VCP-VVF IT Architectures Technologies Standards Practice Test 6 — 15 Questions

Question 1

An IT architect is designing a backup solution for a vSphere Foundation 9.0 vCenter Server Appliance. Which recommended standard should be established for protecting the VCSA configuration?

Accepted Answer

Configure scheduled File-Based Backup (Native Backup) from the VCSA management interface (Appliance Management UI / port 5480).. The recommended standard for protecting a vCenter Server Appliance (VCSA) configuration is to configure scheduled File-Based Backup (Native Backup) from the VCSA Management Interface on port 5480. This built-in feature backs up the VCSA configuration, including the database, to an external SMB, NFS, or FTP location, and supports scheduling and retention policies. It is the VMware-recommended method for VCSA configuration protection.

Answer

Export the vCenter database tables manually using Microsoft Access via ODBC.

Answer

Take guest operating system level screenshots every 10 minutes using a desktop recorder.

Answer

Rely solely on physical top-of-rack switch configuration backups.

Question 2

An administrator is designing a vSphere Foundation 9.0 cluster and wants to optimize memory resource utilization across virtual machines. Which memory management technique reclaims idle memory from running VMs by temporarily reallocating it to VMs experiencing memory pressure?

Accepted Answer

Memory ballooning via the VMware Tools balloon driver (vmmemctl).. Memory ballooning is the vSphere technique that reclaims idle guest memory by having the VMware Tools balloon driver (vmmemctl) inflate inside the guest, forcing the guest OS to page out unused pages to its own swap file. The ESXi host then reallocates the freed physical pages to VMs under memory pressure. This is a cooperative mechanism that requires VMware Tools to be installed and running in the guest.

Answer

Enabling Fibre Channel multipathing round-robin policies.

Answer

Upgrading physical RAM modules without rebooting the ESXi host.

Answer

Forcibly killing guest operating system background services using remote SSH commands.

Question 3

An enterprise architect is designing a multi-site vSphere Foundation 9.0 environment with stretched clusters. When configuring vSAN stretched cluster witness traffic, what is the architectural recommendation regarding the witness network connection?

Accepted Answer

Ensure the witness network link meets minimum bandwidth requirements and maintains an RTT latency of 100 milliseconds or less.. For vSAN stretched clusters, VMware recommends that the witness host be placed at a third site with a network link that meets minimum bandwidth requirements and maintains round-trip latency of 100 ms or less. This ensures timely witness heartbeats and avoids false site-failure declarations. The witness carries metadata and tie-breaking traffic, not full data.

Answer

Configure the witness node to run on the exact same physical ESXi host as the primary storage controller.

Answer

Route witness traffic exclusively through unencrypted public dial-up modems.

Answer

Disable all IP keepalive heartbeats on the witness vmkernel adapter.

Question 4

An IT architect is planning network security for a vSphere Foundation 9.0 environment. They want to ensure that inter-VM traffic within the same virtual network is inspected and filtered by distributed firewall rules without having to hairpin traffic out to a physical firewall appliance. Which architectural feature should be deployed?

Accepted Answer

NSX Distributed Firewall (DFW). VMware NSX Distributed Firewall (DFW) inspects traffic directly at the vnic level of each virtual machine within the ESXi kernel, enforcing micro-segmentation without physical hairpinning.

Answer

Physical top-of-rack access control lists (ACLs).

Answer

Storage I/O Control traffic shaping rules.

Answer

vCenter Server Appliance software firewall.

Question 5

An enterprise storage architect is designing a vSphere Foundation 9.0 vSAN cluster using native NVMe drives. When configuring the vSAN disk group or express storage architecture (ESA), what is the architectural difference between Original Storage Architecture (OSA) and Express Storage Architecture (ESA)?

Accepted Answer

ESA uses a streamlined single-tier architecture optimized for high-performance NVMe media without explicit cache/capacity disk groups, whereas OSA uses a two-tier caching architecture.. vSAN Express Storage Architecture (ESA) is a single-tier, NVMe-optimized architecture that eliminates the traditional cache/capacity disk group model of Original Storage Architecture (OSA). ESA uses a log-structured file system and pooled NVMe devices for both performance and capacity, while OSA uses a two-tier model with cache devices (SSD/NVMe) and capacity devices (HDD/SSD). This is the core architectural difference tested here.

Answer

OSA requires Fibre Channel HBAs, whereas ESA runs exclusively over wireless Wi-Fi 7 networks.

Answer

OSA does not support virtual machine creation, whereas ESA only supports Windows 3.1 workloads.

Answer

ESA is designed exclusively for mechanical 5400 RPM hard disk drives, while OSA requires tape libraries.

Question 6

An administrator is planning an upgrade of ESXi hosts in a vSphere Foundation 9.0 cluster using vSphere Lifecycle Manager. What is the role of a hardware support manager (HSM) or vendor add-on in vLCM?

Accepted Answer

To provide vendor-validated firmware and driver packages that integrate into the unified ESXi cluster software image.. In vSphere Lifecycle Manager (vLCM), a hardware support manager (HSM) or vendor add-on provides vendor-validated firmware and driver packages that are integrated into the unified ESXi cluster software image. This ensures that the firmware and drivers on the ESXi hosts are compatible with the ESXi version and with each other, simplifying lifecycle management and reducing compatibility issues.

Answer

To manage physical switch port VLAN assignments via SNMP traps.

Answer

To act as an external license server for Microsoft Windows guest operating systems.

Answer

To provide active directory domain controller replication services.

Question 7

An administrator is designing a vSphere Foundation 9.0 cluster and needs to configure network adapters for maximum fault tolerance and load distribution. When configuring an IP Hash load-balancing policy on a vSphere Distributed Switch, what is mandatory on the physical switch side?

Accepted Answer

Configure a Port Channel (EtherChannel) on the physical switch ports connected to the ESXi uplinks.. IP Hash load balancing on a vSphere Distributed Switch requires that the physical switch ports connected to the ESXi uplinks be configured as a Port Channel (EtherChannel). This is because IP Hash uses a hash of the source and destination IP addresses to select an uplink, and the physical switch must be aware of the link aggregation to properly forward traffic and avoid loops. Without a Port Channel, the physical switch treats each link as a separate connection, leading to incorrect load balancing and potential packet duplication or drops.

Answer

Disable all spanning tree protocols across every switch in the entire enterprise data center.

Answer

Assign a distinct IP address to every individual physical cable connecting the NICs.

Answer

Configure the physical switch ports as unmanaged hub ports.

Question 8

An infrastructure architect is designing a secure vSphere Foundation 9.0 environment and needs to enforce a strict zero-trust posture for ESXi host shells. Which standard configuration should be applied to ESXi local and remote shells?

Accepted Answer

Disable ESXi Shell (TSM) and SSH (TSM-SSH) services by default, enabling them only temporarily during active troubleshooting.. Best practice security hardening dictates that SSH (TSM-SSH) and the ESXi Shell (TSM) should be disabled when not actively in use, and idle timeout intervals should be enforced.

Answer

Configure SSH to permit root login using unencrypted password authentication over the public internet.

Answer

Replace the ESXi shell binary with an unauthenticated Telnet daemon.

Answer

Grant permanent shell access to all domain user accounts.

Question 9

An administrator is designing a vSphere Foundation 9.0 standard virtual switch (vSwitch) topology and needs to configure security policies for a port group. Which TWO security settings are available by default on a vSwitch port group? (Choose two.)

Accepted Answer

MAC Address Changes. Options B and D are correct because a standard vSwitch port group's Security policy exposes exactly three default settings: Promiscuous Mode, MAC Address Changes, and Forged Transmits. MAC Address Changes (B) controls whether the guest OS can change the effective MAC address of a virtual NIC away from its initial MAC, and Promiscuous Mode (D) controls whether a VM's vNIC can receive frames not addressed to it, both of which are standard per-port-group security toggles. IP Source Guard Filtering (A), Dynamic ARP Inspection Guard (C), and BPDU Filter Activation (E) are not default port group security settings; IP Source Guard and Dynamic ARP Inspection are Distributed Switch/NSX-style traffic filtering features, and BPDU filtering is a separate vSwitch or port group traffic/security-related setting rather than one of the three default Security policy options.

Answer

IP Source Guard Filtering

Answer

Dynamic ARP Inspection Guard

Answer

BPDU Filter Activation

Question 10

An infrastructure architect is designing a high-security vSphere Foundation 9.0 environment. Which THREE architectural features contribute directly to hardening ESXi hosts and virtual machines against attacks? (Choose three.)

Accepted Answer

Trusted Platform Module (TPM) 2.0 chips providing hardware-root-of-trust measurements.. Option B is correct because TPM 2.0 chips provide a hardware root of trust that stores measurements and keys, enabling features like vSphere Trust Authority and attestation to verify ESXi host integrity against tampering. Option D is correct because UEFI Secure Boot validates the cryptographic signatures of boot loaders and kernel modules during startup, preventing unauthorized or malicious code from loading before ESXi initializes. Option E is correct because vSphere VM Encryption encrypts virtual machine disk files (VMDKs) and other VM files at rest using AES-256 via the VM Encryption Key Provider, so stolen storage cannot be read without the keys. Option A is not correct because Telnet on port 23 transmits credentials and data in cleartext, which weakens rather than hardens management access; SSH or the vSphere Client should be used instead. Option C is not correct because anonymous, unauthenticated FTP access grants unauthorized file transfer capabilities and is a well-known security misconfiguration that should be disabled.

Answer

Unencrypted Telnet management daemons running on port 23.

Answer

Permitting root access via unauthenticated anonymous FTP sessions.

Question 11

An enterprise architect is planning the network architecture for a vSphere Foundation 9.0 cluster running vSAN. Which THREE network design practices are recommended for vSAN VMkernel adapters? (Choose three.)

Accepted Answer

Configure dedicated physical NIC uplinks or use Network I/O Control (NIOC) to prioritize vSAN bandwidth.. Option A is correct because vSAN traffic is latency- and bandwidth-sensitive, so VMware recommends either dedicating physical NIC uplinks to the vSAN VMkernel adapter or using Network I/O Control (NIOC) with a vSAN traffic share to guarantee and prioritize storage bandwidth over shared uplinks. Option C is correct because isolating vSAN traffic on its own VLAN or separate physical segment prevents contention and interference from other traffic types (vMotion, management, VM traffic) and improves both performance and security. Option E is correct because enabling Jumbo Frames (MTU 9000) consistently on the vSAN VMkernel adapters, vSwitches/vDS, and the entire physical switch path reduces per-packet overhead and CPU cost, improving vSAN throughput. Option B is wrong because vSAN storage traffic must remain on a trusted, low-latency internal network, never routed through public unencrypted internet gateways. Option D is wrong because disabling TCP checksum offloading on all physical NICs is not a vSAN design recommendation and would generally degrade performance rather than improve it.

Answer

Route all vSAN storage traffic through public unencrypted internet gateways.

Answer

Disable TCP checksum offloading on all ESXi host physical network adapters.

Question 12

An administrator is planning storage connectivity for a vSphere Foundation 9.0 cluster. Which TWO block storage protocols are natively supported by ESXi for connecting external enterprise storage arrays? (Choose two.)

Accepted Answer

Fibre Channel (FC). ESXi natively supports Fibre Channel (FC) and iSCSI for block storage connectivity out of the box.

Answer

Apple Filing Protocol (AFP)

Answer

IDE parallel ATA bus protocols

Answer

Server Message Block (SMB) version 1

Question 13

An enterprise architect is planning vCenter Server 9.0 High Availability (VCHA) in a vSphere Foundation environment. Which THREE nodes comprise a fully configured VCHA deployment? (Choose three.)

Accepted Answer

Active Node. A fully configured VCHA deployment consists of exactly three nodes: the Active Node (A), which runs the vCenter Server services and handles all management operations; the Passive Node (B), which continuously replicates the Active Node's state and is ready to take over if the Active fails; and the Witness Node (D), which acts as a quorum tie-breaker to prevent split-brain scenarios when the Active and Passive nodes lose connectivity with each other. These three roles together provide the automatic failover and quorum arbitration that define VCHA. Options C (Database Replica Node) and E (Proxy Controller Node) are not part of the VCHA architecture — VCHA does not use a separate database replica node (the Passive node itself replicates state), and there is no 'Proxy Controller Node' role in a VCHA deployment.

Answer

Database Replica Node

Answer

Proxy Controller Node

Question 14

An infrastructure architect is designing a multi-site vSphere Foundation 9.0 environment with stretched clusters. Which THREE challenges or requirements must be accounted for in a stretched cluster design? (Choose three.)

Accepted Answer

Redundant, high-bandwidth inter-site ISL (Inter-Switch Links) for vMotion and storage traffic.. Option A is correct because a stretched cluster requires redundant, high-bandwidth inter-site links (ISLs) to carry vMotion, vSAN, and other inter-host traffic between sites while tolerating a single link failure. Option C is correct because the vSAN witness must reside in a third, independent failure domain (a witness site) so it can break ties and maintain quorum if either data site fails, without being affected by a failure common to both. Option D is correct because vSAN stretched clusters enforce strict RTT latency limits between the two data sites—typically no more than 5 ms round-trip—since synchronous writes and metadata operations must complete across sites. Option B is wrong because eliminating all network gateways is neither feasible nor required; gateways are still needed for routing and external connectivity. Option E is wrong because converting VM disks to read-only ISO files is not a stretched-cluster requirement and would make the VMs unusable.

Answer

Complete elimination of all network gateways across the entire enterprise.

Answer

Converting all virtual machine disks into read-only ISO files.

Question 15

An administrator is planning an ESXi host installation in a vSphere Foundation 9.0 environment. Which TWO installation methods are officially supported for deploying ESXi hosts at scale? (Choose two.)

Accepted Answer

Interactive installation using physical media or virtual media (ISO mounting via IPMI/iLO/iDRAC).. Option A is correct because interactive installation from physical media or virtual media (mounting the ESXi ISO via IPMI, iLO, or iDRAC) is an officially supported method for deploying ESXi hosts, including in vSphere Foundation 9.0 environments. Option C is correct because automated scripted installation using kickstart files (installation script configuration) is the VMware-supported method for unattended, at-scale ESXi deployment. Option B is not a supported deployment method, as ESXi binaries cannot be extracted and run from a Windows 11 desktop application. Option D is invalid because ESXi is a closed, VMware-distributed hypervisor and its kernel source is not compiled manually by administrators. Option E is obsolete and unsupported, since floppy diskettes cannot carry the ESXi image and unencrypted floppy transfer is not a recognized installation path.

Answer

Extracting ESXi binaries inside a Microsoft Windows 11 desktop application.

Answer

Direct manual compilation of the ESXi Linux kernel source code on the target server.

Answer

Copying files via unencrypted floppy diskettes.