Knowledge + Practice

CCNA Configure and Manage vSphere Networking Questions

75 of 78 questions · Page 1/2 · Configure and Manage vSphere Networking · Answers revealed

Practice these questions Domain overview All questions

1

Multi-Selecthard

An administrator is configuring a distributed switch with LACP. Which two statements are true regarding LACP support on vSphere distributed switches? (Choose two.)

Select 2 answers

A.LACP supports both active and passive modes.

B.LACP automatically distributes traffic based on IP hash.

C.LACP can be configured on standard vSwitches.

D.LACP requires a Link Aggregation Group (LAG) to be created on the distributed switch.

E.LACP is only supported for virtual machine traffic, not for management or vMotion.

AnswersA, D

DVS supports both LACP modes.

Why this answer

Options A and D are correct. LACP supports both active and passive modes (A). A LAG must be created on the distributed switch for LACP (D).

Option B is false because LACP does not automatically distribute traffic based on IP hash; the load balancing algorithm is configured on the LAG. Option C is false because LACP is only supported on distributed switches, not standard vSwitches. Option E is false because LACP can be used for all traffic types, including management and vMotion.

Practice this question →

2

MCQmedium

An organization uses a VDS with 4 hosts. They want to use Network I/O Control (NIOC) to prioritize vMotion traffic over management traffic. After configuring NIOC, the administrator notices that vMotion performance is not improved. What could be the cause?

A.The vMotion VMkernel adapter is not assigned to the correct network resource pool

B.The physical uplinks are oversubscribed

C.The vMotion traffic is not marked with the appropriate CoS tag

D.NIOC is not enabled on the VDS

AnswerA

Without assigning the adapter to the vMotion resource pool, NIOC cannot prioritize vMotion traffic.

Why this answer

NIOC uses network resource pools to apply QoS policies. If the vMotion VMkernel adapter is not assigned to the appropriate network resource pool (e.g., vMotion pool), NIOC will not prioritize vMotion traffic. Option B is incorrect because oversubscribed uplinks can cause congestion but do not prevent NIOC from working; NIOC would still apply its shares to the traffic.

Option C is incorrect because NIOC does not rely on CoS tags; it uses shares and limits defined in resource pools. Option D is incorrect because the administrator configured NIOC, implying it is enabled; if it were not enabled, no NIOC functionality would be available.

Practice this question →

3

MCQhard

An administrator is troubleshooting SSH connectivity to an ESXi host from a management workstation at 10.10.10.2. The SSH session is established, but the administrator cannot ping the host's IP 10.10.10.1. Based on the exhibit, what is the most likely cause?

A.The default gateway is not set correctly.

B.ICMP traffic is blocked by the ESXi firewall.

C.The SSH service is not running on the host.

D.The management workstation is on a different VLAN.

AnswerB

ESXi firewall blocks ping by default.

Why this answer

The administrator can establish an SSH session, which proves that the ESXi host's SSH service is running and that TCP port 22 is reachable from the management workstation. However, the inability to ping the host's IP address (10.10.10.1) indicates that ICMP echo requests are being blocked. By default, the ESXi firewall blocks ICMP traffic, so the most likely cause is that ICMP is filtered by the host firewall.

Exam trap

The trap here is that candidates assume SSH connectivity implies full network reachability, but the ESXi firewall selectively permits services, so a successful SSH session does not guarantee that ICMP or other protocols are allowed.

How to eliminate wrong answers

Option A is wrong because the default gateway is not required for ping to succeed within the same subnet; the workstation (10.10.10.2) and the host (10.10.10.1) are on the same network segment, so no gateway is involved. Option C is wrong because the SSH session is established, which directly proves the SSH service is running and listening on TCP port 22. Option D is wrong because if the workstation were on a different VLAN, the SSH session would not be able to establish at all, as layer-3 routing would be required and the host's IP would be unreachable.

Practice this question →

4

Multi-Selecteasy

An administrator is configuring a vSphere Standard Switch. Which two settings are essential for basic network connectivity of virtual machines?

Select 2 answers

A.Port group name

B.MTU

C.Network adapter type (e.g., E1000)

D.Security policy

E.VLAN ID

AnswersA, E

A unique name is required for the port group.

Why this answer

For basic network connectivity of virtual machines on a vSphere Standard Switch, a port group must be created. Two essential settings are the port group name (to identify the network) and a VLAN ID (to associate the VMs with the correct VLAN; VLAN 0 is the default untagged VLAN). Without a name, the port group cannot be created; without a VLAN ID, VMs may not be properly segmented or may lack network access.

Other options like MTU, network adapter type, and security policy are not essential for basic connectivity.

Practice this question →

5

MCQhard

A large financial organization has a vSphere cluster with 10 ESXi hosts (8.x) connected to a pair of Nexus 9000 switches via two 10G LACP link aggregation groups (LAGs) per host. Each host has a vSphere Distributed Switch (vDS 7.0.3) with two LAGs (LAG1: vmnic0, vmnic1; LAG2: vmnic2, vmnic3). The vDS has three port groups: Production (VLAN 100-200), DMZ (VLAN 300), and Storage (VLAN 400). The port groups use LACP with load balancing 'Route based on IP hash'. Recently, the network team changed the physical switch port channels from mode 'active' to 'passive' on the downstream ports connected to host #3, without informing the virtualization team. Within hours, VMs on host #3 experience intermittent connectivity; some can communicate but others cannot, and vMotion between host #3 and other hosts fails with a network unreachable error. iSCSI storage traffic from host #3 is also unstable. The administrator verifies that the vDS LACP configuration on host #3 still expects 'active' mode. Which of the following actions is the most effective to restore full functionality while maintaining LACP?

A.Change the LACP mode on host #3's vDS from 'active' to 'passive' for both LAGs.

B.Disable LACP on host #3's vDS and use static EtherChannel instead.

C.Replace the vDS with multiple standard switches and use active/standby failover.

D.Remove and recreate the LAGs on host #3's vDS after verifying the physical switch's LACP configuration.

AnswerD

Recreating the LAGs on the vDS, after verifying the physical switch's LACP settings, ensures LAG IDs and modes are synchronized, restoring LACP functionality.

Why this answer

The root cause is a mismatch between the vDS LACP mode (active) and the physical switch's LACP mode (passive). Simply recreating the LAGs after verifying the switch configuration ensures both sides agree on the LACP mode, restoring proper negotiation and traffic flow. This maintains the existing LACP-based load balancing and avoids disrupting the rest of the cluster.

Exam trap

The trap here is that candidates assume changing the vDS LACP mode to passive (Option A) will fix the mismatch, but they overlook that passive-passive pairs never form a LAG, resulting in no link aggregation at all.

How to eliminate wrong answers

Option A is wrong because changing the vDS LACP mode to 'passive' would create a passive-passive pair, which never initiates LACP PDUs and results in no link aggregation, leaving the links as individual active/standby. Option B is wrong because disabling LACP and using static EtherChannel would require the physical switch ports to be configured as static on, which they are not, and would break the existing LACP-based load balancing for all port groups. Option C is wrong because replacing the vDS with standard switches and using active/standby failover would eliminate LACP entirely, reducing aggregate bandwidth and violating the requirement to maintain LACP.

Practice this question →

6

MCQmedium

An administrator is configuring a distributed switch for a cluster of ESXi hosts. The requirements are: VLAN 100 for production, VLAN 200 for management, and a separate VLAN 300 for vMotion. The management network should be isolated from production traffic. What is the best practice for configuring these networks on the distributed switch?

A.Create three separate distributed port groups, each with the appropriate VLAN ID, and assign each VM kernel adapter or VM to the correct port group.

B.Create one distributed port group with VLAN 100, and use VLAN tagging on the VMs for management and vMotion.

C.Use standard switches for management and vMotion to avoid complexity.

D.Create one distributed port group with VLAN trunk (4095) and use port-based VLAN filtering on the VMs.

E.Create two port groups: one for production (VLAN 100) and one for management+vMotion (VLAN 200) because vMotion can share VLAN with management.

AnswerA

Correct: Separate port groups with specific VLAN IDs for each traffic type (VLAN 100 production, VLAN 200 management, VLAN 300 vMotion) isolate traffic and follow best practices.

Why this answer

Best practice for segmenting different traffic types (production, management, vMotion) on a distributed switch is to create separate distributed port groups, each assigned a unique VLAN ID. This isolates traffic at Layer 2, enhances security, and prevents interference. VMkernel adapters for management and vMotion, as well as VMs for production, are then attached to their respective port groups.

Option B is incorrect because VLAN tagging on VMs is not suitable for VMkernel adapters, which require dedicated port groups. Option C is incorrect because using standard switches defeats the purpose of a distributed switch and adds management complexity. Option D is incorrect because VLAN trunk (4095) is used for guest-level tagging, not for isolating kernel traffic.

Option E is incorrect because management and vMotion should be on separate VLANs to avoid resource contention and security risks.

Exam trap

A common trap is assuming that management and vMotion can share a VLAN or that VLAN trunking simplifies configuration. In reality, each VMkernel service type should have its own VLAN and port group for isolation and performance.

Practice this question →

7

MCQmedium

An administrator is troubleshooting an issue where a VM on a vSphere Distributed Switch cannot receive traffic from outside its subnet. The VM can send traffic out and receive replies from hosts on the same subnet. The default gateway is configured correctly. What is the most likely cause?

A.The VXLAN Tunnel Endpoint (VTEP) IP is not reachable from the remote subnet.

B.The ESXi host's default gateway is misconfigured.

C.The router does not have a route back to the VM's subnet.

D.The port group VLAN ID is different from the physical switch trunk allowed VLAN.

AnswerC

If the upstream router lacks a return route, packets destined to the VM are dropped, causing asymmetric routing where outbound succeeds but inbound fails.

Why this answer

The VM can send traffic out and receive replies from hosts on the same subnet, indicating that its network configuration and the switch are functioning correctly. However, traffic from outside the subnet is not reaching the VM. This typically occurs when the router that connects the subnets does not have a route back to the VM's subnet.

Even though the VM's default gateway is correctly configured, the router must know how to reach the VM's subnet to forward return traffic. Option A is incorrect because the VTEP IP is used for VXLAN overlay networks, not for standard IP routing. Option B is incorrect because the ESXi host's default gateway is for host management traffic and does not affect VM traffic.

Option D is incorrect because a VLAN ID mismatch between the port group and the physical switch would cause issues with all traffic, including same-subnet communication.

Practice this question →

8

MCQhard

A company runs a three-tier application on vSphere 7.0. The web tier uses VLAN 100, app tier VLAN 200, and database tier VLAN 300. Each tier is on a separate port group on a vSphere distributed switch. The environment uses Network I/O Control (NIOC) with shares set to: Web (50), App (30), Database (20). The physical uplinks are two 10 GbE NICs in a team. Recently, the database team reports slow performance during peak hours. The network team checks the physical switches and finds no congestion. The ESXi host shows the two uplinks are heavily utilized with many dropped packets on the database port group. The administrator suspects that the database traffic is being starved by other traffic. Which action should the administrator take to resolve the issue? A. Increase the number of physical uplinks to four 10 GbE NICs. B. Change the NIOC shares to Web (10), App (30), Database (60). C. Create a separate vSphere standard switch for the database tier. D. Enable SR-IOV on the physical NICs and assign virtual functions to database VMs.

A.Create a separate vSphere standard switch for the database tier.

B.Enable SR-IOV on the physical NICs and assign virtual functions to database VMs.

C.Increase the number of physical uplinks to four 10 GbE NICs.

D.Change the NIOC shares to Web (10), App (30), Database (60).

AnswerD

Increases database shares, giving it higher priority.

Why this answer

The database traffic is being starved due to low NIOC shares relative to the web and app tiers. By increasing the database shares to 60 and reducing web to 10, the database port group will receive a higher proportion of the available bandwidth during congestion, alleviating the dropped packets and slow performance. NIOC shares are relative and only take effect when there is contention, so adjusting them directly addresses the starvation without requiring additional hardware.

Exam trap

The trap here is that candidates often assume adding more physical uplinks or isolating traffic on a separate switch will solve performance issues, but they overlook that NIOC shares directly control bandwidth allocation during congestion, and adjusting them is the most efficient and cost-effective solution.

How to eliminate wrong answers

Option A is wrong because increasing the number of physical uplinks to four 10 GbE NICs does not address the root cause of traffic starvation; it only adds more bandwidth, which may not help if the existing bandwidth is not being fairly allocated due to NIOC share settings. Option B is wrong because enabling SR-IOV on the physical NICs and assigning virtual functions to database VMs bypasses the vSphere network stack, but it does not resolve the contention on the shared uplinks; it could introduce complexity and is not a direct fix for NIOC share misconfiguration. Option C is wrong because creating a separate vSphere standard switch for the database tier would isolate the traffic but would still share the same physical uplinks unless dedicated uplinks are assigned, which is not mentioned; it also does not leverage NIOC's traffic shaping capabilities and may lead to underutilization of resources.

Practice this question →

9

MCQhard

A vSphere environment uses a vSphere Distributed Switch (vDS) with 10G uplinks and Network I/O Control (NIOC) enabled. Administrators report that during peak traffic, NFS storage traffic is experiencing high latency, while other traffic types remain unaffected. The vDS has default NIOC shares and limits. Which action should be taken to prioritize NFS traffic without completely starving other traffic?

A.Set a low bandwidth limit for the NFS traffic class.

B.Increase the shares for the NFS traffic class.

C.Set a high bandwidth reservation for the NFS traffic class.

D.Disable Network I/O Control on the vDS.

AnswerB

Increasing shares gives NFS higher relative weight during contention, ensuring it gets more bandwidth without hard limits, thus reducing latency while allowing other traffic to still use remaining bandwidth.

Why this answer

Increasing the shares for the NFS traffic class gives it a higher proportion of bandwidth during contention, without imposing a hard limit. Option A is incorrect because setting a low bandwidth limit would cap NFS traffic, potentially worsening performance. Option C is incorrect because setting a high bandwidth reservation could reserve bandwidth for NFS even when not needed, potentially wasting resources, and does not prioritize dynamically like shares do.

Option D is incorrect because disabling NIOC removes all traffic prioritization, eliminating the ability to differentiate NFS traffic.

Practice this question →

10

MCQhard

A vSphere administrator is configuring Network I/O Control (NIOC) on a vSphere Distributed Switch to prioritize vMotion traffic during maintenance windows. The environment has three system traffic classes: Management, NFS, and vMotion. The administrator wants to ensure that when the network is congested, vMotion gets at least 50% of the available bandwidth, while Management and NFS each get at least 25%. Which NIOC configuration achieves this?

A.Set a limit of 500 Mbps for Management and NFS, and no limit for vMotion.

B.Set the vMotion traffic class shares to 50, Management shares to 25, and NFS shares to 25.

C.Set a reservation of 500 Mbps for vMotion, 250 Mbps for Management, and 250 Mbps for NFS.

D.Do nothing; NIOC is not needed because all traffic types are equally important.

AnswerB

Shares define relative priority; with these values, vMotion gets 50/100 = 50% during congestion, fulfilling the requirement.

Why this answer

Shares allocate bandwidth proportionally during contention. Setting the vMotion shares to 50, Management to 25, and NFS to 25 ensures that vMotion receives 50% of available bandwidth when all traffic classes are congested, while Management and NFS each get 25%. Option A is incorrect because limits cap bandwidth and do not guarantee proportional allocation; they would restrict vMotion to at most 500 Mbps regardless of available bandwidth.

Option C is incorrect because reservations guarantee a minimum bandwidth but do not enforce proportional sharing during congestion; they would ensure each class gets at least the reserved amount but not necessarily the desired percentages when the total bandwidth exceeds the sum of reservations. Option D is incorrect because without NIOC, all traffic classes are treated equally, so vMotion would not get prioritized bandwidth.

Practice this question →

11

MCQhard

Refer to the exhibit. The ESXi host has three VMkernel interfaces. A vMotion operation fails with a routing error. Which is the most likely cause?

A.The vMotion VMkernel interface uses DHCP.

B.The vMotion VMkernel interface is on vmk1, but the default gateway points to vmk0.

C.The vMotion VMkernel interface is on vmk0, but the gateway is incorrect.

D.The vMotion VMkernel interface is on vmk2, but no route exists for the vMotion destination network.

AnswerD

If the destination is not on the same subnet as vmk2, a route is needed but missing.

Practice this question →

12

MCQhard

Refer to the exhibit. An administrator notices that two uplinks are down on the VDS. Which step should be taken first to restore redundancy?

A.Check the physical switch ports and cables for uplink2 and uplink3.

B.Increase the MTU to 9000 to improve performance.

C.Disable LACP on the VDS to allow single-uplink operation.

D.Remove the down uplinks from the VDS.

AnswerA

Physical connectivity issues are the most common cause of down uplinks.

Practice this question →

13

MCQeasy

Based on the Healthcheck output for a distributed port (DVS Port 1) on dvs0, what can be concluded?

A.The uplinks vmnic0 and vmnic1 are operating at 10 Gbps.

B.The physical switch is correctly configured for VLAN 100 and MTU 1500 on the uplinks connected to this host.

C.The load balancing policy is set to 'Route based on IP hash'.

D.The port is experiencing high packet loss due to misconfiguration.

AnswerB

The VLAN Status and MTU Status are both OK, indicating end-to-end connectivity matches.

Why this answer

The Healthcheck output shows 'VLAN 100' and 'MTU 1500' with status 'OK', indicating that the physical switch configuration matches the DVS port settings for VLAN and MTU. Option A is incorrect because Healthcheck doesn't report speed/duplex of uplinks. Option C is incorrect because the teaming policy shown is 'Route based on originating virtual port', not IP hash.

Option D is incorrect because Healthcheck checks configuration consistency, not packet loss.

Practice this question →

14

MCQmedium

A vSphere administrator is troubleshooting connectivity issues for a virtual machine that is unable to communicate with other VMs on the same VLAN. The VM is connected to a distributed port group on a vSphere Distributed Switch (vDS). The administrator verifies that the VM's IP configuration is correct and that the port group is configured with the correct VLAN ID. However, the VM can only communicate with other VMs on the same ESXi host. What is the most likely cause?

A.The vDS is not configured with a VLAN trunking policy.

B.The VM's network adapter is configured with the wrong MAC address.

C.The distributed port group has forging transmits set to reject.

D.The physical switch ports connecting the ESXi hosts are not configured as trunk ports for the VLAN.

AnswerD

If physical switch ports are not trunking the VLAN, frames tagged with that VLAN will be dropped, preventing cross-host communication while intra-host communication (no physical switch) works.

Why this answer

The VM can communicate only with other VMs on the same ESXi host because VLAN-tagged frames cannot pass through the physical switch ports to other hosts. For VMs on the same VLAN to communicate across hosts, the physical switch ports connecting the ESXi hosts must be configured as trunk ports that allow the relevant VLAN. Option A is incorrect because the vDS does not require a separate VLAN trunking policy; the port group VLAN ID handles tagging.

Option B is incorrect because the MAC address is automatically assigned and would not cause host-only communication. Option C is incorrect because the 'forging transmits' security policy controls MAC address changes, not basic connectivity.

Practice this question →

15

MCQeasy

An administrator needs to provide redundancy for VM traffic across multiple physical NICs on a vSphere Standard Switch. Which NIC teaming policy should be used to ensure fault tolerance without load balancing?

A.Route based on IP hash

B.Route based on originating virtual port

C.Use explicit failover order (Active/Standby)

D.Route based on source MAC hash

AnswerC

This provides fault tolerance without load balancing.

Why this answer

The 'Use explicit failover order (Active/Standby)' policy designates one or more NICs as active and the rest as standby, providing pure fault tolerance without any load balancing. When the active NIC fails, traffic automatically fails over to the standby NIC, ensuring redundancy without distributing traffic across multiple uplinks.

Exam trap

The trap here is that candidates often confuse 'fault tolerance without load balancing' with load-balancing policies like IP hash or source MAC hash, mistakenly thinking any teaming policy provides redundancy, but only the explicit failover order ensures a single active path with no traffic distribution.

How to eliminate wrong answers

Option A is wrong because 'Route based on IP hash' uses a hash of source and destination IP addresses to distribute traffic across multiple active NICs, which provides load balancing but not pure fault tolerance without load balancing. Option B is wrong because 'Route based on originating virtual port' distributes traffic based on the virtual switch port ID, which also load-balances across active NICs and does not guarantee a single active path for fault tolerance. Option D is wrong because 'Route based on source MAC hash' uses the source MAC address to distribute traffic across multiple active NICs, again providing load balancing rather than the required fault tolerance without load balancing.

Practice this question →

16

MCQhard

A company deploys a VDS with multiple uplinks and uses Route based on originating virtual port for load balancing. The network team reports that traffic from VMs on the same host is not balanced across uplinks. The administrator verifies that the physical switch ports are all in the same port-channel. What could be the cause?

A.The uplinks are configured in active/standby mode

B.The load balancing algorithm is not supported by the physical switch

C.The number of VMs is less than the number of uplinks

D.The teaming policy uses an explicit failover order

AnswerA

In active/standby mode, only one uplink is active, so no load balancing occurs.

Why this answer

When uplinks are configured in active/standby mode, only one uplink is active at a time, so no load balancing occurs regardless of the algorithm. Option B is incorrect because Route based on originating virtual port is a vSphere algorithm and does not depend on physical switch support. Option C is incorrect because having fewer VMs than uplinks might reduce distribution but does not prevent load balancing entirely; traffic could still be balanced across active uplinks.

Option D is incorrect because an explicit failover order can still allow multiple active uplinks if multiple paths are set to active; it is not the same as active/standby.

Practice this question →

17

MCQhard

An ESXi host has two VMkernel interfaces as shown in the exhibit. The iSCSI targets are on the same subnet as vmk1 and support jumbo frames. The administrator reports that iSCSI sessions are experiencing high error rates and poor performance. What is most likely the cause?

A.The management network (vmk0) is also using the vDS, causing traffic interference.

B.The iSCSI VMkernel port should not be bound to a vDS.

C.The iSCSI network (vmk1) is on a different subnet than the iSCSI targets.

D.The vDS port group for iSCSI does not have jumbo frames enabled (MTU 9000).

AnswerD

If the vDS port group MTU is 1500, packets up to 9000 will be fragmented, causing errors. The VMkernel interface has MTU 9000, so the port group must match.

Why this answer

The iSCSI targets support jumbo frames (MTU 9000), but if the vDS port group for iSCSI is configured with the default MTU of 1500, packets will be fragmented, leading to high error rates and poor performance. The exhibit shows vmk1 is on the vDS, and the iSCSI targets are on the same subnet as vmk1, so the mismatch in MTU settings is the most likely cause. Option A is incorrect because management traffic on vmk0 is separate and does not affect iSCSI.

Option B is incorrect because iSCSI VMkernel ports can be bound to a vDS. Option C is incorrect because the iSCSI network (vmk1) is on the same subnet as the iSCSI targets, so subnet mismatch is not the issue.

Practice this question →

18

MCQeasy

An administrator sees this health check output. What should be done to verify VLAN 100 connectivity?

A.Create a VMkernel adapter on VLAN 100 and ping a gateway.

B.Enable VLAN pruning on the physical switch.

C.Configure a port group for VLAN 100 and connect a VM.

D.Restart the management agents.

AnswerA

A VMkernel adapter provides a layer 3 test on that VLAN.

Why this answer

To test VLAN 100, a VMkernel adapter with that VLAN should be created and used to ping a gateway. Option B is for pruning, not testing. Option C would test VM traffic, but VMkernel adapter is more direct for verification.

Option D is not necessary.

Practice this question →

19

MCQhard

A vSphere administrator is deploying a vSphere Distributed Switch (vDS) version 7.0. The environment has ESXi hosts with hardware version 7.0. The administrator needs to ensure that the vDS supports Network I/O Control version 3 (NIOCv3). What must be true for NIOCv3 to function correctly?

A.All hosts must be running ESXi 7.0 or later.

B.The vDS must be configured with Route based on IP hash teaming.

C.All hosts must have the vDS in Link Aggregation Control Protocol (LACP) mode.

D.The vDS must have a Network Resource Pool configured.

AnswerA

NIOCv3 requires ESXi 7.0 or later.

Why this answer

NIOCv3 is a feature introduced with vSphere 7.0 that provides granular bandwidth allocation and reservation for network traffic. For NIOCv3 to function correctly, all ESXi hosts attached to the vDS must be running ESXi 7.0 or later because the feature relies on kernel-level enhancements and the vSphere Network Resource Management (vNRM) agent that are only present in that version. Hosts on earlier versions lack the necessary drivers and scheduling capabilities, causing NIOCv3 to be unavailable or non-functional.

Exam trap

The trap here is that candidates often assume upgrading the vDS version alone is sufficient to enable NIOCv3, overlooking the critical requirement that every host in the cluster must also be running ESXi 7.0 or later for the feature to function.

How to eliminate wrong answers

Option B is wrong because Route based on IP hash teaming is a load-balancing policy, not a prerequisite for NIOCv3; NIOCv3 works independently of the teaming algorithm and does not require IP hash. Option C is wrong because LACP mode is a link aggregation configuration that is unrelated to NIOCv3; NIOCv3 can function with or without LACP, and forcing LACP is not a requirement. Option D is wrong because a Network Resource Pool is a construct used to allocate bandwidth to specific traffic types within NIOC, but it is not a prerequisite for NIOCv3 to function; NIOCv3 can operate with default resource pools or custom ones, but the feature itself must first be enabled on a vDS that meets the host version requirement.

Practice this question →

20

MCQmedium

An administrator has configured a vSphere Distributed Switch (VDS) with Network I/O Control. They need to guarantee bandwidth for a specific set of virtual machines. Which method should be used?

A.Create a port group with a custom network resource pool.

B.Enable SR-IOV on the physical NICs.

C.Set the virtual machine's network adapter to use a specific VLAN.

D.Configure Traffic Shaping on the distributed switch.

AnswerA

Network Resource Pools allow bandwidth reservation and guarantee.

Why this answer

Create a port group with a custom network resource pool. Network I/O Control allows administrators to create network resource pools to guarantee bandwidth for specific virtual machines or port groups. By creating a custom network resource pool and assigning it to a port group, you can reserve a certain amount of bandwidth.

Option B is incorrect because SR-IOV provides direct hardware passthrough but does not manage bandwidth guarantees; it can actually bypass Network I/O Control. Option C is incorrect because setting a VLAN tag does not guarantee bandwidth; it only separates traffic. Option D is incorrect because traffic shaping is used to limit bandwidth (throttle outgoing traffic) but does not guarantee a minimum bandwidth; it only caps it.

Practice this question →

21

MCQeasy

A vSphere administrator needs to provide redundancy for VM traffic on a vSphere Standard Switch by using multiple physical uplinks. Which teaming configuration should be used to ensure that if one uplink fails, traffic automatically fails over to another?

A.Set load balancing to 'Route based on IP hash' and make both uplinks active.

B.Enable 'Use explicit failover order' and configure 'Network failures' detection.

C.Set load balancing to 'Explicit failover order' and set one uplink as active.

D.Set load balancing to 'Route based on originating virtual port' and make one uplink active and one standby.

AnswerD

This provides clear active/standby failover; if the active uplink fails, standby takes over.

Why this answer

Option D is correct because setting load balancing to 'Route based on originating virtual port' with one active and one standby adapter explicitly configures a failover pair: if the active uplink fails, the standby automatically takes over, ensuring redundancy. Option A is incorrect because while an active/active configuration with 'Route based on IP hash' can provide failover, it is designed primarily for load balancing and requires proper EtherChannel setup on the physical switch; for simple redundancy, the active/standby configuration is the direct and recommended approach. Option B is incorrect because enabling 'Use explicit failover order' does not by itself designate a standby adapter; you must also configure the active/standby assignments.

Option C is incorrect because having only one active uplink with no standby leaves no failover target if that uplink fails. Therefore, D is the correct answer.

Practice this question →

22

Multi-Selectmedium

Which four types of traffic can be assigned to a separate VMkernel adapter on an ESXi host?

Select 4 answers

A.Management traffic

B.vMotion

C.vSAN

D.Virtual machine network traffic

E.Fault Tolerance logging

AnswersA, B, C, E

Management (host) traffic uses a VMkernel adapter and can be isolated.

Why this answer

The correct answers are A, B, C, and E. VMkernel adapters are used for system traffic such as management, vMotion, vSAN, and Fault Tolerance logging. Management traffic (A) handles host communication, vMotion (B) supports live migration, vSAN (C) provides storage traffic, and Fault Tolerance logging (E) is used for FT logging and can be assigned to a separate VMkernel adapter for performance and isolation.

Virtual machine network traffic (D) uses standard or distributed port groups, not VMkernel adapters.

Practice this question →

23

Multi-Selecteasy

An administrator is configuring a vSphere distributed switch. Which TWO are valid uplink teaming policies? (Choose two.)

Select 2 answers

A.Explicit failover order

B.Route based on MAC hash

C.Route based on round robin

D.Route based on physical NIC load

E.Route based on IP hash

AnswersD, E

Valid load balancing policy.

Why this answer

Route based on physical NIC load (option D) is a valid uplink teaming policy in vSphere distributed switches. This policy uses the load metric from the physical NICs to distribute traffic, where the switch selects the uplink with the least current load for outbound traffic, as determined by the vSphere Distributed Switch's load balancing algorithm.

Exam trap

The trap here is that candidates often confuse the valid teaming policies on distributed switches (which include 'Route based on physical NIC load' and 'Route based on IP hash') with those on standard switches (which include 'Route based on MAC hash' and 'Route based on round robin'), leading them to select the wrong options.

Practice this question →

24

MCQhard

An administrator is configuring LACP on a VDS with two uplinks. Which configuration must match between the VDS and the physical switch?

A.LACP mode (active/passive).

B.LACP rate (slow/fast).

C.LACP port key.

D.All of the above.

AnswerD

Port key, mode, and rate must all match.

Why this answer

For a successful LACP negotiation, the port key, mode (active/passive), and rate (slow/fast) must be consistent on both ends. Option A alone is insufficient. Option B alone is insufficient.

Option C alone is insufficient.

Practice this question →

25

MCQhard

A vSphere administrator is designing a network for a cluster of ESXi hosts. Each host has four 10GbE uplinks. The cluster will host mission-critical VMs that require maximum throughput and redundancy. The administrator plans to use Network I/O Control (NIOC) and a vSphere Distributed Switch (vDS). Which configuration best ensures consistent network performance for all VMs?

A.Configure a single vDS with all four uplinks, enable NIOC, and set shares and reservations for each traffic type.

B.Configure a single vDS with all four uplinks and enable NetFlow for monitoring.

C.Create two separate vDS, each with two uplinks, and separate VM traffic from VMkernel traffic.

D.Configure a single vDS with all four uplinks and use Route based on IP hash teaming.

AnswerA

NIOC provides minimum bandwidth guarantees and fair sharing.

Why this answer

NIOC enables per-traffic-type resource management using shares, reservations, and limits, ensuring that mission-critical VMs receive consistent network throughput even under contention. Combining all four uplinks into a single vDS maximizes aggregate bandwidth and provides redundancy through teaming policies, while NIOC prioritizes traffic flows to prevent VMkernel or management traffic from starving VM traffic.

Exam trap

The trap here is that candidates often confuse load-balancing algorithms (like IP hash) with QoS mechanisms, assuming that distributing traffic across uplinks alone guarantees performance, when in fact NIOC's per-traffic-type resource controls are required to enforce consistent throughput for all VMs.

How to eliminate wrong answers

Option B is wrong because NetFlow is a monitoring and traffic analysis tool, not a QoS or performance guarantee mechanism; it does not allocate bandwidth or enforce fairness among traffic types. Option C is wrong because splitting uplinks across two separate vDS reduces the total available bandwidth per vDS and prevents NIOC from managing all traffic centrally, leading to potential underutilization and inconsistent performance. Option D is wrong because Route based on IP hash provides load balancing but does not offer per-traffic-type resource controls like shares and reservations, so it cannot guarantee consistent performance for all VMs under contention.

Practice this question →

26

MCQhard

Refer to the exhibit. The administrator notices rx_dropped packets on vmnic0 but no errors. What is the most likely cause of the dropped packets?

A.There is a VLAN mismatch causing packets to be dropped.

B.The virtual switch port has insufficient buffer space.

C.The physical NIC's receive ring buffer is overflowing due to high traffic.

D.The physical switch is dropping packets due to congestion.

AnswerC

rx_dropped on a NIC without errors usually indicates the ring buffer is full and packets are dropped. Increasing ring buffer size or optimizing interrupt coalescing can help.

Why this answer

The exhibit shows rx_dropped: 120 on vmnic0, but no rx_errors. The vsish output shows no drops on the virtual switch port. The drops on the physical NIC are likely due to ring buffer overflow, which occurs when the host receives packets faster than it can process them.

This is common under high traffic load or insufficient interrupt handling.

Practice this question →

27

Multi-Selectmedium

An administrator is troubleshooting network connectivity for a virtual machine connected to a vSphere Distributed Switch. Which three components must be properly configured for the VM to communicate with the external network?

Select 3 answers

A.VM's IP address

B.Physical NIC uplink

C.Distributed switch uplink port group

D.VM's network adapter driver

E.Physical switch port configuration

AnswersB, C, E

The physical NIC must be connected and functional.

Why this answer

Options B, C, and E are correct. The physical NIC uplink provides connectivity from the host, the distributed switch uplink port group connects the DVS to the physical NIC, and the physical switch port must be configured to allow traffic. Option A is incorrect because the VM's IP address is an OS setting, not a vSphere networking component.

Option D is incorrect because the VM's network adapter driver is a software component, not a configuration element.

Practice this question →

28

Multi-Selectmedium

Which three factors influence the behavior of Network I/O Control (NIOC) when allocating bandwidth to different traffic types? (Choose three.)

Select 3 answers

A.The total physical bandwidth

B.Reservation per traffic type

C.Shares per traffic type

D.Limit per traffic type

E.The number of physical uplinks

AnswersB, C, D

Reservation guarantees a minimum bandwidth.

Why this answer

Options B, C, and D are correct. Network I/O Control (NIOC) uses three configurable parameters to allocate bandwidth per traffic type: reservation (guaranteed bandwidth), shares (relative priority), and limit (maximum bandwidth). Total physical bandwidth (A) and the number of physical uplinks (E) affect overall capacity but are not configurable per traffic type, and do not directly influence NIOC's bandwidth allocation behavior.

Practice this question →

29

MCQmedium

A VM on a vSphere Distributed Switch is experiencing intermittent connectivity drops. The administrator checks the vDS health check and sees no errors. The physical switch logs show no issues. The VM is on a port group with VLAN 200. The administrator runs a ping from the VM to the gateway and notices packet loss. What should the administrator investigate next?

A.Verify the VMkernel port configuration

B.Check the VM's firewall settings

C.Check DNS resolution for the gateway

D.Review the NIC teaming failover order and ensure active uplinks are up.

AnswerD

Intermittent drops can be caused by failover events.

Why this answer

Intermittent connectivity drops on a VM connected to a vDS, despite no errors on the vDS health check or physical switch logs, often point to a NIC teaming misconfiguration. If the active uplinks are not properly set or one uplink is down, the VM traffic may fail over to a standby or unused uplink, causing packet loss. Verifying the teaming failover order and ensuring all active uplinks are operational directly addresses this common cause of intermittent drops.

Exam trap

The trap here is that candidates often assume intermittent connectivity must be a VM firewall or DNS issue, overlooking the NIC teaming failover order as a primary cause of packet loss on a vDS when physical and vDS health checks show no errors.

How to eliminate wrong answers

Option A is wrong because VMkernel port configuration is used for management traffic, vMotion, or storage, not for VM data traffic on a port group; investigating it would not resolve VM connectivity drops. Option B is wrong because the VM's firewall settings (e.g., Windows Firewall) would typically block all traffic or allow it consistently, not cause intermittent packet loss to a gateway; the issue is at the network layer, not the host firewall. Option C is wrong because DNS resolution is used for name-to-IP mapping, not for direct IP connectivity; the administrator is pinging the gateway IP, so DNS is irrelevant to packet loss.

Practice this question →

30

Multi-Selecteasy

Which two actions must the administrator take to ensure network connectivity for VMs on a new distributed switch?

Select 2 answers

A.Configure a VMkernel interface on the distributed switch

B.Add the ESXi hosts to the distributed switch

C.Set the MTU to 9000

D.Create a port group and assign a VLAN

E.Enable Network I/O Control

AnswersB, D

Without adding the hosts, the distributed switch cannot be used by VMs on those hosts.

Why this answer

The correct answers are B and D. Adding ESXi hosts to the distributed switch (B) is required for them to use the switch and manage VMs. Creating a port group with a VLAN assignment (D) provides the necessary network connectivity for VMs.

Option A (configuring a VMkernel interface) is for host management traffic, not VM connectivity. Option C (setting MTU to 9000) is optional for jumbo frames and not required. Option E (enabling Network I/O Control) is for QoS and not needed for basic connectivity.

Practice this question →

31

MCQhard

After upgrading the physical switches, the LAG (Link Aggregation Group) on a VDS does not come up. The VDS LAG configuration shows LACP active mode. The physical switch ports are configured with LACP active mode as well. What is the most likely cause?

A.The physical switch uses a different LACP system priority

B.The physical switch ports are not in a port-channel

C.The ESXi hosts have different LAG IDs

D.The VDS LAG hashing algorithm is set to IP hash

AnswerB

LACP requires the physical switch ports to be configured as part of a port-channel group; otherwise, they are treated as individual links and LACP will not form.

Why this answer

For a LAG to form, the physical switch ports must be configured as a port-channel or etherchannel. Even if both sides are set to LACP active, the switch ports must first be grouped into a port-channel interface; otherwise, LACP negotiations will not complete. Option A is incorrect because the system priority affects LACP role but does not prevent LAG formation if both sides are active.

Option C is incorrect because LAG IDs are not relevant across hosts; each host's LAG is independent. Option D is incorrect because the hashing algorithm does not affect LACP negotiation; it only affects load distribution.

Practice this question →

32

MCQeasy

A VM cannot connect to the network after being migrated to a different host in the cluster. The VM's network adapter is connected to a standard switch port group that exists on the source host but not on the destination host. What is the most likely cause?

A.The standard switch is not configured on the destination host.

B.The VM's MAC address is not allowed on the destination port group.

C.The VLAN ID on the port group does not match.

D.The ESXi host's firewall is blocking the VM's traffic.

AnswerA

Standard switches are local to each host; the port group must be created on the destination host.

Why this answer

Standard switches are host-specific, so the port group must exist on each host where VMs using it are placed. If the destination host does not have the same standard switch and port group configured, the VM loses connectivity. Option B is incorrect because MAC address restrictions are not a typical cause.

Option C is irrelevant because the VLAN ID is part of the port group definition, but the issue here is the port group's absence. Option D is unrelated to standard switch configuration.

Practice this question →

33

MCQhard

An administrator configures a Private VLAN on a distributed switch with primary VLAN 100 and secondary VLANs 101 (isolated) and 102 (community). A VM on isolated secondary VLAN 101 needs to communicate with a VM on community secondary VLAN 102. What additional configuration is required?

A.Enable promiscuous mode on the port group for VLAN 101.

B.Configure a proxy router on the physical network.

C.They cannot communicate because isolated PVLANs prohibit any communication to other secondary VLANs.

D.Deploy a VM on the primary VLAN 100 with routing capabilities to forward traffic between the secondary VLANs.

AnswerD

A promiscuous port (primary VLAN) can communicate with both isolated and community, enabling routing.

Why this answer

In a Private VLAN configuration, isolated secondary VLANs can only communicate with promiscuous ports on the primary VLAN. A VM deployed on the primary VLAN with routing capabilities acts as a promiscuous port and can forward traffic between the isolated (101) and community (102) secondary VLANs. Option A is incorrect because enabling promiscuous mode on the isolated port group does not allow communication to community VLANs and breaks isolation.

Option B is not the standard VMware recommended approach; the typical method is to use a VM on the primary VLAN. Option C is incorrect because communication is possible through a promiscuous port on the primary VLAN.

Practice this question →

34

MCQeasy

An administrator is reviewing the network configuration of a standard switch. The exhibit shows the current settings for a port group. Which change would improve load distribution for VM traffic?

A.Change the VLAN ID to 100.

B.Enable failover on the port group.

C.Change the load balancing policy to Route based on IP hash.

D.Set one NIC as active and the other as standby.

AnswerC

IP hash provides better distribution.

Why this answer

Route based on IP hash uses a hash of source and destination IP addresses to determine which uplink to use for each traffic flow, ensuring that all packets in a given flow use the same uplink while distributing different flows across multiple uplinks. This improves load distribution for VM traffic compared to the default Route based on the originating virtual port, which only considers the vNIC port ID and can lead to uneven distribution when multiple VMs share the same port group.

Exam trap

The trap here is that candidates often confuse 'failover' with 'load balancing' and assume enabling failover (Option B) will distribute traffic, but failover only provides redundancy, not active load sharing, while Route based on IP hash (Option C) is the correct method for distributing VM traffic across multiple uplinks.

How to eliminate wrong answers

Option A is wrong because changing the VLAN ID to 100 would alter the VLAN tagging for the port group, which does not affect load balancing or distribution of VM traffic across uplinks. Option B is wrong because failover is already implicitly enabled on a standard switch with multiple uplinks; enabling failover is not a configurable toggle and does not improve load distribution—it only ensures redundancy. Option D is wrong because setting one NIC as active and the other as standby would disable load balancing entirely, forcing all traffic through the active NIC and leaving the standby NIC unused until a failure occurs, which reduces rather than improves load distribution.

Practice this question →

35

MCQhard

An organization is using Network I/O Control (NIOC) on a distributed switch to manage bandwidth for different traffic types. The current configuration assigns 50 shares to management traffic, 50 shares to vMotion traffic, and 100 shares to NFS storage traffic. During peak hours, management traffic is suffering from high latency. The administrator must prioritize management traffic over all others while still ensuring minimum bandwidth for storage. Which action would best address the issue?

A.Increase the shares for management traffic to 200 and reduce vMotion to 25.

B.Set a reservation of 1 Gbps for management traffic and keep shares as they are.

C.Reduce NFS shares to 50 and increase management shares to 100.

D.Enable the 'Limit' setting on management traffic to cap it.

E.Create a network resource pool for management traffic with a guaranteed share value.

AnswerB

Reservation provides a guaranteed minimum bandwidth for management traffic.

Why this answer

Setting a reservation for management traffic guarantees a minimum bandwidth, ensuring it is not starved. Option A increases shares but does not guarantee minimum bandwidth. Option C is wrong because limit would cap traffic, making it worse.

Option D still lacks guarantee. Option E is not a feature of NIOC.

Practice this question →

36

MCQmedium

An administrator configures a VDS with two uplinks and sets the load balancing policy to 'Route based on IP hash'. What additional configuration is required on the physical switches to ensure proper traffic distribution?

A.Use individual ports with no aggregation.

B.Set port security to allow multiple MAC addresses.

C.Enable Link Aggregation Control Protocol (LACP).

D.Configure a static EtherChannel.

AnswerD

Static EtherChannel is required for IP hash load balancing.

Why this answer

IP hash load balancing requires a static EtherChannel on the physical switches to aggregate the two links. Option A is incorrect because using individual ports without aggregation would not properly distribute traffic based on IP hash. Option B is incorrect because port security settings are not related to load balancing.

Option C is incorrect because LACP is not required; IP hash works with a static EtherChannel.

Practice this question →

37

MCQhard

Refer to the exhibit. An administrator notices that the ESXi host is listening on both IPv4 and IPv6 for HTTPS. However, IPv6 traffic is not being forwarded to the host. Which configuration change is most likely needed?

A.Configure a default gateway for the IPv6 stack on the host.

B.Disable IPv6 and use only IPv4.

C.Remove the IPv4 HTTPS listener to force IPv6.

D.Enable IPv6 on the vSphere Distributed Switch.

AnswerA

Without an IPv6 default gateway, traffic cannot be routed to the host.

Practice this question →

38

MCQhard

Refer to the exhibit. An administrator notices that virtual machines on the Production port group are unable to communicate with hosts on VLAN 200. The Management and Storage port groups work fine. What is the most likely cause?

A.The uplinks for DSwitch are not properly configured for VLAN 200.

B.The MTU setting on the DSwitch (9000) is incompatible with the physical network for VLAN 200.

C.The Production port group is not attached to any uplink.

D.There is a VLAN ID mismatch between the virtual switch and physical switch for VLAN 200.

AnswerB

Jumbo frames (MTU 9000) require end-to-end support. If the physical switches do not support jumbo frames on VLAN 200, packets larger than 1500 bytes are dropped.

Why this answer

The exhibit shows that the DVS has MTU 9000 configured, but the Production port group inherits this MTU. If the physical network infrastructure does not support jumbo frames (MTU >1500), traffic on VLAN 200 may be dropped due to fragmentation issues. The Management port group is on VLAN 100 and Storage on VLAN 300, which might be configured differently or not experiencing the issue yet.

The correct answer is that the MTU mismatch causes the Production traffic to fail.

Practice this question →

39

MCQeasy

An administrator needs to configure a vSphere Standard Switch (vSS) for a small environment. Which component must be created first before adding a virtual machine to the network?

A.Create a standard switch.

B.Configure a VMkernel interface.

C.Create a virtual machine port group.

D.Add a physical uplink to the host.

AnswerA

A standard switch is the foundational component; it must be created before any port groups can be added.

Why this answer

A standard switch must exist to create port groups. Without the switch, port groups cannot be created. Option B is incorrect because a VMkernel interface is used for management or storage traffic, not for regular VM connectivity, and it is created after the standard switch.

Option C is incorrect because a virtual machine port group is created on the standard switch after the switch exists. Option D is incorrect because adding a physical uplink to the host occurs during or after standard switch creation, but the switch itself must exist first.

Practice this question →

40

MCQhard

Refer to the exhibit. An administrator checks the status of a distributed switch port and sees no errors or drops. However, virtual machines on this port cannot communicate with the default gateway at 192.168.200.1. What is the most likely cause?

A.The port has no allowed MAC addresses, which may cause filtering.

B.The port is configured with Allowed VLANs 100, 200, 300, which is a trunk configuration, but the virtual machine expects an access port on VLAN 200.

C.The MTU is set to 1500, which is standard and should work fine.

D.The link speed is 10 Gbps, which is sufficient.

AnswerB

The port should be set to VLAN 200 only (access) instead of allowing multiple VLANs. This misconfiguration leads to connectivity issues.

Why this answer

The exhibit shows the port has Allowed VLANs: 100, 200, 300. This is unusual because a port should typically be assigned to a single VLAN (access port) or carry multiple VLANs (trunk port). If the port is set to allow multiple VLANs but the virtual machine expects a specific VLAN, packets may be misconfigured.

However, the most likely cause is that the port is configured as a trunk port (allows multiple VLANs) when it should be an access port for VLAN 200. This can cause the virtual machine to receive traffic from other VLANs or not tag its own traffic correctly.

Practice this question →

41

Multi-Selectmedium

Which THREE of the following are prerequisites for configuring LACP on a vSphere Distributed Switch? (Select exactly three.)

Select 3 answers

A.The vSphere Distributed Switch must be configured with enhanced LACP support.

B.Each uplink must be in a separate VLAN to avoid loops.

C.The physical switch ports must be configured as LACP active or passive.

D.The uplinks must be connected to different physical switches for redundancy.

E.The physical network switch must support LACP (IEEE 802.3ad).

AnswersA, C, E

The vDS version must support LACP; enhanced LACP is available in vSphere 6.0+.

Why this answer

Options A, C, and E are correct. For LACP on a vSphere Distributed Switch, the vDS must be configured with enhanced LACP support (option A). The physical switch ports must be configured for LACP, either in active or passive mode (option C).

Additionally, the physical network switch must support LACP (IEEE 802.3ad) (option E). Option B is incorrect because each uplink does not need to be in a separate VLAN; LACP works across VLANs and VLAN configuration is independent. Option D is incorrect because the uplinks must be connected to the same physical switch to form a LAG; using different switches requires Multi-chassis LACP (e.g., MLAG).

Practice this question →

42

MCQhard

An administrator has configured jumbo frames on a VDS and all physical switches. Virtual machines on different hosts can ping each other but cannot transfer files larger than 1500 bytes. What is the most likely cause?

A.The physical NICs are not configured for jumbo frames.

B.The TCP/IP offload engine is causing fragmentation.

C.The VMkernel adapters are not configured with MTU 9000.

D.The virtual machine's operating system MTU is set to 1500.

AnswerD

The OS MTU must be 9000 for jumbo frames to work.

Why this answer

Jumbo frames require the entire network path, including the virtual machine's operating system, to support the larger MTU. If the VM OS MTU is left at 1500, packets larger than 1500 bytes will be fragmented by the OS or dropped, preventing large file transfers. Option A is incorrect because the problem states physical switches and the VDS are configured for jumbo frames, but the physical NICs must also be configured; however, the question does not indicate they are misconfigured, and the issue is more likely the VM OS.

Option B is incorrect because TCP offload engines typically handle segmentation and checksum, not fragmentation due to MTU mismatch. Option C is incorrect because VMkernel adapters are for management and vMotion traffic, not VM data traffic; VM data uses the VM's own network stack.

Practice this question →

43

MCQmedium

A vSphere administrator is troubleshooting connectivity issues for a virtual machine on a standard switch. The VM is configured with VLAN 100, but cannot ping the default gateway. The VMkernel port on the host is on VLAN 200. The physical switch port connected to the host is configured as a trunk port allowing VLANs 100 and 200. Which action should the administrator take to resolve the issue?

A.Enable promiscuous mode on the VM port group.

B.Change the physical switch port to access mode on VLAN 100.

C.Ensure the VM port group is set to VLAN 100.

D.Set the VM port group VLAN to 4095.

AnswerC

The VM port group must match the VM's VLAN.

Why this answer

The VM is configured with VLAN 100, and the physical switch trunk port already allows VLAN 100 and 200. The VMkernel port on VLAN 200 is working, so the issue is that the VM port group must be explicitly set to VLAN 100 to tag egress frames with VLAN 100 and to accept only VLAN 100-tagged frames on ingress. Option C ensures the standard switch port group applies the correct VLAN ID, matching the physical switch trunk configuration.

Exam trap

The trap here is that candidates often confuse the VM port group VLAN setting with the VMkernel port VLAN, or think that a trunk port on the physical switch automatically passes all VLANs to the VM without requiring the port group to be set to a specific VLAN ID.

How to eliminate wrong answers

Option A is wrong because enabling promiscuous mode on the VM port group allows the VM to see all traffic on the switch, but it does not affect VLAN tagging or connectivity to the default gateway; it is a security setting unrelated to VLAN mismatch. Option B is wrong because changing the physical switch port to access mode on VLAN 100 would strip VLAN tags and break the VMkernel port's connectivity on VLAN 200, which is required for management and other functions; the trunk port is correctly configured. Option D is wrong because setting the VM port group VLAN to 4095 enables VLAN trunking to the VM (allowing the VM to handle its own VLAN tags), but the VM is not configured to tag frames internally; this would cause the VM to send untagged frames that the physical switch would drop or misclassify.

Practice this question →

44

MCQhard

During a period of high network contention, management traffic is starved while NFS traffic gets the most bandwidth. Which configuration change would best address the issue?

A.Increase management shares to 100.

B.Increase the NFS limit to 1000 Mbps.

C.Set a reservation for management traffic.

D.Enable traffic shaping on the management port group.

E.Remove the reservation from vMotion.

AnswerC

Reservation guarantees minimum bandwidth for management.

Why this answer

Setting a reservation for management traffic guarantees a minimum amount of bandwidth, ensuring that management traffic does not get starved even under high network contention. Option A (increasing management shares) improves relative priority but does not guarantee bandwidth. Option B (increasing the NFS limit) would allocate more bandwidth to NFS, worsening the problem.

Option D (enabling traffic shaping on the management port group) affects only outbound traffic on a standard switch and does not use NIOC (Network I/O Control), which is needed for reservation-based guarantees. Option E (removing the vMotion reservation) may free up bandwidth but does not guarantee management traffic receives a minimum.

Practice this question →

45

Multi-Selecthard

Which THREE are valid methods to isolate and secure management traffic on a vSphere Distributed Switch? (Choose three.)

Select 3 answers

A.Enable Route based on IP hash on the management port group.

B.Assign a specific VLAN ID to the management port group.

C.Use Private VLANs on the management port group.

D.Configure the ESXi firewall to restrict management access.

E.Create a dedicated VMkernel port group for management.

AnswersB, D, E

VLANs provide isolation.

Why this answer

Assigning a specific VLAN ID to the management port group isolates management traffic at Layer 2 by tagging frames with a unique VLAN identifier. This prevents unauthorized access from other VLANs and ensures that management traffic is logically separated from other network traffic on the same vSphere Distributed Switch.

Exam trap

The trap here is that candidates often confuse load-balancing policies (like Route based on IP hash) with security features, or they overcomplicate isolation by choosing Private VLANs instead of the simpler and more reliable VLAN assignment.

Practice this question →

46

MCQeasy

An administrator needs to ensure that virtual machines can be migrated between ESXi hosts using vMotion. The virtual machines are connected to a standard vSwitch port group named 'Production'. What must be consistent across all hosts?

A.Port group name 'Production'

B.MTU size

C.Number of uplinks

D.Load balancing policy

AnswerA

Port group name must match for vMotion.

Why this answer

VMotion requires the same port group name on source and target host. Option B is incorrect because MTU may differ if not using jumbo frames. Option C is incorrect because number of uplinks can vary.

Option D is incorrect because load balancing policy does not affect vMotion compatibility.

Practice this question →

47

MCQmedium

An administrator needs to capture traffic from a specific virtual machine for troubleshooting. Which vSphere networking feature should be used?

A.Port mirroring on the VDS.

B.LLDP on the VDS.

C.NetFlow on the VDS.

D.Traffic shaping on the VDS.

AnswerA

Correct. Port mirroring copies traffic from a source to a destination port on a VDS for analysis.

Why this answer

Port mirroring on a VDS (option A) is the correct feature for capturing traffic from a specific virtual machine. It copies all packets from a source port (the VM's port) to a destination port for analysis. Option B (LLDP) is used for discovering network neighbors, not packet capture.

Option C (NetFlow) provides flow statistics and metadata but not full packet capture. Option D (traffic shaping) controls bandwidth, not capture.

Practice this question →

48

MCQhard

A vSphere administrator notices that VMs on a specific ESXi host lose connectivity intermittently. The VMs are on a distributed switch port group. The administrator finds that the Uplink 1 on that host is down. What should the administrator do first?

A.Increase the number of uplinks in the teaming policy

B.Check the physical switch port configuration for the failed uplink

C.Set the load balancing policy to Route based on source MAC

D.Configure a different failover order

AnswerB

The physical switch port might be misconfigured, disabled, or have a faulty cable; this is the most direct troubleshooting step.

Why this answer

The first step is to verify the physical switch port configuration for the failed uplink. The physical switch port may be misconfigured, disabled, or have a faulty cable. Checking this directly addresses the root cause of the down uplink.

Option A (increasing uplinks) would be premature without understanding why the uplink failed. Option C (changing load balancing) and Option D (changing failover order) are potential workarounds but do not fix the down uplink itself. Therefore, the administrator should first check the physical switch port configuration.

Practice this question →

49

MCQmedium

A vSphere administrator notices that after adding a new ESXi host to a vSphere Distributed Switch (vDS), some VMs on existing hosts lose network connectivity intermittently. What is the most likely cause?

A.The vDS MTU setting does not match the physical network MTU.

B.The new host's physical uplink is faulty, causing broadcast storms.

C.The vDS is configured with LACP, and the new host's links are not properly bundled.

D.The vDS Network I/O Control settings are not evenly distributed.

AnswerA

If the vDS uses jumbo frames (MTU 9000) but the physical switch or new host has MTU 1500, large packets may be fragmented or dropped, causing intermittent connectivity.

Why this answer

When a new ESXi host is added to a vDS with a different MTU setting than the physical network, packets may be silently dropped or fragmented, causing intermittent connectivity loss for VMs on existing hosts. This is because the vDS MTU must match the physical network MTU to avoid issues. Option B is incorrect because a faulty physical uplink would affect only VMs on that specific host, not VMs on other existing hosts.

Option C is incorrect because LACP misconfiguration would typically cause issues with the new host's connectivity, not intermittent connectivity for VMs on hosts already in the vDS. Option D is incorrect because Network I/O Control regulates bandwidth allocation and does not cause connectivity loss; such issues would manifest as performance degradation rather than intermittent loss.

Practice this question →

50

MCQmedium

Refer to the exhibit. A virtual machine on the VM Network is experiencing intermittent connectivity. The administrator notices that vmnic0 is saturated. Which action would improve performance without causing a single point of failure?

A.Change the active uplinks for VM Network to vmnic1 only.

B.Increase the MTU on vSwitch0 to 9000.

C.Configure load-based teaming on vSwitch0 for the VM Network portgroup.

D.Move the VM Network to vSwitch1.

AnswerC

Load-based teaming would distribute traffic across both uplinks, reducing saturation.

Practice this question →

51

MCQmedium

The administrator configured this LAG on a distributed switch and corresponding LACP settings on the physical switch. But the LAG is not coming up. What is a likely issue?

A.The load balancing policy should be IP hash.

B.The LAG name is not used by the physical switch.

C.The LAG mode is passive, but the physical switch is also configured as passive.

D.The uplinks should be in active/active mode.

AnswerC

LACP requires one side to be active for negotiation.

Why this answer

When both the vSphere distributed switch LAG and the physical switch are configured in passive mode, LACP negotiation fails because neither side initiates the negotiation. One side must be set to active for LACP to establish. Option A is incorrect because the load balancing policy (e.g., IP hash) is separate from LACP mode; it controls traffic distribution, not LACP negotiation.

Option B is incorrect because the LAG name is not used by LACP; LACP uses system identifiers and port keys, so a name mismatch does not prevent the LAG from coming up. Option D is incorrect because active/active mode refers to the uplink teaming policy, not the LACP mode setting.

Practice this question →

52

MCQeasy

An administrator has created a standard vSwitch port group with VLAN ID 100. Virtual machines in this port group can communicate with each other but not with devices on the physical network. What is a possible cause?

A.The vSwitch has only one uplink.

B.The virtual machines have duplicate MAC addresses.

C.The physical switch port is not configured to pass VLAN 100.

D.The virtual machines are using different subnets.

AnswerC

The physical switch must allow VLAN 100 on the port.

Why this answer

The issue is that VMs on VLAN 100 can communicate among themselves but not with the physical network. This indicates that VLAN tagging is working within the vSwitch (inter-VM communication works), but the physical switch port is not configured to pass VLAN 100 traffic. The uplink from the ESXi host to the physical switch must be set as a trunk port allowing VLAN 100, or if using an access port, it must be set to VLAN 100.

Option A (only one uplink) is sufficient for connectivity. Option B (duplicate MAC addresses) would cause issues even locally. Option D (different subnets) would also affect local communication, but local communication works, so these are not the cause.

Practice this question →

53

MCQeasy

A company has a single ESXi host with a standard switch. The administrator creates a new port group for a DMZ network and assigns a VM to it. The VM cannot ping the default gateway. The physical switch port is configured as a trunk with VLAN 100 allowed. The port group VLAN ID is set to 100. The physical NIC is connected to the switch port and shows link up. What should the administrator do to resolve the issue?

A.Enable VLAN tagging on the physical switch port

B.Change the VLAN ID to 0

C.Verify the VM's IP configuration

D.Add a second physical NIC to the standard switch

AnswerC

If the gateway IP, subnet mask, or default gateway is misconfigured, the VM cannot ping the gateway despite correct VLAN settings.

Why this answer

The physical and virtual networking configurations appear correct (VLAN 100 on both sides, link up), so the issue is likely an IP misconfiguration on the VM itself. Option A (enable VLAN tagging on the physical switch port) is unnecessary as the port group already tags VLAN 100. Option B (change VLAN ID to 0) would break connectivity.

Option D (add a second physical NIC to the standard switch) does not address the connectivity problem.

Practice this question →

54

MCQhard

Refer to the exhibit. An administrator configured beacon probing for network failure detection on the Production port group. However, virtual machines are experiencing intermittent connectivity. What is the most likely reason?

A.There are only two uplinks, and beacon probing requires at least three uplinks.

B.The VLAN ID 200 is not allowed on the physical switch trunks.

C.The DVS version 7.0.0 does not support beacon probing.

D.The load balancing policy is set to Route based on IP hash, which is incompatible with beacon probing.

AnswerA

Beacon probing needs three or more uplinks to properly detect failures. With two uplinks, it can cause flapping.

Why this answer

Beacon probing requires at least three uplinks to function correctly. The exhibit shows only two uplinks (vmnic1 and vmnic2) are active. With two uplinks, beacon probing cannot reliably detect failures because there are not enough beacons to determine which link is down.

This can cause false positives and connectivity issues.

Practice this question →

55

MCQeasy

A network administrator needs to isolate traffic between VMs in the same VLAN on a distributed switch. Which feature should be used?

A.Network I/O Control

B.Private VLAN

C.VLAN trunking

D.Traffic shaping

E.Port binding

AnswerB

Private VLANs allow isolation within a VLAN by defining primary, community, and isolated VLANs, restricting traffic as needed.

Why this answer

Private VLANs enable isolation between VMs within the same VLAN by dividing the VLAN into primary, isolated, and community sub-VLANs. Option A (Network I/O Control) is used for bandwidth allocation and does not provide traffic isolation. Option C (VLAN trunking) allows multiple VLANs over a single link, not isolation within a VLAN.

Option D (Traffic shaping) controls rate limiting, not isolation. Option E (Port binding) determines port membership on a distributed switch, but does not isolate traffic within a VLAN.

Practice this question →

56

MCQmedium

Refer to the exhibit. An administrator cannot resolve the hostname of a DNS server using the ESXi host. What is the most likely cause?

A.The search domain is incorrectly set to localdomain.

B.The DNS servers are unreachable.

C.The DNS servers are not configured correctly for the domain.

D.The ESXi host is not configured to use DNS.

AnswerC

The hostname resolution failed, indicating the DNS server cannot resolve the name.

Practice this question →

57

MCQeasy

A network administrator notices that all traffic from two VMs connected to the same standard switch port group is going through the same physical uplink, causing congestion. The teaming policy is set to Route based on originating virtual port. What change should the administrator make to distribute traffic more evenly?

A.Change teaming policy to Route based on IP hash.

B.Increase the number of uplinks to 4.

C.Enable LACP on the standard switch.

D.Change the load balancing policy to Explicit failover order.

AnswerA

Correctly distributes traffic based on IP pairs.

Why this answer

IP hash uses source and destination IP addresses to distribute traffic across uplinks, providing better load distribution. Option B is incorrect because simply adding more uplinks without changing the teaming policy does not redistribute traffic; the originating virtual port still ties the VM to a single uplink. Option C is incorrect because LACP is not supported on standard vSwitches; it requires a distributed switch.

Option D is incorrect because explicit failover order does not distribute traffic; it only defines active/standby uplinks.

Practice this question →

58

MCQhard

An administrator has enabled jumbo frames (MTU 9000) on a vSphere Distributed Switch. Virtual machines on different hosts cannot communicate, but VMs on the same host can. The physical switches support jumbo frames. What is the most likely cause?

A.The physical switch QoS is misconfigured.

B.The VMkernel adapters are still using default MTU.

C.The distributed switch port group MTU is set to 1500.

D.The physical NICs are not configured with MTU 9000.

AnswerD

Correct. The physical NICs (vmnic) must also be set to MTU 9000 for jumbo frames to work across hosts.

Why this answer

Jumbo frames must be enabled on the physical NICs (vmnic) as well as the virtual switch. If the physical NICs are still set to MTU 1500, frames larger than 1500 bytes will be dropped when they reach the physical switch port, preventing inter-host communication while intra-host communication remains unaffected. Option A is incorrect because QoS configuration does not relate to MTU issues.

Option B is incorrect because VMkernel adapters are used for management and vMotion traffic, not VM data traffic. Option C is incorrect because the distributed switch port group MTU is inherited from the DVS, which already has MTU 9000.

Practice this question →

59

Drag & Dropmedium

Order the steps to perform a vMotion migration of a powered-on virtual machine.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Prerequisites check, initiate migration, select type, choose destination, and confirm.

Practice this question →

60

Multi-Selecteasy

Which two conditions must be met for a VMkernel adapter to be used for vMotion on a distributed switch? (Choose two.)

Select 2 answers

A.The VMkernel adapter must be in the same subnet as the destination host.

B.The VMkernel adapter must be enabled for vMotion.

C.The physical uplinks must be in active/standby mode.

D.The port group must have VLAN ID 0.

E.The port group must be configured with a static IP address.

AnswersA, B

vMotion requires IP connectivity between hosts on the same subnet.

Why this answer

Options A and B are correct. The VMkernel adapter must be in the same subnet as the destination host (A) to allow vMotion traffic to route properly, and it must be enabled for vMotion (B) in the adapter properties. Other options are not required: active/standby mode (C) is not a requirement; VLAN ID can be any valid VLAN (D); and static IP is not necessary (E) as DHCP can be used.

Practice this question →

61

MCQmedium

A virtual machine connected to the 'VM Network' port group is unable to obtain an IP address from the DHCP server located on the same subnet (192.168.1.0/24). The DHCP server is connected to the physical switch which is configured as an access port for VLAN 100. What is the most likely cause of the issue?

A.The physical uplink vmnic0 is not configured as a trunk on the physical switch.

B.The port group should use a different VLAN ID.

C.The standard switch has MTU of 1500 but DHCP uses 1500.

D.The DHCP server is on a different VLAN.

E.The VMkernel port vmk0 has an IP address in the same subnet but is not required for DHCP.

AnswerB

Correct. The VM Network port group defaults to VLAN 0, placing the VM in a different VLAN from the DHCP server (VLAN 100). Configuring the port group with VLAN 100 aligns the broadcast domains and resolves the issue.

Why this answer

The virtual machine is connected to the default 'VM Network' port group, which has VLAN ID 0 (no VLAN tagging), sending untagged traffic. The DHCP server is connected to a physical switch port configured as an access port for VLAN 100, placing it in VLAN 100. Because the VM and the DHCP server are on different VLANs, they cannot communicate at Layer 2, preventing DHCP discovery broadcasts from reaching the server.

The most likely cause is that the port group should use a different VLAN ID (VLAN 100) to match the DHCP server's VLAN. Changing the port group to VLAN 100 will tag the traffic, requiring a trunk on the physical uplink, but the root cause is the VLAN mismatch, not solely the uplink configuration.

Exam trap

Candidates may assume the physical switch uplink configuration is the only factor, overlooking that the default VM Network port group (VLAN 0) places the VM in a different VLAN than the DHCP server. The primary misconfiguration is the port group VLAN setting, not the trunk mode of the physical switch.

How to eliminate wrong answers

Option B is wrong because the port group should use VLAN ID 100 to match the access port's VLAN, not a different ID. Option C is wrong because MTU 1500 is standard for Ethernet and DHCP; mismatched MTU would cause fragmentation issues, not DHCP failure. Option D is wrong because the DHCP server is on the same subnet (192.168.1.0/24) and connected to an access port for VLAN 100, so it is on the same VLAN as the VM's intended network.

Option E is wrong because the VMkernel port vmk0 is used for vSphere management traffic, not for VM DHCP; its IP address is irrelevant to VM network connectivity.

Practice this question →

62

MCQhard

An ESXi host has two physical uplinks (vmnic0, vmnic1) connected to a distributed switch. The administrator wants to use LACP to aggregate these uplinks to a physical switch stack. Which prerequisite must be met for LACP to work with a distributed switch?

A.The physical switch must be configured with a static LAG.

B.The distributed switch version must be 5.5 or later.

C.The uplinks must be in an active/standby configuration.

D.The distributed switch must be configured with a LAG and the physical switch with matching LACP settings.

E.The LACP group must have a unique MAC address.

AnswerD

A LAG must be created on the DVS, and the physical switch must be configured with compatible LACP parameters.

Why this answer

For LACP to work with a distributed switch, the distributed switch must be configured with a Link Aggregation Group (LAG) and the physical switch must be configured with matching LACP settings. Option A is incorrect because LACP requires a dynamic LAG on the physical switch, not static. Option B is incorrect because LACP support for distributed switches was introduced in vSphere 5.1, not 5.5.

Option C is incorrect because LACP requires active/active configuration, not active/standby. Option E is not a prerequisite; LACP uses the physical MAC addresses of the uplinks.

Practice this question →

63

MCQhard

A company operates a three-node vSphere cluster for a critical application. Each ESXi host has two 10GbE physical NICs (vmnic0 and vmnic1) connected to two separate physical switches (Switch A and Switch B) for redundancy. The cluster uses a vSphere Distributed Switch (vDS) with two uplinks per host: uplink1 (vmnic0) connected to Switch A, and uplink2 (vmnic1) connected to Switch B. The teaming policy is set to 'Route based on originating virtual port' with both uplinks active. The physical switches are configured in a multi-chassis link aggregation group (MLAG) that bundles the ports from both switches into a single LAG interface. The LAG is configured with mode 'active' (802.3ad). Recently, the cluster experienced a network outage when one of the physical switch uplinks failed. The VMs on the affected host lost connectivity for several seconds before recovering. The administrator wants to prevent such outages in the future. Which action should the administrator take?

A.Disable LACP on the physical switches and configure the vDS with 'Route based on originating virtual port' only.

B.Add a third physical NIC to each host and configure it as a standby uplink.

C.Change the vDS teaming policy to 'Use explicit failover order' with vmnic0 active and vmnic1 standby.

D.Configure the vDS with LACP support and set the teaming policy to 'Route based on IP hash'.

AnswerD

This aligns the vDS with the physical LAG.

Why this answer

The current configuration uses a static LAG (MLAG) on the physical switches with 802.3ad active mode, but the vDS is not configured for LACP. This mismatch causes the vDS to send frames based on originating virtual port, which does not coordinate with the physical LAG's hashing algorithm. When a physical uplink fails, the MLAG may not properly redistribute traffic because the vDS is unaware of the LAG state, leading to connectivity loss.

Configuring the vDS with LACP support and setting the teaming policy to 'Route based on IP hash' aligns the virtual and physical LAG configurations, ensuring proper load balancing and failover behavior.

Exam trap

The trap here is that candidates assume 'Route based on originating virtual port' with two active uplinks provides adequate failover, but they overlook the critical requirement for LACP coordination when the physical switches are configured with an active-mode LAG (802.3ad), leading to a mismatch that causes delayed failover.

How to eliminate wrong answers

Option A is wrong because disabling LACP on the physical switches and keeping 'Route based on originating virtual port' would break the existing MLAG configuration, potentially causing loops or inconsistent forwarding, and does not address the root cause of the outage. Option B is wrong because adding a third NIC as a standby uplink does not resolve the mismatch between the vDS teaming policy and the physical LAG; the outage occurred due to improper failover coordination, not a lack of physical redundancy. Option C is wrong because changing to 'Use explicit failover order' with one active and one standby would eliminate the active-active load balancing and still not coordinate with the physical LAG's hashing, so a single uplink failure could still cause traffic disruption if the vDS does not properly detect the LAG state.

Practice this question →

64

MCQeasy

A virtual machine is configured with two vNICs connected to different standard port groups (VLAN 10 and VLAN 20). The administrator wants to use both vNICs for load balancing and failover within the VM OS. Which condition must be met on the vSwitch side?

A.Enable MAC address changes on both port groups.

B.Configure teaming on the standard switch by bridging the two port groups.

C.Configure NIC teaming within the guest operating system.

D.Set load balancing to 'Route based on IP hash' on both port groups.

AnswerC

Since the vNICs are on separate port groups, the VM OS must handle load balancing and failover via software teaming (e.g., bond).

Why this answer

The VM OS must have NIC teaming configured to use both interfaces. The vSwitch port groups are separate, so they don't team at the virtual switch level. Option A is incorrect because teaming at vSwitch is per port group, not across port groups.

Option B is incorrect because MAC address changes are not needed. Option D is incorrect because route based on IP hash is for a single port group.

Practice this question →

65

MCQeasy

An administrator is creating a new vSphere Standard Switch on an ESXi host. The host has two physical NICs: vmnic0 and vmnic1. The administrator wants to use vmnic0 for VM traffic and vmnic1 for management traffic. How should the administrator configure the switch?

A.Create one standard switch with vmnic0 only and use VLANs for separation.

B.Create one standard switch with both vmnics and separate port groups for VM and VMkernel.

C.Create two standard switches: one with vmnic0 and a VM port group, and another with vmnic1 and a VMkernel port group.

D.Create a vSphere Distributed Switch with both vmnics.

AnswerC

Separation of traffic types.

Why this answer

The requirement is to use separate physical NICs for different traffic types (VM traffic on vmnic0 and management traffic on vmnic1). In vSphere, a standard switch is a per-host virtual switch that connects virtual machines and VMkernel interfaces to physical NICs. To isolate traffic at the physical NIC level, you must create two distinct standard switches: one with vmnic0 and a VM port group for VM traffic, and another with vmnic1 and a VMkernel port group for management traffic.

This ensures that management traffic never traverses vmnic0 and VM traffic never traverses vmnic1, providing physical separation and avoiding contention.

Exam trap

The trap here is that candidates often assume a single standard switch with multiple uplinks and separate port groups is sufficient for traffic separation, but they overlook that physical NIC assignment is per-switch, not per-port-group, so both traffic types could still share the same NICs via teaming or failover unless explicit NIC binding is configured.

How to eliminate wrong answers

Option A is wrong because creating a single standard switch with only vmnic0 and using VLANs for separation does not physically separate management traffic onto vmnic1; management traffic would still be forced through vmnic0, violating the requirement. Option B is wrong because creating one standard switch with both vmnics and separate port groups for VM and VMkernel traffic would allow both traffic types to use either NIC (via teaming or failover), failing to enforce the dedicated NIC assignment. Option D is wrong because a vSphere Distributed Switch (VDS) requires vCenter Server and is not created directly on an ESXi host; it also does not inherently force specific traffic types to dedicated physical NICs without explicit configuration, and the question specifies a standard switch.

Practice this question →

66

MCQmedium

An administrator configures a distributed switch with a single uplink on each host and a port group with VLAN 10. After connecting a VM to the port group, the VM cannot communicate with other VMs on the same VLAN but on different hosts. What is a likely cause?

A.The physical switch port is set to access mode with VLAN 10.

B.The distributed switch has no teaming configured.

C.The physical switch port connected to the uplink is set to trunk mode and is tagging the VLAN.

D.The VLAN ID is not set correctly on the VM's virtual network adapter.

AnswerA

Access mode expects untagged traffic, but vSphere tags frames, causing communication failure.

Why this answer

When the physical switch port is in access mode with VLAN 10, it expects untagged frames. However, the distributed port group with VLAN 10 tags the frames with VLAN 10. This mismatch causes the physical switch to drop or mishandle the traffic, preventing the VM from communicating with other VMs on the same VLAN across hosts.

Option B is incorrect because teaming is not required for basic connectivity; a single uplink suffices. Option C describes trunk mode which would actually accept tagged frames, so it would work. Option D is incorrect because the VLAN ID is configured on the port group, not on the VM's virtual adapter.

Practice this question →

67

Drag & Dropmedium

Order the steps to enable vSphere HA on a cluster.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct sequence for enabling vSphere HA ensures that all prerequisites are met, starting with cluster selection, then accessing the HA configuration page, toggling the enable option, customizing settings, and applying changes. Common mistakes include attempting to configure options before enabling HA or accessing settings before selecting the cluster.

Practice this question →

68

MCQeasy

An administrator needs to separate vMotion traffic from management traffic. Which should be created?

A.A new physical NIC.

B.A new VMkernel adapter on a different subnet.

C.A new VLAN on the existing port group.

D.A new standard switch port group.

AnswerB

A separate VMkernel adapter on a different network isolates vMotion traffic.

Why this answer

Creating a separate VMkernel adapter on a different subnet isolates vMotion traffic from management traffic. Option A is incorrect because a new physical NIC alone does not provide network separation; a separate VMkernel adapter and IP subnet are required. Option C is incorrect because using the same VLAN but different IP subnet still shares the same broadcast domain.

Option D is incorrect because a new standard switch port group alone does not separate traffic without a different IP network for the VMkernel adapter.

Practice this question →

69

Multi-Selecthard

An administrator needs to implement Network I/O Control (NIOC) on a vSphere Distributed Switch to guarantee bandwidth for vSphere Replication traffic. Which two actions are required?

Select 2 answers

A.Enable NIOC on the distributed switch.

B.Create a network resource pool for vSphere Replication.

C.Set the replication VMkernel adapter's traffic shaping to guaranteed.

D.Configure the replication network on a separate VLAN.

E.Assign the vSphere Replication VMkernel adapter to the resource pool.

AnswersA, B

NIOC must be enabled globally on the DVS.

Why this answer

Options A and B are the two actions required to implement NIOC for vSphere Replication. NIOC must first be enabled on the distributed switch (A), then a network resource pool must be created for the replication traffic (B). Option C is incorrect because traffic shaping is a separate rate-limiting mechanism and is not used with NIOC; NIOC relies on resource pools for guaranteed bandwidth.

Option D is incorrect because a separate VLAN provides network segmentation but does not guarantee bandwidth; NIOC is needed for that. Option E is incorrect because assigning the VMkernel adapter to the resource pool is a subsequent step that is necessary but not one of the two primary actions asked for in the question.

Practice this question →

70

Multi-Selectmedium

Which TWO of the following are functions of a vSphere Distributed Switch that are not available in a vSphere Standard Switch? (Select exactly two.)

Select 2 answers

A.Port mirroring (Distributed Port Mirroring).

B.NIC teaming with explicit failover order.

C.Network I/O Control (NIOC).

D.Traffic shaping policies.

E.VLAN tagging and trunking.

AnswersA, C

Distributed switches support advanced port mirroring; standard switches only have basic mirroring via third-party solutions.

Why this answer

Options A and C are correct. Port mirroring (Distributed Port Mirroring) is a feature exclusive to the vSphere Distributed Switch (vDS). Network I/O Control (NIOC) is also only available on vDS, allowing for bandwidth allocation and prioritization.

Option B is incorrect because NIC teaming with explicit failover order is available on both standard and distributed switches. Option D is incorrect because traffic shaping policies are available on vSphere Standard Switches (vSS) at the port group level. Option E is incorrect because VLAN tagging and trunking are supported on both switch types.

Practice this question →

71

MCQmedium

An organization has deployed a vSphere Distributed Switch (vDS) across multiple ESXi hosts. The security team requires that no virtual machine can change its MAC address to impersonate another device. Which security policy setting on the distributed port group should be configured to fulfill this requirement?

A.Set 'Forged transmits' to 'Reject'.

B.Set 'MAC address changes' to 'Reject'.

C.Set 'Promiscuous mode' to 'Reject'.

D.Enable traffic shaping and set a low average bandwidth.

AnswerA

When forged transmits is rejected, the vSwitch drops frames that do not originate from the VM's actual MAC address, thus preventing MAC spoofing.

Why this answer

The 'Forged transmits' policy, when set to 'Reject', drops any outbound frames with a source MAC address different from the one assigned to the virtual NIC. This prevents a VM from impersonating another device by spoofing its MAC address. Option B is incorrect because 'MAC address changes' controls whether the VM can change its effective MAC address, but this does not prevent the VM from sending frames with a forged source MAC.

Option C is incorrect because 'Promiscuous mode' allows the VM to see all traffic on the port, which is a security risk but unrelated to MAC impersonation. Option D is incorrect because traffic shaping limits bandwidth, not MAC security.

Practice this question →

72

MCQhard

Refer to the exhibit. An engineer tries to ping the DNS server 10.0.0.1 from the management interface vmk0 but gets 'Network is unreachable'. What is the most likely cause?

A.The DNS server 10.0.0.1 is down.

B.The MTU of 1500 is too small for DNS traffic.

C.The vmk0 interface does not have a default gateway configured; the default gateway is on vmk1.

D.The DNS server IP address is misconfigured.

AnswerC

vmk0's subnet is 192.168.10.0/24, and there is no route for 10.0.0.1 via vmk0. The default route goes through vmk1, but vmk0 cannot use that gateway because it's on a different subnet.

Why this answer

The routing table shows the default gateway is on vmk1 (192.168.20.1), but vmk0 is on a different subnet (192.168.10.0/24). Traffic from vmk0 to 10.0.0.1 is not directly reachable and must go through a gateway. Since there is no route for 10.0.0.0/24 or default route via vmk0, the kernel reports network unreachable.

The correct fix is to add a default gateway on vmk0 or a specific route.

Practice this question →

73

Matchingmedium

Match each vSphere feature to its correct description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Distributes VM workloads across hosts based on resource usage

Provides continuous availability by maintaining a secondary VM

Migrates VM storage without downtime

Powers hosts on/off to save energy based on demand

Standardizes host configuration across a cluster

Why these pairings

Key vSphere features: vMotion (live migration), HA (automatic restart), DRS (load balancing), FT (continuous availability via lockstep). Common confusions involve swapping the feature and its description.

Practice this question →

74

MCQmedium

A VM on a vSphere Distributed Switch is unable to receive traffic from external networks. The VM can send traffic out successfully. The VM port group has no security policies set (default). The physical switch port is configured as an access port on VLAN 100. The VM port group VLAN is set to 100. What is the most likely cause?

A.VLAN mismatch between VM port group and physical switch

B.The VM's NIC is in promiscuous mode

C.The VM is using a different default gateway than the VMkernel interface

D.The physical switch port is configured as an access port instead of a trunk

AnswerC

Asymmetric routing can cause one-way traffic.

Why this answer

The VM can send traffic out successfully but cannot receive traffic from external networks, which indicates a routing issue rather than a switching or VLAN problem. The most likely cause is that the VM's default gateway is set to the VMkernel interface's IP address instead of the physical network's gateway, causing return traffic to be misrouted. This is a common misconfiguration where the VM's default gateway does not match the subnet's gateway, preventing inbound traffic from reaching the VM.

Exam trap

The trap here is that candidates often focus on VLAN configuration or switch port modes when the symptom is unidirectional traffic, but the real issue is a routing misconfiguration at the VM's default gateway, which is a common oversight in vSphere networking troubleshooting.

How to eliminate wrong answers

Option A is wrong because the VM port group VLAN is set to 100 and the physical switch port is configured as an access port on VLAN 100, which is a correct match; a VLAN mismatch would cause both inbound and outbound traffic to fail. Option B is wrong because promiscuous mode on the VM's NIC allows it to see all traffic on the VLAN, but it does not prevent the VM from receiving traffic destined to its own MAC address; it would not cause a unidirectional traffic issue. Option D is wrong because an access port on VLAN 100 is the correct configuration for a single VLAN; a trunk port would be needed only if multiple VLANs were required, and using an access port does not inherently block inbound traffic.

Practice this question →

75

Multi-Selectmedium

Which TWO conditions must be met to successfully enable vSphere Network I/O Control (NIOC) on a vSphere Distributed Switch? (Choose two.)

Select 2 answers

A.All ESXi hosts in the cluster must be connected to the same vDS.

B.Each ESXi host must have a dedicated vDS.

C.The vDS must have at least one uplink.

D.The vSphere license must be Enterprise Plus.

E.The physical switches must support LACP.

AnswersA, D

NIOC is configured on the vDS.

Why this answer

NIOC operates at the vDS level and requires all hosts participating in the NIOC configuration to be attached to the same distributed switch. This ensures consistent network resource allocation and traffic shaping policies across the cluster. Option D is correct because NIOC is a premium feature that requires an Enterprise Plus license, as it leverages advanced resource management capabilities not available in lower license tiers.

Exam trap

The trap here is that candidates often confuse NIOC's dependency on Enterprise Plus with other networking features like LACP or uplink requirements, leading them to select options C or E instead of recognizing the license and shared vDS prerequisites.

Practice this question →

Page 1 of 2 · 78 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Configure and Manage vSphere Networking questions.

Start 20-question session