compliance monitoring for ESXi hosts?

Accepted Answer

vSphere Lifecycle Manager (vLCM). vSphere Lifecycle Manager (vLCM) provides image-based and baseline-based lifecycle management for ESXi clusters, including firmware and driver validation.

Answer

vRealize Operations / Aria Operations.

Answer

vCenter Server Update Planner.

Answer

VMware Host Client.

Question 4

When configuring identity sources, what is the primary benefit of using LDAPS over LDAP?

Accepted Answer

Encryption of the authentication traffic. LDAPS (LDAP over SSL) provides encryption for sensitive credentials during authentication.

Answer

Prevents domain controller overload

Answer

Allows usage of non-standard ports

Answer

Faster synchronization with Active Directory

Question 5

A cluster is suffering from frequent VM restarts due to host failures. To improve resilience, the team wants to ensure that if a host fails, there is sufficient capacity to restart the affected VMs. What should be configured in the vSphere HA settings?

Accepted Answer

HA Admission Control. vSphere HA Admission Control is the mechanism that reserves a percentage of cluster resources (CPU and memory) specifically to guarantee that VMs can be restarted on surviving hosts after a host failure. By configuring an admission control policy (e.g., 'Percentage of cluster resources reserved' or 'Slot policy'), the administrator ensures sufficient spare capacity exists at all times to meet the restart requirement.

Answer

DRS Affinity Rules

Answer

Proactive HA

Answer

vSphere FT

Question 6

What is the primary function of a 'Host Profile' in vSphere?

Accepted Answer

To standardize host configuration. Host Profiles allow for the standardization of host configurations across a cluster.

Answer

To backup virtual machines

Answer

To patch ESXi hosts

Answer

To monitor hardware sensors

Question 7

An administrator is troubleshooting a failure during an automated VVF cluster expansion in SDDC Manager. The task fails while attempting to configure the new ESXi host's Distributed Switch uplinks. Which log file on SDDC Manager should the administrator examine first to diagnose the API payload failure?

Accepted Answer

/var/log/vmware/vcf/sddc-manager/sddc-manager.log. The SDDC Manager log file /var/log/vmware/vcf/sddc-manager/sddc-manager.log is the primary log for SDDC Manager operations, including cluster expansion tasks and API calls. When a cluster expansion fails during Distributed Switch uplink configuration, this log captures the API payload, error responses, and orchestration details needed to diagnose the failure. It is the first place to look for SDDC Manager orchestrated task failures.

Answer

/var/log/vmware/nsx-manager/cluster.log

Answer

/var/log/vmware/loudmouth.log

Answer

/var/log/vmware/vpxd.log

Question 8

An administrator is utilizing vSphere Lifecycle Manager (vLCM) in vSphere Foundation 9.0 to manage ESXi host updates across a cluster. The cluster is configured with a single software image. The administrator attempts to remediate the cluster, but pre-checks report that a third-party ESXi IOVP driver installed on the hosts is not compatible with the target ESXi version. What is the correct procedure to remediate this issue?

Accepted Answer

Update the vLCM cluster image specification to include a compatible vendor add-on or updated component version that supports the target ESXi release.. vSphere Lifecycle Manager (vLCM) uses a declarative image model where the desired state is defined in a cluster image specification. If a third-party driver is incompatible, the correct procedure is to update the image specification to include a compatible vendor add-on or updated component version that supports the target ESXi release. This ensures the driver is either replaced or updated as part of the remediation, maintaining the desired state.

Answer

Bypass the vLCM pre-check by enabling override mode in the vSphere Client advanced settings.

Answer

Revert the cluster to a manual baseline configuration and disable vSphere Lifecycle Manager.

Answer

Uninstall the third-party driver manually using ESXCLI on each host, then perform an upgrade using legacy Update Manager baselines.

Question 9

An administrator needs to review the history of user logins and administrative tasks performed in vCenter Server over the past 30 days. Which vCenter feature or view provides this audit trail?

Accepted Answer

vCenter -> Monitor -> Tasks and Events.. In vCenter Server, the Monitor tab's Tasks and Events view aggregates recent task history and event logs, including user logins (via event types like UserLoginSessionEvent) and administrative operations. This is the built-in audit trail for vCenter activity and can be filtered by user, time range, and event type. It is the correct place to review the last 30 days of activity.

Answer

Host -> Configure -> Advanced Settings -> Audit.Log.

Answer

SDDC Manager -> Audit -> Activity Log.

Answer

VCF Operations -> Administration -> Access Audit.

Question 10

An administrator is configuring identity federation using Microsoft Entra ID (Azure AD) with vCenter 9.0. During authentication, users receive an OIDC token validation error. Upon checking the vCenter sso log (/var/log/vmware/sso/sso.log), it indicates a clock skew issue between vCenter and the IdP. How should the administrator resolve this?

Accepted Answer

Configure and synchronize Network Time Protocol (NTP) on both the vCenter Server appliance and the external Identity Provider.. Clock skew between vCenter and the external IdP causes OIDC token validation failures because token timestamps (iat, exp, nbf) fall outside the allowed tolerance. The fix is to configure and synchronize NTP on both the vCenter Server appliance and the IdP so their clocks agree.

Answer

Regenerate the vCenter machine SSL certificate using the Certificate Manager utility.

Answer

Modify the sso.properties file on vCenter to increase the token lifetime tolerance to 72 hours.

Answer

Disable OAuth token verification in the advanced vCenter SSO configuration settings.

Question 11

An administrator is managing certificates in a vSphere Foundation 9.0 environment and needs to renew or replace certificates using the certificate management utility. Which THREE certificate types are managed by vSphere Certificate Manager? (Choose three.)

Accepted Answer

VMCA Root Certificate (acting as the internal certificate authority). The vSphere Certificate Manager utility is designed to manage the core certificate infrastructure of vCenter Server, and it explicitly handles three certificate categories. Option B, the VMCA Root Certificate, is correct because VMCA (VMware Certificate Authority) acts as the internal CA that signs all other vSphere certificates, and Certificate Manager provides options to replace it (e.g., with a custom CA-signed root) or regenerate it. Option C, Solution User certificates (such as vpxd, rhttpproxy, and vpxd-extension), is correct because these are issued to vCenter services for authentication and Certificate Manager can renew or replace them individually or in bulk. Option D, the Machine SSL certificate securing HTTPS traffic to vCenter Server, is correct because Certificate Manager offers the option to replace the machine SSL certificate with a custom CA-signed certificate or regenerate it using VMCA. Option A is not managed by vSphere Certificate Manager because Aria Operations collector certificates are handled within the Aria Operations product's own certificate management interface, not vCenter's utility. Option E is also incorrect because ESXi host IPMI/BMC SSL certificates are managed on the ESXi host itself (or via vendor tools) and are outside the scope of vSphere Certificate Manager.

Answer

Aria Operations collector SSL certificate

Answer

ESXi Host Hardware IPMI Management Controller SSL certificate

Question 12

An administrator needs to integrate an external Active Directory identity provider with vCenter Server 9.0 for vSphere Foundation. Which authentication mechanism should be configured to allow users to log in with multi-factor authentication (MFA)?

Accepted Answer

Identity Provider (IdP) federation using OpenID Connect (OIDC) or SAML 2.0.. vCenter Server 9.0 supports external identity provider federation using OIDC or SAML 2.0, which lets vCenter delegate authentication to an enterprise IdP (such as Entra ID, Okta, or ADFS). Because the IdP owns the authentication flow, MFA policies enforced there (push, TOTP, FIDO2) apply to vCenter logins without vCenter needing to implement MFA itself. This is the supported path for MFA with vSphere Foundation.

Answer

Integrated Windows Authentication (IWA) via direct Kerberos ticket exchange.

Answer

Anonymous bind LDAP configuration with certificate-based client pinning.

Answer

Local OS user database synchronization over insecure LDAP ports.

Question 13

An administrator is troubleshooting a virtual machine performance issue where the VM has high CPU ready time and poor application throughput. Which TWO configuration changes can help reduce CPU ready time? (Choose two.)

Accepted Answer

Right-size the virtual machine by decreasing the number of assigned vCPUs if the workload does not utilize them.. CPU ready time measures how long a vCPU was ready to run but had to wait for a physical core, so the fix is to reduce contention for physical CPU resources. Option D is correct because over-provisioning vCPUs inflates ready time: the ESXi scheduler must co-schedule all vCPUs of a VM, so if the workload does not actually use the assigned vCPUs, decreasing the vCPU count reduces scheduling contention and lowers ready time. Option E is correct because vMotion to a less heavily utilized ESXi host moves the VM onto a host with more available physical cores, directly reducing the wait for CPU scheduling and improving throughput. Option A is incorrect because VMFS-6 is a datastore filesystem and formatting the ESXi boot bank has no effect on CPU scheduling. Option B is incorrect because increasing vCPUs to the maximum worsens ready time by adding more vCPUs that must be co-scheduled. Option C is incorrect because software iSCSI multipathing addresses storage path redundancy and performance, not CPU ready time.

Answer

Format the ESXi boot bank with VMFS-6.

Answer

Increase the virtual machine vCPU count to the maximum supported limit.

Answer

Enable software iSCSI multipathing on the virtual machine guest OS.

Question 14

An administrator is designing a multi-cluster vSphere Foundation 9.0 architecture and wants to implement Enhanced vMotion Compatibility (EVC) across clusters containing both Intel Xeon Scalable (Ice Lake) and AMD EPYC (Milan) processors. What is the design limitation regarding EVC in this scenario?

Accepted Answer

Cross-vendor EVC between Intel and AMD physical processors is architecturally unsupported.. Enhanced vMotion Compatibility (EVC) works by masking CPU features so that all hosts in a cluster present a common baseline instruction set to VMs. This masking is only possible within a single CPU vendor family — Intel VT-x/SSE baselines for Intel hosts, AMD-V/SSE baselines for AMD hosts. Because Intel and AMD use fundamentally different instruction set extensions and virtualization implementations, EVC cannot create a common baseline across vendors, making cross-vendor EVC architecturally unsupported.

Answer

Cross-vendor EVC requires vCenter Server to be deployed on a physical Windows Server with hardware virtualization enabled.

Answer

EVC automatically emulates AMD instruction sets on Intel hosts using binary translation vCPUs.

Answer

Cross-vendor EVC is supported as long as the lowest common denominator SSE4 instruction set is enabled in the BIOS.

Question 15

An administrator needs to back up the vCenter Server Appliance configuration in a vSphere Foundation 9.0 deployment. Where is this backup feature accessed and initiated?

Accepted Answer

Access the vCenter Server Appliance Management Interface (VAMI) at port 5480, log in as root, and select Backup to configure scheduled or manual backups.. vCenter Server Appliance native file-based backups are managed through the vCenter Server Appliance Management Interface (VAMI) accessible on port 5480.

Answer

Navigate to Lifecycle Manager in the vSphere Client and create a Backup Baseline.

Answer

Open the vSphere Client, right-click the vCenter root object, and select Export vCenter Appliance Backup.

Answer

Log in to the ESXi host hosting the vCenter VM and run `vim-cmd vcenter/backup`.