VCP-VVF Practice Test 9 — 10 Questions

Question 1

A security architect is hardening a vSphere Foundation 9.0 environment and needs to restrict access to the ESXi host CIM (Common Information Model) service. Which design practice aligns with modern security hardening standards?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable the CIM server service on ESXi hosts if hardware monitoring is handled out-of-band via IPMI/iLO/iDRAC.. The ESXi CIM service (hostd's CIM broker, often called sfcbd) exposes hardware health data to management tools. If hardware monitoring is handled out-of-band via IPMI, iLO, or iDRAC, the CIM service is redundant and can be disabled to reduce attack surface — aligning with hardening guidance like VMware's Security Configuration Guide and CIS benchmarks. Disabling unnecessary services is a core least-functionality principle.

Answer

Grant CIM access permissions to all authenticated Active Directory users.

Answer

Configure the CIM service to use unencrypted HTTP ports for faster hardware polling.

Answer

Route all CIM traffic through the vCenter Server database layer.

Question 2

An enterprise storage architect is evaluating the use of NVMe over Fabrics (NVMe-oF) with Fibre Channel (FC-NVMe) in a vSphere Foundation 9.0 architecture. What is the primary architectural advantage of FC-NVMe over traditional FCP (Fibre Channel Protocol SCSI)?

Accepted Answer

Support for a vastly increased number of parallel queues and command depths, matching the parallelism of NVMe storage devices.. The primary architectural advantage of FC-NVMe over traditional FCP (SCSI) is its support for a vastly increased number of parallel queues and command depths, which matches the parallelism of NVMe storage devices. This allows for higher IOPS and lower latency, especially for workloads that can benefit from deep queueing, such as databases and real-time analytics.

Answer

Mandatory integration with public cloud AWS S3 object storage buckets.

Answer

Automatic conversion of block storage LUNs into NFS v4.1 file shares at the host bus adapter.

Answer

Elimination of all physical cabling requirements by utilizing wireless optical lasers.

Question 3

An administrator is configuring a new virtual machine in vSphere 9 and needs to attach a persistent raw LUN directly from the storage array. Which disk provisioning type should be selected?

Accepted Answer

Raw Device Mapping (RDM) Physical Mode. A Raw Device Mapping (RDM) in Physical Mode presents the raw LUN directly to the guest OS, allowing the VM to issue SCSI commands straight to the array — required for clustering software (MSCS, Oracle RAC) and array-based snapshots/replication. Thick and Thin VMDK provisioning types create a virtual disk file on a VMFS datastore, not a direct LUN passthrough. Only RDM Physical Mode satisfies the requirement of attaching a persistent raw LUN directly from the storage array.

Answer

Thick Provision Eager Zeroed

Answer

Thick Provision Lazy Zeroed

Answer

Thin Provision

Question 4

An administrator is troubleshooting a virtual machine that is failing to migrate via vMotion. Which THREE conditions could cause a vMotion migration to fail validation checks? (Choose three.)

Accepted Answer

The source and destination hosts have incompatible CPU feature sets and EVC is not enabled.. Option C is correct because vMotion requires compatible CPU feature sets between source and destination hosts; if the CPUs differ and Enhanced vMotion Compatibility (EVC) is not enabled to mask incompatible features, the migration validation fails. Option D is correct because the destination ESXi host must have access to the virtual machine's datastore (shared storage) for vMotion to succeed; if the datastore is not mounted or visible on the target host, validation fails. Option E is correct because a CD/ROM drive backed by an ISO on a local datastore that the target host cannot access will cause vMotion validation to fail, since the target host cannot reach that device backing. Option A is incorrect because snapshot age alone (e.g., older than 30 days) is not a vMotion validation condition; snapshots do not inherently block vMotion. Option B is incorrect because a memory limit lower than allocated RAM is a valid configuration and does not cause vMotion validation to fail.

Answer

The virtual machine has snapshot files older than 30 days.

Answer

The virtual machine is configured with a memory limit lower than its allocated RAM.

Question 5

An administrator is configuring log forwarding from vSphere Foundation 9.0 ESXi hosts to a centralized SIEM system. The requirement is to ensure all security audit logs and authentication events are securely transmitted over TLS. Which configuration utility and protocol setting must be applied?

Accepted Answer

Configure the `Syslog.global.logHost` advanced setting on each ESXi host to specify the remote collector address using the `tls://:` syntax.. The correct approach is to set the `Syslog.global.logHost` advanced setting on each ESXi host to the remote collector using the `tls://:` syntax, which directs ESXi's syslog daemon (vmsyslogd) to transmit logs over TLS. This ensures security audit and authentication events are encrypted in transit to the SIEM, meeting the TLS requirement.

Answer

Configure SNMPv3 trap destinations in vCenter Server inventory under the host's Alert Definitions.

Answer

Deploy an external Log Insight agent virtual appliance and map it using Host Profiles security policies.

Answer

Modify the `/etc/rsyslog.conf` file directly on the ESXi host filesystem and restart the syslog daemon.

Question 6

An infrastructure architect is evaluating storage protocols and features for a vSphere Foundation 9.0 environment. Which THREE advanced vSphere storage features rely on VAAI (vStorage APIs for Array Integration)? (Choose three.)

Accepted Answer

Block Zero / Full Copy (accelerated cloning and zeroing operations). VAAI (vStorage APIs for Array Integration) offloads specific storage operations to compliant arrays, and three of its primitive classes are represented here. Option A, Block Zero / Full Copy, is correct because VAAI's Block Zeroing primitive lets the array zero large blocks (e.g., for eager-zeroed thick disks) and its Full Copy primitive lets the array clone extents directly, avoiding host-side data movement. Option B, Thin Provisioning Space Reclamation (UNMAP), is correct because VAAI's UNMAP primitive allows the ESXi host to notify the array that previously used blocks are free so the array can reclaim them for thin-provisioned LUNs. Option C, Hardware-Accelerated Locking (Atomic Test and Set - ATS), is correct because VAAI's ATS primitive replaces SCSI-2 reservations with finer-grained atomic locking on VMFS datastores, reducing lock contention during metadata updates. Option D is not a VAAI feature; iSCSI checksum calculation is handled by the software iSCSI initiator or by NIC/TOE hardware offload, not by VAAI array primitives. Option E is unrelated to VAAI, as guest OS registry defragmentation is an in-guest maintenance task and has nothing to do with array-integrated storage offloads.

Answer

Software iSCSI software-based software checksum calculation

Answer

Guest operating system registry file defragmentation

Question 7

When using vSAN, how does the administrator define the storage performance and availability requirements for specific virtual machines?

Accepted Answer

Virtual Machine Storage Policies. vSAN storage policies are the mechanism that defines per-VM storage requirements such as RAID level (FTT), stripe width, IOPS limits, and object space reservation. Each VM is assigned a policy, and vSAN uses it to place and protect components across the cluster. This is the native, granular way to express performance and availability requirements for individual VMs.

Answer

Datastore Cluster settings

Answer

Host Profile configurations

Answer

vCenter Server resource pools

Question 8

An administrator is troubleshooting a virtual machine network throughput issue on a vSphere Distributed Switch (vDS). The VM has a 10GbE requirement, but throughput tests show it is capped. Upon checking the vDS port group, Traffic Shaping is enabled. What does the Traffic Shaping policy control?

Accepted Answer

It enforces average bandwidth, peak bandwidth, and burst size limits on traffic flowing through the port group.. Traffic Shaping on a vDS port group enforces average bandwidth, peak bandwidth, and burst size limits on traffic flowing through the port group. These three parameters control the rate at which traffic is shaped, capping throughput to the configured values. This explains why a VM with a 10GbE requirement shows capped throughput when Traffic Shaping is enabled with restrictive limits.

Answer

It prioritizes voice and video packets using DSCP tagging.

Answer

It mirrors port traffic to a designated analyzer VM for packet capture.

Answer

It automatically load-balances traffic across physical uplinks using IP hash.

Question 9

An administrator is configuring the Supervisor on a vSphere cluster within a vSphere Foundation 9.0 environment. After enabling workload management, the control plane VMs fail to power on, and the status shows that the primary storage policy assigned to the Supervisor namespace cannot be validated against the datastore clusters. What is the most likely cause and corrective action?

Accepted Answer

Assign a storage policy that is backed by vSAN or an SPM-compliant datastore and ensure the policy tags match the requirements of the control plane nodes.. The most likely cause is that the storage policy assigned to the Supervisor namespace is not compatible with the datastore clusters. The corrective action is to assign a storage policy backed by vSAN or an SPM-compliant datastore and ensure the policy tags match the control plane node requirements. This ensures the control plane VMs can be provisioned.

Answer

Disable DRS on the cluster because Supervisor control plane VMs cannot run on DRS-enabled clusters.

Answer

Convert the target datastore from VMFS to NFS, as Supervisor control planes do not support VMFS datastores.

Answer

Log in to each ESXi host via SSH and manually create VMDK files for the control plane VMs in the datastore root.

Question 10

An administrator needs to configure alarm actions in vCenter Server 9.0 so that when a virtual machine experiences high CPU utilization (>90% for 15 minutes), an email notification is sent and a script is automatically executed on a management server. Where must the administrator configure this alarm?

Accepted Answer

Select the vCenter Server or VM in the inventory, navigate to Configure > Alarm Definitions, create a new alarm, and define actions under the Actions tab.. In vCenter Server, alarm definitions are created and managed at the inventory object level (vCenter, datacenter, cluster, host, or VM) under the Configure tab's Alarm Definitions section, and actions such as sending email or running a script are defined on the Actions tab of that alarm. This is the native, supported location for configuring both the trigger condition (CPU >90% for 15 minutes) and the two required actions.

Answer

Open vCenter Server > Administration > Advanced Settings and modify the alarm.action.script parameters.

Answer

Navigate to vRealize Log Insight (Aria Operations for Logs) and create a webhook alert for CPU metrics.

Answer

Configure an alert rule inside the vSphere Lifecycle Manager settings panel.