VCP-VVF Practice Test 27 — 15 Questions

Question 1

An administrator is reviewing vCenter Server 9.0 service health and notices that the vpxd service has failed. What is the primary impact of the vpxd service stopping?

Accepted Answer

All vCenter management operations, inventory visibility, and API requests will fail, although running virtual machines on ESXi hosts will continue to function.. vpxd is the core vCenter Server daemon responsible for managing ESXi hosts, virtual machines, clustering, and client requests. When vpxd stops, vCenter management functionality is lost.

Answer

All running virtual machines across the entire datacenter immediately power off.

Answer

All virtual switch configurations are deleted from the physical network switches.

Answer

vSphere HA immediately triggers a cluster-wide reboot of all physical servers.

Question 2

An administrator is designing a vSphere Foundation 9.0 cluster and configuring vSphere Distributed Switch (VDS) port groups. Which TWO traffic types are commonly assigned to distinct VLAN-backed port groups on a VDS? (Choose two.)

Accepted Answer

VMkernel Management traffic. Option D (VMkernel Management traffic) is correct because management traffic such as host configuration, vCenter communication, and ESXi Shell access is carried by a VMkernel adapter that must be placed on a port group, and best practice is to isolate it on its own VLAN-backed port group for security and traffic separation. Option E (vMotion migration traffic) is correct because vMotion live-migration streams are also carried by dedicated VMkernel adapters, and separating vMotion onto its own VLAN-backed port group prevents migration traffic from competing with management, VM, or storage traffic and allows specific QoS/security policies. The unmarked options A (CMOS clock pulses), B (power supply AC voltage feeds), and C (BIOS POST diagnostic code streams) are all hardware-level physical signals internal to a server, not network traffic types, so they cannot be assigned to a VDS port group.

Answer

Local motherboard CMOS clock pulses

Answer

Physical server power supply AC voltage feeds

Answer

BIOS POST diagnostic code streams

Question 3

An enterprise architect is integrating vSphere Foundation 9.0 with an external hardware security module (HSM) cluster using KMIP. Which architectural standard ensures that vCenter Server securely establishes keys for VM encryption without exposing cleartext credentials?

Accepted Answer

Mutual TLS (mTLS) certificate authentication combined with KMIP-compliant key exchange.. KMIP (Key Management Interoperability Protocol) defines how key management clients like vCenter Server communicate with external key servers such as HSMs. Secure KMIP deployments require mutual TLS (mTLS), where both vCenter and the KMS present certificates, ensuring the channel is authenticated and encrypted so cleartext credentials or key material are never exposed. This is the standard architecture VMware documents for VM encryption with external KMS/HSM.

Answer

IPsec transport mode tunnels terminated on the ESXi management vmkernel interface.

Answer

OAuth 2.0 token exchange via the vCenter Lookup Service.

Answer

LDAP over SSL (LDAPS) binding using shared secret service accounts.

Question 4

An administrator is configuring custom alarms and alert notifications in vSphere Foundation 9.0. Which TWO actions can be configured directly as responses to an alarm trigger in vCenter Server? (Choose two.)

Accepted Answer

Run a command or script on the vCenter Server.. Option C is correct because vCenter alarm actions include the ability to run a command or script on the vCenter Server itself, configured under the alarm's Actions settings. Option D is correct because sending a notification email to specified recipients is one of the built-in alarm actions in vCenter Server, using the configured mail sender settings. These two are standard alarm response actions available when defining an alarm. Option A is incorrect because vSphere Lifecycle Manager re-imaging is not an alarm-triggered action. Option B is incorrect because vCenter HA failover is managed by the vCenter HA cluster itself, not by alarm actions. Option E is incorrect because there is no built-in alarm action to power off all VMs on a cluster immediately.

Answer

Automatically re-image the ESXi host using vSphere Lifecycle Manager.

Answer

Trigger an automatic failover of the vCenter HA cluster nodes.

Answer

Power off all virtual machines on the cluster immediately.

Question 5

An administrator is integrating VMware Aria Operations with vCenter Server in a vSphere Foundation 9.0 environment. After registration, data collection fails for one of the vCenter instances, and the adapter instance status shows 'Down'. What is the first troubleshooting step the administrator should take?

Accepted Answer

Verify network connectivity on port 443 and ensure the vCenter service account credentials used by the adapter are valid and not locked.. When an Aria Operations adapter instance shows 'Down' after registering vCenter, the most common root causes are network reachability to the vCenter endpoint (TCP 443) or invalid/locked service account credentials used by the adapter. Verifying connectivity and credential validity is the standard first step because it isolates the two most frequent failure modes without making any destructive changes. Only after confirming these basics should you investigate adapter logs or re-register the instance.

Answer

Modify the vCenter database connection string to point directly to the Aria Operations analytics node.

Answer

Reboot all ESXi hosts in the managed vCenter inventory simultaneously.

Answer

Uninstall and reinstall the vCenter Server Appliance operating system packages.

Question 6

Which TWO methods are available for adding a host to a vCenter inventory?

Accepted Answer

Using an IP address. Options C and D are correct because vCenter's "Add Host" wizard requires you to specify the target ESXi host by either its IP address (Option C) or its fully qualified domain name (Option D), which vCenter then uses to establish the management connection over port 902/443. Both identifiers resolve to the host's management interface, allowing vCenter to authenticate with root credentials and add the host to the inventory. Option A is wrong because a USB thumb drive serial is not a network-reachable identifier and plays no role in the Add Host workflow. Option B is wrong because a MAC address is a layer-2 hardware identifier that vCenter cannot use to locate and connect to a host's management service. Option E is wrong because a CPU serial number is a hardware inventory attribute, not a routable or resolvable address used for host onboarding.

Answer

Using a USB thumb drive serial

Answer

Using the host's MAC address

Answer

Using the CPU serial number

Question 7

A systems architect is reviewing the hardware compatibility list (HCL) for a vSphere Foundation 9.0 cluster upgrade. The target servers utilize a modern SmartNIC (DPU) architecture. Which architectural benefit does offloading network and storage virtualization tasks to the DPU provide?

Accepted Answer

Reclaiming host CPU cycles by offloading infrastructure tasks such as distributed firewalling, encapsulation, and crypto processing to the DPU hardware.. DPUs (SmartNICs) offload infrastructure functions — distributed firewalling, VXLAN/Geneve encapsulation, IPsec/TLS crypto, and storage I/O processing — from the host CPU to dedicated hardware on the NIC. This reclaims host CPU cycles for tenant workloads, improving density and performance in vSphere Foundation environments.

Answer

Eliminating the requirement for shared external storage arrays by converting the DPU into a vSAN witness node.

Answer

Enabling zero-latency synchronous replication across unlimited geographic distances.

Answer

Automating the physical switch firmware deployment via LLDP integration.

Question 8

An administrator is managing a vSphere 9.0 cluster configured with vSphere High Availability (HA). During a sudden network partition where ESXi management networks are severed between hosts, the isolated hosts cannot reach the primary HA node. If the host isolation response is set to 'Power off and restart VMs', what exact action will the isolated ESXi host take regarding the running virtual machines on that host?

Accepted Answer

It will power off the virtual machines locally, allowing other surviving hosts in the cluster to restart them.. With the host isolation response set to 'Power off and restart VMs', the isolated ESXi host powers off its running VMs locally. The surviving hosts in the cluster, coordinated by the HA master, then restart those VMs according to the cluster's admission control and restart priority settings. This prevents split-brain by ensuring only one instance of each VM runs.

Answer

It will immediately migrate all VMs to a healthy host via vMotion before shutting down.

Answer

It will reboot the ESXi host operating system without affecting the running virtual machines.

Answer

It will pause all virtual machines and wait indefinitely for the management network to recover.

Question 9

An administrator is managing resource allocation in a vSphere Foundation cluster using Resource Pools. Which THREE rules govern how shares, reservations, and limits operate within a Resource Pool hierarchy? (Choose three.)

Accepted Answer

A reservation guarantees that a resource pool receives at least the specified amount of compute power regardless of total contention.. Option B is correct because a reservation is a guaranteed minimum allocation: the pool is assured of receiving at least the specified MHz (CPU) or MB (memory) whenever it has demand, even under heavy contention, provided the parent pool has sufficient unreserved capacity. Option D is correct because shares only matter during contention and set the relative priority/weight used to divide the parent's available resources among sibling resource pools (and VMs), with higher share values receiving proportionally more. Option E is correct because a limit defines a hard ceiling on consumption—the pool and its children cannot exceed that configured maximum, even if more resources are available. Option A is not a valid rule: shares are static configuration values (Low/Normal/High or custom numbers) and do not automatically decrease when VMs are powered off. Option C is false because limits do not override reservations; a reservation is still guaranteed, and effective allocation is bounded by the limit only for consumption above the reservation, not by dropping the reserved amount.

Answer

Resource pool shares automatically scale down when virtual machines inside them are powered off.

Answer

Limits take precedence over reservations, allowing reserved resources to be dropped if limits are set lower.

Question 10

An administrator is performing a virtual machine backup and needs to quiesce the guest operating system. Which TWO technologies or methods can assist in achieving application-consistent snapshots? (Choose two.)

Accepted Answer

Linux file system freezing mechanisms via VMware Tools scripts.. Option A is correct because on Linux guests VMware Tools includes scripts (such as the pre-freeze and post-thaw scripts, and filesystem freeze helpers like vmsync/freeze) that flush and freeze the guest file systems so the snapshot is application-consistent. Option D is correct because on Windows guests VMware Tools uses the Microsoft Volume Shadow Copy Service (VSS) to quiesce applications and the filesystem before the snapshot is taken, producing an application-consistent image. Option B is incorrect because vSphere HA isolation response settings only control how VMs are handled when a host loses management network connectivity, not guest quiescing. Option C is incorrect because Storage I/O Control throttling manages datastore I/O congestion and does not quiesce the guest OS. Option E is incorrect because Enhanced vMotion Compatibility CPU filtering only masks CPU features for vMotion compatibility and has no role in snapshot quiescing.

Answer

vSphere High Availability isolation response settings.

Answer

Storage I/O Control throttling policies.

Answer

Enhanced vMotion Compatibility CPU filtering.

Question 11

An administrator is troubleshooting an issue where an ESXi host cannot communicate with other hosts on a different subnet. The administrator suspects an incorrect default gateway. Which esxcli command can the administrator use to inspect the current IPv4 default gateway configuration on the ESXi host?

Accepted Answer

esxcli network ip route ipv4 list. To view the IPv4 default gateway on an ESXi host, administrators use 'esxcli network ip route ipv4 list' or check the network ip interface config.

Answer

esxcli storage core gateway list

Answer

esxcli network vswitch standard gateway show

Answer

esxcli gateway get

Question 12

An administrator is deploying a Kubernetes cluster using the Supervisor in a vSphere Foundation 9.0 environment. During namespace creation, the administrator needs to grant developer access to a specific Active Directory group. Which step must be performed to associate the AD group with the Supervisor Namespace?

Accepted Answer

Select the Namespace in the vSphere Client, navigate to Configure > Permissions, click Add Permission, and select the AD group with an appropriate developer role.. In vSphere with Tanzu / Supervisor, AD group access to a Supervisor Namespace is granted through the vSphere Client by selecting the Namespace, going to Configure > Permissions, clicking Add Permission, and assigning the AD group an appropriate role (e.g., Owner or a custom developer role). This maps the AD group to Kubernetes RBAC via the Supervisor's identity provider integration. It is the supported, GUI-driven method for namespace-level access.

Answer

Log in to the NSX Manager UI and map the AD group to the Tier-1 router logical switch.

Answer

Add the AD group to the vCenter Server Global Permissions list with Administrator privileges.

Answer

Modify the `kubectl-rbac.yaml` manifest file and apply it using the `kubectl apply` command against the ESXi management IP.

Question 13

An infrastructure architect is designing a vSphere Foundation 9.0 environment and needs to configure advanced network security. Which THREE features are provided by VMware NSX when integrated with vSphere? (Choose three.)

Accepted Answer

Distributed Firewall (DFW) for micro-segmentation. VMware NSX provides distributed firewalling, overlay networking (Geneve), and advanced layer 4-7 load balancing/routing services.

Answer

Automatic physical power outlet rebooting via SNMP

Answer

Hardware RAID controller battery replacement scheduling

Question 14

An administrator is configuring audit logging and log analysis in a VVF environment. Which THREE log categories or files are critical when investigating security events across vCenter, ESXi, and NSX? (Choose three.)

Accepted Answer

NSX Manager audit.log and node-mgmt.log for networking administrative changes and API calls.. Option A is correct because NSX Manager's audit.log records administrative and configuration changes made through the NSX API and UI, while node-mgmt.log captures management-plane and API activity, making both essential for investigating NSX-related security events. Option B is correct because vCenter's vpxd.log tracks vCenter Server service operations and administrative actions, and sso.log records authentication and token events from the Single Sign-On service, which are key for correlating who did what across the vSphere environment. Option D is correct because on each ESXi host, hostd.log captures host daemon and vSphere API activity, while auth.log (or the shell/DCUI logs) records local and remote login attempts, so together they reveal host-level access and daemon events. Option C is not correct because vLCM software repository cache files are used for image/depot caching and lifecycle management, not for auditing security events. Option E is not correct because Cloud Builder's loudmouth.log relates to deployment orchestration and post-deployment heartbeat status, not to ongoing security auditing across vCenter, ESXi, and NSX.

Answer

vLCM software repository cache files on the local ESXi scratch partition.

Answer

Cloud Builder deployment loudmouth.log for post-deployment VM heartbeat status.

Question 15

An administrator needs to manage identity sources. Which TWO of the following identity providers are supported for vCenter Server authentication? (Choose two.)

Accepted Answer

Active Directory over LDAP. Option A (Active Directory over LDAP) is correct because vCenter Server natively supports integrating with Active Directory as an identity source, either via Integrated Windows Authentication (IWA) or over LDAP/LDAPS, allowing AD users and groups to authenticate to vCenter. Option E (OpenID Connect (OIDC) Identity Provider) is correct because vCenter Server supports OIDC as an external identity provider for federated authentication, enabling token-based single sign-on through compliant OIDC providers. Option B (a custom SQL database source) is incorrect because vCenter Server does not use a SQL database as an identity source; databases are used for inventory/configuration data, not authentication. Option C (FTP-based user file) is incorrect because FTP is a file-transfer protocol and is not a supported identity source for vCenter authentication. Option D (Local Windows Workgroup users) is incorrect because vCenter Server does not authenticate against local Windows workgroup accounts; it relies on supported directory or federated identity providers.

Answer

A custom SQL database source

Answer

FTP-based user file

Answer

Local Windows Workgroup users