VCP-VVF Deploy Configure And Operate Vvf Practice Test 3 — 15 Questions

Question 1

An administrator is configuring role-based access control (RBAC) in a vSphere Foundation 9.0 environment and needs to grant a user permission to manage virtual machines within a specific folder, but inherited permissions from the root vCenter level are granting too many privileges. How should the administrator resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable permission inheritance on the specific folder object or assign the No Access role at that level.. In vSphere RBAC, permissions are inherited down the inventory hierarchy, but an administrator can disable inheritance on a specific object (such as a folder) or assign the 'No Access' role at that level to block inherited privileges. This allows granular control so the user only gets the intended VM management rights within that folder. It is the supported method to override root-level permissions.

Answer

Edit the global vCenter configuration file to block all role inheritance globally.

Answer

Delete the root-level permissions and recreate all user accounts from scratch.

Answer

Move the user account to a separate Active Directory organizational unit without vSphere integration.

Question 2

An administrator needs to configure custom alarms in vSphere 9.0 to monitor datastore latency spikes. The alarm must execute a script on the vCenter Server when latency exceeds 30 milliseconds. Where must the script be placed on the vCenter Server Appliance for vCenter to successfully execute it as an alarm action?

Accepted Answer

/usr/lib/vmware-vpxd/actions/. For vCenter Server alarms that execute a script as an action, the script must be placed in the /usr/lib/vmware-vpxd/actions/ directory on the vCenter Server Appliance. This is the designated location where vpxd looks for executable scripts referenced by custom alarm actions. Placing the script elsewhere will cause the alarm action to fail.

Answer

/storage/vsphere/actions/bin/

Answer

/var/log/vmware/vpxd/actions/

Answer

/etc/vmware/vmware-vpx/custom_scripts/

Question 3

An administrator is configuring vSphere Lifecycle Manager (vLCM) in vSphere Foundation 9.0 to use a local depot mirror in an air-gapped environment. How must the local depot be configured so vLCM can successfully sync updates?

Accepted Answer

Configure the local depot URL under vSphere Lifecycle Manager > Settings > Patch Setup > Add Local Depot Source.. In vSphere Lifecycle Manager, a local depot is configured by adding a local depot source under vSphere Lifecycle Manager > Settings > Patch Setup > Add Local Depot Source, where you provide the URL or file path to the mirrored depot. This is the supported mechanism for air-gapped environments where vLCM cannot reach the internet.

Answer

Deploy an OVF template of the VMware Update Manager Download Service (UMDS) on an ESXi host.

Answer

Mount an NFS datastore containing the depot files to the root directory /var/lib/vmware/vLCM/depot/ on every ESXi host.

Answer

Modify the vCenter global setting vLCM.depot.offlineMode to true and paste the base64 payload into the advanced settings.

Question 4

An administrator is monitoring resource performance in vSphere Foundation 9.0 using vCenter Performance Charts. Which metric type reflects the memory actively being used by a virtual machine, accounting for memory reclamation techniques like ballooning?

Accepted Answer

Active memory. Active memory is the metric that reflects the amount of memory a VM is actively using, as estimated by the ESXi host's memory reclamation algorithms. It accounts for ballooning, compression, and swapping by measuring the working set of guest memory that is actually being touched, making it the best indicator of true memory demand. Ballooned memory, by contrast, only reports the amount reclaimed via ballooning, not the active usage.

Answer

Overhead memory

Answer

Ballooned memory

Answer

Consumable memory

Question 5

An administrator needs to view historical trends of CPU usage across a vSphere Foundation cluster over the last year. Which component provides this long-term historical reporting and analytics capability?

Accepted Answer

VMware Aria Operations historical capacity analytics. VMware Aria Operations provides long-term historical capacity analytics, retaining metrics for extended periods (configurable, often 1+ years) and offering trend analysis, capacity forecasting, and right-sizing recommendations across the vSphere estate. It's the designated component for historical reporting beyond vCenter's built-in retention.

Answer

vSphere Lifecycle Manager compliance reports

Answer

vCenter Server Performance charts with default 1-year retention

Answer

ESXi local log bundles (vm-support)

Question 6

An administrator is reviewing vSphere Foundation 9.0 identity access management and needs to understand where Local OS users are authenticated if they are not using Active Directory. Which built-in service handles local user accounts on vCenter Server?

Accepted Answer

vCenter Single Sign-On (vCenter SSO) with the vsphere.local domain. vCenter Single Sign-On (SSO) with the vsphere.local domain is the built-in identity provider for vCenter Server, and it manages local user accounts (e.g., administrator@vsphere.local) when Active Directory is not used. SSO acts as the authentication broker for all vSphere components, issuing SAML tokens after validating credentials against its internal directory. In vSphere Foundation 9.0, local OS users are stored and authenticated by SSO, not by any external OS-level service.

Answer

SDDC Manager Identity Broker service

Answer

Windows Security Account Manager (SAM)

Answer

ESXi Direct Console User Interface (DCUI) local shadow file

Question 7

An administrator is configuring certificate management for a vSphere Foundation 9.0 environment. They want to replace the machine SSL certificate of an ESXi host using custom certificates issued by an enterprise Microsoft Certificate Authority. Which tool or interface can be used to generate the CSR and install the custom certificate on an ESXi host?

Accepted Answer

The vSphere Client under Host > Configure > Security > Certificates, or via esxcli. The vSphere Client provides a direct interface to generate a Certificate Signing Request (CSR) and install a custom certificate for an ESXi host under Host > Configure > Security > Certificates. Alternatively, the esxcli command-line tool offers equivalent functionality via commands like 'esxcli system security certificates generate-csr' and 'esxcli system security certificates import'. Both methods are officially supported for replacing the machine SSL certificate on standalone ESXi hosts in vSphere Foundation 9.0.

Answer

The vSphere Certificate Manager command-line utility on vCenter Server

Answer

VMware Aria Operations Administration > Certificates menu

Answer

The vCenter Appliance Management Interface (VAMI) under the Host Certificates tab

Question 8

An administrator is deploying a Supervisor cluster in vSphere Foundation 9.0 and needs to ensure that Developer Namespaces are properly isolated. Which construct is used to enforce resource quotas and network policies across multiple developer namespaces?

Accepted Answer

Supervisor Namespace limits and vSphere Storage/Compute Quotas. In vSphere Foundation 9.0, Supervisor Namespaces are the Kubernetes construct that provides isolation for developer workloads, and resource quotas plus network policies are enforced at the namespace level via vSphere Compute/Storage Quotas and NSX-backed network policy. This is the intended mechanism for multi-tenant isolation across developer namespaces on a Supervisor.

Answer

vCenter Server Alarm definition filters

Answer

vSphere Distributed Switch VLAN tagging policies

Answer

ESXi host firewall rules configured via esxcli network firewall

Question 9

An administrator is auditing identity and access management in a vSphere Foundation 9.0 environment. Which THREE authentication or identity sources are natively supported for integration with vCenter Single Sign-On (vCenter SSO)? (Choose three)

Accepted Answer

OpenLDAP directory services. Option E (Active Directory over LDAP, AD-LDAP) is correct because vCenter SSO natively supports adding an Active Directory domain as an identity source using the LDAP protocol, either via integrated Windows authentication or LDAP bind. Option C (OpenLDAP directory services) is correct because vCenter SSO supports generic LDAP-compliant directories, including OpenLDAP, as an identity source when configured with the appropriate bind DN and base DN. Option D (OpenID Connect, OIDC federated identity providers) is correct because vSphere 8.0 and later, including vSphere Foundation 9.0, add native OIDC support in vCenter SSO for federated authentication against external identity providers. Option A is not a supported SSO identity source: local ESXi host user accounts are managed per host for direct host access and are not integrated into vCenter SSO. Option B is not supported: vCenter SSO does not read identity data from proprietary relational database tables via direct SQL queries; supported sources are AD, LDAP, OIDC, and the built-in vsphere.local domain.

Answer

Local operating system user accounts on each individual ESXi host

Answer

Proprietary relational database tables accessed via direct SQL queries

Question 10

An administrator is troubleshooting certificate replacement issues in a vSphere Foundation 9.0 environment using the vSphere Certificate Manager. Which TWO statements regarding VMCA (VMware Certificate Authority) are correct? (Choose two)

Accepted Answer

VMCA can be configured to act as an intermediate CA signed by an enterprise external Certificate Authority.. Option B is correct because VMCA supports being configured as a subordinate/intermediate CA whose signing certificate is issued by an enterprise or third-party external CA, which is the standard supported mode for integrating vSphere certificates with corporate PKI. Option C is correct because VMCA automatically issues and provisions VMCA-signed certificates for vCenter services and for ESXi hosts when they are added to the vCenter inventory, which is the default certificate provisioning behavior. Option A is incorrect because VMCA stores its root private key in its local certificate store (backed by the VMware Endpoint Certificate Store/VECS), and an external HSM is not a requirement. Option D is incorrect because replacing VMCA-issued certificates is performed through the vSphere Certificate Manager and does not require rebooting physical ESXi hosts. Option E is incorrect because VMCA supports both self-signed and custom/external CA-signed certificate modes, so it is not limited to self-signed certificates.

Answer

VMCA requires an external hardware security module (HSM) for storing its root private key.

Answer

Replacing VMCA certificates requires rebooting the physical ESXi hosts in the managed cluster.

Answer

VMCA only supports self-signed certificates and cannot be replaced with custom keys.

Question 11

An administrator is preparing to deploy a Supervisor cluster in a vSphere Foundation 9.0 environment. Which TWO prerequisites must be met prior to enabling Workload Management? (Choose two)

Accepted Answer

Shared storage (such as vSAN or NFS/VMFS) must be available to all hosts in the cluster.. Option C is correct because a Supervisor cluster requires shared storage accessible to every ESXi host in the cluster — typically vSAN, NFS, or VMFS datastores — so that Kubernetes control plane VMs and persistent volumes can be placed and remain highly available across hosts. Option D is correct because enabling Workload Management requires the cluster to be backed by a vSphere Distributed Switch (VDS), which provides the port groups and networking foundation the Supervisor and its Tanzu components rely on. Option A is incorrect because there is no 512 GB per-host RAM minimum for a Supervisor cluster; the actual requirement is far lower (roughly 32 GB per host in typical designs). Option B is incorrect because IPv4 is fully supported and is the default networking protocol; IPv6 is not required to be the sole protocol on vmkernel interfaces. Option E is incorrect because NSX-T is not mandatory for every Supervisor configuration — the vSphere Networking (VDS) option allows a Supervisor to be deployed without NSX.

Answer

All ESXi hosts in the cluster must be configured with a minimum of 512 GB of RAM.

Answer

IPv6 must be the default and sole networking protocol on all vmkernel interfaces.

Answer

NSX-T Data Center must be deployed as a mandatory prerequisite for all Supervisor configurations.

Question 12

An administrator is configuring log forwarding and analysis in a vSphere Foundation 9.0 deployment using VMware Aria Operations for Logs. Which THREE methods can be used to ingest logs from ESXi hosts into Aria Operations for Logs? (Choose three)

Accepted Answer

Installing the Aria Operations for Logs agent directly on the ESXi host.. Option A is correct because the Aria Operations for Logs agent (liagent) can be installed directly on an ESXi host to collect and forward logs to the Log Insight cluster, which is a supported ingestion method for ESXi. Option B is correct because enabling vCenter integration in Aria Operations for Logs uses the vSphere API/CFAPI to automatically pull vCenter and associated ESXi task and event logs into the platform. Option D is correct because ESXi supports native syslog forwarding via the advanced setting Syslog.global.logHost, which can be pointed at the Aria Operations for Logs cluster to send logs over the syslog protocol. Option C is not correct because an NFS datastore used for ESXi core dumps stores diagnostic dump files, not a log ingestion channel into Aria Operations for Logs. Option E is not correct because SNMP traps on port 162 are for SNMP-based alerting/monitoring, not for real-time log parsing and ingestion by Aria Operations for Logs.

Answer

Mapping an NFS datastore share where ESXi writes raw binary core dumps.

Answer

Configuring SNMP trap listeners on port 162 for real-time log parsing.

Question 13

An administrator is configuring dashboards in VMware Aria Operations for vSphere Foundation. Which TWO widget types are commonly used to display metric trends over time? (Choose two)

Accepted Answer

Area Chart / Line Chart widgets (or Metric Chart configured for lines). Option C is correct because Area Chart and Line Chart widgets (including a Metric Chart configured to render lines) are specifically designed to plot one or more metrics against a time axis, making them the standard choice for visualizing metric trends over time in VMware Aria Operations dashboards. Option D is correct because the Metric Chart widget natively graphs selected metrics over a configurable time range, showing how values rise and fall across the selected interval, which is exactly the trend-over-time use case. The unmarked options do not belong: the Scoreboard widget (A) only shows current metric values or scores in a compact numeric/status format without a time series, the Temperature Map widget (B) uses color-coded heat boxes to compare current values across objects rather than plotting trends, and the Topology widget (E) displays relationship and dependency maps between objects, not time-based metric data.

Answer

Scoreboard widget

Answer

Temperature Map widget

Answer

Topology widget

Question 14

An administrator is troubleshooting a failing vCenter Server Appliance backup in vSphere Foundation 9.0. Which TWO backup protocols are natively supported by the vCenter Server Native Backup scheduler in VAMI? (Choose two)

Accepted Answer

SFTP (Secure File Transfer Protocol). The vCenter Server Native Backup scheduler in VAMI (the appliance management interface at port 5480) natively supports two backup protocols: SFTP and HTTPS. Option A (SFTP) is correct because the scheduler can send the backup file to a remote SFTP server using SSH-based secure file transfer, which is the most common target for scheduled appliance backups. Option C (HTTPS) is correct because the scheduler can also upload the backup to an HTTPS endpoint (such as a web server or S3-compatible target) using secure HTTP transport. Option B (SMTP email attachment streaming) is not a backup transport — SMTP is only used for email notifications, not for delivering backup archives. Option D (BLE peer-to-peer streaming) is not a supported protocol for vCenter backups and has no role in VAMI. Option E (Direct USB pass-through from a local ESXi host management port) is not a supported backup method; VAMI backups are file-based transfers over the network, not USB pass-through.

Answer

SMTP email attachment streaming

Answer

Bluetooth Low Energy (BLE) peer-to-peer streaming

Answer

Direct USB pass-through from a local ESXi host management port

Question 15

An administrator is replacing default VMCA-signed certificates with custom Certificate Authority (CA) signed certificates in a vSphere Foundation 9.0 environment using vSphere Certificate Manager. During the replacement of machine SSL certificates, the operation fails at the step of generating the Certificate Signing Request (CSR). What is the most likely reason for this failure?

Accepted Answer

The `certtool.cfg` configuration file contains incorrect or missing parameters such as organization name, country code, or IP address fields.. The most likely reason for CSR generation failure during certificate replacement is that the certtool.cfg configuration file contains incorrect or missing parameters, such as organization name, country code, or IP address fields. vSphere Certificate Manager uses this file to generate the CSR, and any invalid or missing required fields will cause the process to fail.

Answer

The custom CA root certificate was imported into the user store instead of the MACHINE_SSL_STAMP store.

Answer

The vCenter Server Appliance root password has expired and must be updated via the VAMI before modifying certificates.

Answer

VMware Certificate Authority (VMCA) service was stopped on the Platform Services Controller.