VMware vSphere Foundation 9.0 Administrator (VCP-VVF, 2V0-16.25) (VCP-VVF) (VCP-VVF) — Questions 1–75

Expandable Reservation lets a child pool borrow beyond its own reservation, drawing on the parent's unreserved capacity. It takes effect only once the child's reservation is fully consumed and the parent still holds unreserved resources available for lending.

An orphaned VM remains visible in vCenter inventory, but its ESXi host no longer acknowledges or manages it, typically after host disconnection or inventory mismatch. The VM's files may still exist on datastores, but vCenter cannot control it.

With four identical hosts and a one-host failure tolerance, the percentage policy must reserve enough capacity to absorb a single host's workload. Reserving 25 percent of cluster CPU and memory equals exactly one host's share (1 ÷ 4), satisfying the FTT = 1 constraint without over-reserving.

The HCL lists supported hardware components for each ESXi version. Verifying that the host model, network adapters, storage controllers, and other devices are on the HCL for the ESXi version in the image ensures that the image will function correctly after remediation. This proactive check prevents failures due to unsupported hardware.

vLCM integrates with hardware support managers to apply firmware updates as part of the desired image, satisfying the stem's host maintenance requirement. Firmware is managed alongside ESXi software, ensuring validated, consistent firmware levels across every host in the cluster.

A VM-Host affinity rule binds the VM to a Host Group of the two designated hosts, enforcing placement and restricting it from the other four. This satisfies the strict licensing constraint requiring the VM to run only on those hosts.

Group-based assignment lets you grant roles once to an Active Directory or OpenID group, so membership changes inherit permissions automatically. This satisfies the stem's recommended practise by avoiding per-account maintenance and reducing the risk of orphaned or excessive individual permissions.

NFS 4.1 introduces session trunking and native client-side multipathing, allowing multiple TCP connections across paths for load balancing and failover. NFSv3 lacks this, relying on a single path, so this satisfies the stem's requirement for a key architectural advantage in vSphere.

vCenter parses the uploaded IdP metadata XML against the SAML schema before trusting the external identity provider. Malformed syntax or an unsupported schema declaration breaks that parse, producing the metadata parsing error during Identity Provider configuration.

Software iSCSI relies on standard TCP/3260, so any firewall blocking that port breaks target sessions entirely. Equally, multipathing requires the physical switch ports and ESXi uplinks to carry multiple paths; without that underlying fabric support, the iSCSI adapter cannot present more than one viable route.

Right-clicking the host and selecting 'Export System Logs' invokes the host's support-bundle generation, aggregating vm-support output into a single downloadable archive. This satisfies the stem's requirement to collect ESXi 9.0 logs for VMware Global Support Services directly through the vSphere Client, without SSH or DCUI access.

Solution User certificates authenticate vCenter services to one another and to Single Sign-On. When trust breaks, these certificates may need manual replacement or refresh, satisfying the stem's requirement to name components requiring certificate remediation in VVF.

Yellow memory alarms trigger on the alarm definition's consumed or active memory threshold, not on unallocated physical RAM. A host can retain free RAM while active or consumed memory exceeds the configured warning level, raising the alarm.

The conflict arises because an independently installed VIB duplicates or contradicts a dependency in the vendor add-on. Removing that independent VIB from the image specification, or updating the add-on, resolves the dependency tree so compliance can be restored.

Joining ESXi and vCenter Server to a directory domain relies on LDAP for directory queries and Kerberos for authentication and ticket issuance. This is the standard directory integration model in vSphere Foundation 9.0. It enables centralized authentication against the existing directory service and supports single sign-on for administrative access, matching the design requirement for an industry-standard protocol.

Jumbo frames at 9000 bytes reduce per-packet processing overhead and packet count, while 10GbE or 25GbE+ provides the bandwidth all-flash vSAN needs to sustain heavy database I/O. This satisfies the stem's requirement for dedicated high-speed vSAN VMkernel networking.

A dedicated distributed port group with its own VLAN ID segments vMotion traffic at Layer 2, satisfying the isolation requirement. Unlike NIOC, which only prioritises bandwidth on a shared uplink, a separate VLAN keeps vMotion frames off other traffic types entirely, preventing contention with management, vSAN or VM traffic.

Stretched clusters require low-latency, high-bandwidth inter-site links because vMotion and storage traffic traverse the interswitch link continuously. Insufficient ISL capacity or latency degrades HA failover and vSAN performance across sites, so redundant ISLs sized for peak workload mobility and storage replication satisfy this design constraint.

Manual mode makes DRS produce migration recommendations whenever the cluster becomes imbalanced, but no vMotion task runs until an administrator reviews and applies each one. This satisfies the stem's constraint: automatic rebalancing is absent because remediation stays administrator-driven, unlike Fully Automated mode, which executes recommendations itself.

Supervisor control plane VMs require their own dedicated management network IP block that does not overlap existing vSphere networks, since each control plane node consumes an address. Verifying this allocation before enabling the Supervisor prevents address conflicts and deployment failures.

The vDS Topology view maps each uplink (vmnic) to its assigned physical adapter, directly satisfying the need to identify which vmnics serve specific uplinks. Uplink port group settings also list the active and standby vmnic assignments per uplink, confirming the physical adapter mapping.

A virtual TPM 2.0 device is supported on vSphere Foundation 9.0 virtual machines and enables guest features such as BitLocker and measured boot. Including it in the baseline ensures new workloads can use encryption and attestation without hardware changes later. It is a standard, broadly supported capability rather than a niche add-on.

NSX Distributed Firewall enforces stateful rules in the kernel of each ESXi host's virtual switch, inspecting east-west traffic at the vNIC before it leaves the host, so inter-VM filtering occurs in-guest-network without hairpinning to a physical appliance.

vLCM provides image-based cluster management, where a desired-state image defines ESXi base image, firmware add-ons and components, plus drift and compliance monitoring against that image. This satisfies the stem's requirement for centralised lifecycle management and image-based updates across the cluster.

DAVG measures the physical array's service time for read or write commands, excluding VMkernel queue latency, which is KAVG. This satisfies the stem's requirement to isolate array-side latency from queueing delays when analysing storage performance in esxtop's device view.

Deselecting the memory tickbox produces a crash-consistent snapshot containing only the VM's disk state and configuration. The .vmsn memory file is omitted, so no RAM contents are captured, reducing snapshot size and avoiding quiescing of running memory.

VM Encryption encrypts virtual machine files and disks at rest using keys from a KMIP-compliant server, so stolen disks or servers yield unreadable data. This directly addresses the physical theft threat at the ROBO site.

Co-stop arises because the hypervisor must co-schedule all 32 vCPUs simultaneously, yet only 16 physical cores exist. This strict co-scheduling forces vCPUs to wait for a complete set of free cores, inflating %RDY. The oversized vCPU-to-core ratio directly causes the scheduling delays observed in esxtop.

Snapshot privileges reside under the Virtual Machine, State category, covering create, revert, consolidate and delete operations. Selecting this category satisfies the stem's requirement to grant snapshot management, since permissions there control the VM's snapshot state rather than configuration or interaction.

vSphere HA admission control reserves capacity in the cluster to guarantee failover. If the policy is configured to reserve a large percentage or a specific number of host failures, the cluster may consider itself unable to admit a new VM even though hosts have free CPU and memory. This is the feature that most directly blocks power-on with an insufficient-resources error.

The Direct Console User Interface runs locally on the ESXi host console, providing exactly the basic operational tasks named: shutting down or restarting the host, configuring the management network, and restarting services. It requires no vCenter Server or network connectivity, satisfying the stem's requirement for per-host administration.

HA Admission Control reserves cluster capacity before failover, guaranteeing sufficient resources exist to restart affected VMs on surviving hosts. It directly satisfies the stem's requirement that host failure leaves enough capacity, by blocking power-ons that would consume the reserved failover buffer.

LDAPS wraps directory authentication in TLS, encrypting credentials and queries in transit, whereas plain LDAP transmits them in cleartext. This directly satisfies the stem's security constraint by preventing credential interception during bind operations against Microsoft Entra ID-integrated or on-premises directory services.

The vCenter Server Licensing dashboard aggregates all licence keys across the SDDC, showing capacity and expiration dates in one consolidated view. This directly satisfies the requirement to check vSphere Foundation licence capacity and expiry, since vSphere Foundation licensing is managed through vCenter Server rather than separate per-component interfaces.

Hot-add vCPU lets a running VM gain processors through the VMX device model, which signals the guest OS to bring the new vCPUs online dynamically. This satisfies the no-downtime constraint, provided the guest supports CPU hot-plug and the VM's configured socket/core limits permit the addition.

Directory groups centralise authorisation: permissions bind to the group object, so membership changes in Active Directory propagate automatically without editing vCenter roles per user. This satisfies the best-practise requirement for scalable, auditable privilege assignment across the integrated identity source.

Exceeding licensed VVF capacity places the cluster in a non-compliant state, satisfying the stem's constraint on over-capacity growth. vSphere Foundation licensing is capacity-based, so adding hosts beyond entitlement breaches the licence terms; vCenter reports non-compliance rather than blocking workloads, preserving operations while flagging remediation.

Aria Operations vSAN dashboards aggregate vSAN performance metrics across the cluster, while metric correlation views align them with compute and storage data to expose bottlenecks. This satisfies the stem's requirement for diagnostic tooling spanning both vSphere and Aria Operations, pinpointing whether degradation originates in vSAN itself or underlying resources.

The host-level Time Configuration page under Configure → System exposes the NTP client service directly, letting the administrator add or edit NTP servers and start, stop or restart the service on that specific ESXi host. This satisfies the stem's requirement to configure or restart NTP for the host itself, not cluster-wide.

Host Profiles capture a reference host's configuration—networking, storage, security and advanced settings—then remediate other hosts against it, satisfying the requirement to standardise configuration across the cluster. Compliance checking flags drift, and remediation reapplies the reference values, ensuring consistent, repeatable host settings without manual reconfiguration.

The sddc-manager.log records SDDC Manager's internal operations and outbound API calls, including the payloads sent when configuring a new host's Distributed Switch uplinks. It is therefore the first place to inspect for the failing API payload during cluster expansion.

vLCM image remediation fails because the third-party IOVP driver is absent from the target image; adding a compatible vendor add-on or updated component version to the cluster image specification supplies a driver version matching the target ESXi release.

Image-based remediation uses a single image that defines the desired ESXi version, firmware, and drivers for all hosts in the cluster. vLCM continuously monitors hosts for compliance with the image and reports drift. Remediation applies the image to bring hosts back into compliance, ensuring uniformity across the cluster.

Locked redo logs usually stem from an active backup task or third-party appliance holding the snapshot. Checking vSphere tasks, the backup appliance's status, and host logs identifies the process holding the lock, satisfying the stem's need to locate the external lock before consolidation can proceed.

The vSphere Client Certificate Management interface is where trusted root CA certificates are imported and mapped to vCenter Server, establishing the trust chain for secure communication. Updating the root CA here propagates trust to services and ESXi, satisfying the stem's certificate lifecycle requirement.

Namespace permissions in vSphere Supervisor are scoped per namespace, not per cluster or user. Selecting the target namespace under Workload Management exposes its own Permissions tab, letting the developer team be granted the namespace-scoped role the stem requires, without granting cluster-wide rights.

A VMDK on VMFS or NFS is the native virtual disk format, provisioned through the datastore and attached directly to the VM's virtual SCSI or NVMe controller. This satisfies the requirement for storage natively provisioned and attached within vSphere.

vCenter's Tasks and Events view retains task and event records, capturing user logins and administrative operations with timestamps and initiating user. It satisfies the 30-day audit requirement because events persist in the vCenter database per retention settings, giving the administrator the required historical trail.

In a 2-node direct-connect topology, neither host can hold quorum alone, so a Witness Node in a third failure domain supplies the tie-breaker vote. Without it, a network partition between the two hosts risks split-brain, with both sides claiming the vSAN datastore.

vSphere Foundation 9.0 supports NTP as the standard time synchronization protocol for both ESXi hosts and vCenter Server. Using NTP keeps host and vCenter clocks aligned, which is required for certificate validation, Kerberos authentication, and accurate log correlation. It is the protocol the architect should document as the supported baseline.

Selecting Cluster > Updates > Check Compliance triggers vLCM's desired-state reconciliation, comparing each host's installed firmware and software against the cluster's image specification. This directly satisfies the scenario's requirement to verify host compliance with the desired image, initiating the scan from the cluster-level Updates tab where image drift is reported.

Administrator holds the most privileges by default, including full control over all inventory objects, permissions, and system configuration. Other roles such as Read Only or No Access grant strictly narrower scopes, making Administrator the highest-privilege built-in role.

Secure Shell provides encrypted, authenticated command-line access to the ESXi host's shell, satisfying the requirement for secure administration and troubleshooting. Unlike the deprecated Telnet service, SSH encrypts all traffic, including credentials, and is enabled per host through the vSphere Client or ESXi Shell settings.

Triggering the notification action from the alarm definition menu exercises the alerting path without altering host or datastore state, so no production outage occurs. Simulating the event in a test cluster provides the same verification while satisfying the stem's constraint of testing safely.

Clock skew between vCenter and the external Identity Provider invalidates OIDC token timestamps, causing validation failures. Synchronising NTP on both the vCenter Server appliance and the IdP aligns their clocks, restoring successful token validation during federated authentication.

Host Profiles captures a reference host's configuration as a profile, then continuously checks every attached host against it and remediates drift automatically. This directly satisfies the requirement for compliance checking plus automated remediation across all 20 hosts, preventing configuration drift without manual per-host auditing.

The Supervisor cluster's storage policy must reference a datastore that supports the required capabilities, such as vSAN, because Workload Management provisions control plane and Tanzu Kubernetes Grid nodes on that backing storage. A policy tied to an incompatible datastore fails validation.

Round Robin cycles I/O across all active paths, using them simultaneously and distributing load. It is the recommended default path selection policy for active-active storage arrays and satisfies the design goal of leveraging every available path. This makes it the correct choice for the Fibre Channel array described.

vSAN health and performance monitoring is surfaced under the cluster object's Monitor tab, in the vSAN section. Cluster > Monitor > vSAN > Health and Performance is the primary dashboard location, satisfying the requirement to check vSAN storage service health across the cluster.

The VMCA Root Certificate is one of the three certificate types vSphere Certificate Manager handles, allowing renewal or replacement of the internal certificate authority that signs all other vSphere certificates. This satisfies the stem's requirement to identify a managed certificate type.

The Monitor tab's Performance view, switched to Advanced, renders real-time CPU and memory charts for the selected VM, satisfying the requirement to observe live usage in the vSphere Client. Advanced mode exposes per-metric counters and time ranges that the Summary overview omits, giving the granular real-time graphs requested.

Default DRS load balancing consumes active memory and CPU demand metrics, not configured static allocations, so it satisfies the stem's requirement to balance virtual machines on genuine utilisation. This is the standard metric set for Fully Automated clusters.

NVMe over RDMA with RoCEv2 uses Remote Direct Memory Access to transfer data directly between host and array memory, bypassing the CPU and TCP/IP stack. This minimizes CPU overhead and supports end-to-end congestion control through Explicit Congestion Notification, which is critical for latency-sensitive database workloads on a lossless Ethernet fabric.

Configuring an external identity provider through OIDC or SAML 2.0 federation delegates authentication to Active Directory, where MFA is enforced. This satisfies the stem's MFA requirement, as vCenter's native AD-over-LDAP integration cannot broker multi-factor challenges.

The Distributed Port Group's Monitor tab exposes per-port-group performance charts, including network throughput and packet drop rate. This is the only location in the vSphere Client showing real-time statistics scoped to that specific port group.

Stretched vSAN clusters require synchronous replication, which is bounded by round-trip latency. VMware supports a maximum RTT of 5 milliseconds between sites; beyond this, writes cannot commit within tolerance and the stretched configuration is unsupported.

CPU ready time reflects a vCPU waiting for a physical core. Reducing assigned vCPUs when the workload cannot use them lowers scheduling contention, so each remaining vCPU waits less and throughput improves. Over-provisioned vCPU counts are a common cause of elevated ready time.

Appliance configuration backup is initiated from VAMI on port 5480, where root logs in and selects Backup to configure scheduled or manual jobs, since this interface manages the appliance itself rather than vSphere Client inventory.

EVC masks CPU feature differences within a single vendor's processor family by presenting a common baseline; it cannot reconcile the fundamentally different instruction sets of Intel and AMD. Cross-vendor EVC is therefore architecturally unsupported, making this the design limitation for the mixed Ice Lake and EPYC clusters.

GRANT (28672 MB) exceeds ACTIVE (16384 MB), so roughly 12 GB is mapped to the VM's physical address space but not touched recently. The hypervisor has granted those pages, yet the guest is not actively referencing them, indicating reclaimable idle memory rather than a shortage.

Block Zero and Full Copy are VAAI primitives offloaded to compliant arrays: the array zeroes thick disks and clones VMDKs natively, eliminating host-side write operations. This hardware acceleration satisfies the requirement for array-integrated advanced storage features.

Proactive HA consumes hardware provider events and, on a degraded redundant power supply, either recommends or automatically evacuates VMs depending on the cluster's automation level. This satisfies the stem's constraint that response behaviour follows the configured automation setting.

Storage capabilities are exposed through VASA provider data or user-defined datastore tags, which the policy then matches against. Automated tiering between SSD and HDD is advertised as such a capability, so the policy enforces placement on capable datastores.

A VM-Host anti-affinity rule with a must rule strictly prohibits the selected virtual machines from running on the selected host group. It does not force the virtual machine onto any specific host, so it meets the requirement of excluding the reserved hosts without pinning the workload elsewhere. This is the correct rule type for guaranteed exclusion.

Storage DRS continuously monitors datastore latency and I/O imbalance, then uses Storage vMotion to redistribute virtual disks across datastores in the datastore cluster once latency thresholds are breached, directly satisfying the requirement to automatically balance I/O load.