Knowledge + Practice

CCNA Deploy Configure And Operate Vvf Questions

75 of 145 questions · Page 1/2 · Deploy Configure And Operate Vvf · Answers revealed

Practice these questions Domain overview All questions

1

Multi-Selecthard

An administrator is deploying a new vSphere cluster with vSphere Lifecycle Manager (vLCM) in a VVF 9.0 environment. The cluster will use a single image to manage ESXi hosts. Before remediating the hosts, the administrator must validate that the desired image is compatible with the cluster's hardware. Which TWO actions should the administrator take to ensure a successful remediation? (Choose two.)

Select 2 answers

A.Enable Quick Boot on each host to speed up remediation.

B.Verify that the hardware compatibility list (HCL) for the desired ESXi version includes the host model and its devices.

C.Run a compliance check on the cluster against the desired image.

D.Configure a vSphere Distributed Resource Scheduler (DRS) rule to evacuate all VMs from the hosts before remediation.

E.Import an offline bundle from a USB drive to the vLCM depot.

AnswersB, C

The HCL lists supported hardware components for each ESXi version. Verifying that the host model, network adapters, storage controllers, and other devices are on the HCL for the ESXi version in the image ensures that the image will function correctly after remediation. This proactive check prevents failures due to unsupported hardware.

Why this answer

To ensure a successful vLCM remediation, the administrator must first verify that the desired image is compatible with the hardware by checking the HCL for the ESXi version. Then, running a compliance check against the image identifies any host-level discrepancies. These two actions validate both hardware support and current state, minimizing remediation failures.

Exam trap

The trap here is confusing general vLCM preparation steps, such as importing bundles or enabling Quick Boot, with the specific validation steps needed to confirm image compatibility before remediation.

Practice this question →

2

Multi-Selecthard

When utilizing vSphere Lifecycle Manager (vLCM) to manage a cluster, which THREE tasks can be performed to maintain ESXi hosts?

Select 3 answers

A.Managing firmware updates via integration with hardware support managers

B.Deploying virtual machines to the cluster

C.Installing vendor-provided hardware support packages (add-ons)

D.Configuring Distributed Switch uplinks manually

E.Applying a desired image to all hosts in the cluster

AnswersA, C, E

vLCM integrates with hardware support managers to apply firmware updates as part of the desired image, satisfying the stem's host maintenance requirement. Firmware is managed alongside ESXi software, ensuring validated, consistent firmware levels across every host in the cluster.

Why this answer

Option A is correct because vLCM integrates with hardware support managers (HSMs) from vendors such as Dell, HPE, and Lenovo to manage firmware updates for ESXi hosts in the cluster, ensuring firmware compliance alongside software. Option C is correct because vLCM supports installing vendor-provided hardware support packages, known as add-ons, which extend the base ESXi image with vendor-specific drivers and components. Option E is correct because the core function of vLCM is to apply a desired image (a single ESXi base image plus components and add-ons) to all hosts in the cluster, ensuring consistent and declarative host state.

Option B is incorrect because deploying virtual machines is a workload operation handled by vCenter/ESXi, not a host lifecycle maintenance task of vLCM. Option D is incorrect because manually configuring Distributed Switch uplinks is a networking configuration task, not part of vLCM's image and firmware management capabilities.

Practice this question →

3

Multi-Selectmedium

An administrator is managing user permissions in vSphere Foundation 9.0. Which TWO practices are recommended when assigning roles and permissions? (Choose two)

Select 2 answers

A.Assign permissions to Active Directory/OpenID groups rather than individual user accounts.

B.Assign permissions to individual users at the virtual machine level for every single VM.

C.Modify the built-in Administrator role directly to add custom security auditing privileges.

D.Assign roles at the highest logical inventory level (such as datacenter or folder) to leverage inheritance.

E.Grant all developers the global Administrator role to ensure zero operational friction.

AnswersA, D

Group-based assignment lets you grant roles once to an Active Directory or OpenID group, so membership changes inherit permissions automatically. This satisfies the stem's recommended practise by avoiding per-account maintenance and reducing the risk of orphaned or excessive individual permissions.

Why this answer

Option A is correct because assigning permissions to Active Directory or OpenID Connect groups rather than individual user accounts centralizes identity management, simplifies onboarding/offboarding, and reduces the risk of orphaned or excessive per-user permissions in vSphere Foundation 9.0. Option D is correct because assigning roles at the highest logical inventory level, such as a datacenter or folder, leverages vSphere's permission inheritance model so child objects (clusters, hosts, VMs) automatically receive the role, minimizing administrative overhead and configuration drift. Option B is not recommended because per-VM, per-user assignments create massive management overhead and are error-prone compared to group-based, inherited permissions.

Option C is not recommended because built-in roles such as Administrator are system-defined and should not be modified; custom roles should be cloned and edited instead to preserve upgrade compatibility and supportability. Option E is not recommended because granting the global Administrator role to all developers violates least-privilege principles and exposes the environment to accidental or malicious changes.

Exam trap

The trap is thinking that assigning permissions at the VM level provides better granularity, but the exam expects recognition that group-based and high-level assignments are recommended for manageability and inheritance.

Practice this question →

4

MCQmedium

An administrator is configuring vCenter Server Identity Provider settings in vSphere Foundation 9.0. They receive an error stating that the metadata XML file provided by the external IdP cannot be parsed. What is the most likely cause?

A.The vCenter Server has insufficient disk space in the root partition.

B.The ESXi hosts are running an outdated build of vSphere 8.0.

C.The IdP metadata XML contains malformed XML syntax or an unsupported SAML schema declaration.

D.The NTP time synchronization offset between vCenter and the IdP exceeds 3 seconds.

AnswerC

vCenter parses the uploaded IdP metadata XML against the SAML schema before trusting the external identity provider. Malformed syntax or an unsupported schema declaration breaks that parse, producing the metadata parsing error during Identity Provider configuration.

Why this answer

The error explicitly states the metadata XML file cannot be parsed, which points to a problem with the file's content itself. SAML IdP metadata must be well-formed XML that conforms to the SAML 2.0 metadata schema; malformed syntax (unclosed tags, invalid characters) or an unsupported schema/namespace declaration will cause vCenter's parser to reject it immediately. Disk space, ESXi build version, and NTP offset would produce different symptoms (storage alerts, compatibility errors, or signature/timestamp validation failures), not an XML parse error.

Exam trap

VCP-VVF often tests whether candidates can distinguish between metadata parsing errors (file content/schema issues) and runtime SAML validation failures (clock skew, expired certificates), which produce different error messages.

How to eliminate wrong answers

Option A is wrong because insufficient disk space would cause a storage or write failure during configuration, not an XML parsing error from the metadata file. Option B is wrong because ESXi host build versions are irrelevant to vCenter's Identity Provider metadata parsing, which is handled entirely by the vCenter server's STS service. Option D is wrong because NTP time skew affects SAML assertion timestamp and signature validation at authentication time, not the initial parsing of the IdP metadata XML.

Practice this question →

5

Multi-Selecthard

When troubleshooting certificate trust issues in VVF, which THREE components might require manual certificate replacement or refreshing?

Select 3 answers

A.vSphere Client browser cache

B.ESXi Host hardware BIOS password

C.Solution User certificates

D.Machine SSL certificate

E.STS signing certificate

AnswersC, D, E

Solution User certificates authenticate vCenter services to one another and to Single Sign-On. When trust breaks, these certificates may need manual replacement or refresh, satisfying the stem's requirement to name components requiring certificate remediation in VVF.

Why this answer

In a vSphere (VVF) environment, certificate trust issues commonly involve the Solution User certificates (option C), which are used by services such as vCenter Single Sign-On, vSphere Client, and other management components for authentication and must be replaced or refreshed if they expire or become untrusted. The Machine SSL certificate (option D) secures communication between vCenter Server and its clients/ESXi hosts, and replacing or refreshing it is a standard remediation when trust breaks. The STS signing certificate (option E) is used by the Security Token Service to sign SAML tokens; if it is expired or untrusted, authentication fails and it must be replaced or refreshed.

Option A (vSphere Client browser cache) is not a certificate component and clearing it does not replace or refresh certificates, and option B (ESXi Host hardware BIOS password) is unrelated to certificate trust and is a hardware/firmware credential, not a certificate.

Exam trap

VCP-VVF often tests whether candidates can distinguish actual certificate components (Machine SSL, Solution User, STS) from unrelated items like browser cache or BIOS passwords that sound plausible in a troubleshooting context.

Practice this question →

6

MCQhard

An administrator is reviewing a cluster image compliance failure in vLCM. The error states that a specific VIB included in the vendor add-on has a dependency conflict with an independently installed driver on the ESXi host. How should the administrator remediate this conflict?

A.Upgrade vCenter Server to the next major release to automatically purge conflicting VIBs.

B.Disable vLCM image enforcement and revert the cluster to legacy baseline mode via the ESXi command line.

C.Remove the conflicting independent VIB from the image specification or update the vendor add-on to a version that resolves the dependency tree.

D.Manually delete the VIB file from /var/lib/vmware/vlcmlib/ on each ESXi host using SSH.

AnswerC

The conflict arises because an independently installed VIB duplicates or contradicts a dependency in the vendor add-on. Removing that independent VIB from the image specification, or updating the add-on, resolves the dependency tree so compliance can be restored.

Why this answer

A vLCM compliance failure caused by a VIB dependency conflict must be resolved by changing the desired-state image: either remove the conflicting independently installed VIB from the image specification or move to a vendor add-on version whose dependency tree is compatible. vLCM remediates hosts to match the image, so the fix is to correct the image content rather than manipulate hosts directly. Once the image is corrected, remediation will bring the host into compliance.

Exam trap

VCP-VVF often tests whether candidates try to fix vLCM conflicts on the host (SSH, manual deletion) instead of correcting the cluster image specification, which is the only supported remediation path.

How to eliminate wrong answers

Option A is wrong because upgrading vCenter does not automatically purge conflicting VIBs; vLCM compliance is driven by the image specification, and a vCenter upgrade alone will not resolve a dependency conflict. Option B is wrong because disabling vLCM and reverting to legacy baselines abandons the desired-state model and does not fix the underlying dependency conflict; it also requires more than a single ESXi command and is not a remediation of the conflict. Option D is wrong because manually deleting VIB files from /var/lib/vmware/vlcmlib/ (or any host path) via SSH is unsupported, can corrupt the image state, and does not address the dependency relationship defined in the image.

Practice this question →

7

MCQmedium

An administrator is configuring a new vSphere Distributed Switch (VDS) in a VVF environment and wants to ensure that network traffic for vSphere vMotion is isolated from other traffic types. Which VDS feature should be utilized?

A.Enable Private VLANs (PVLANs) on the physical switch uplinks only without port groups.

B.Create a dedicated Distributed Port Group configured on a separate VLAN ID specifically for vMotion traffic.

C.Configure IPFIX netflow sampling on the default management port group.

D.Enable Network I/O Control (NIOC) and set the vMotion share level to Low.

AnswerB

A dedicated distributed port group with its own VLAN ID segments vMotion traffic at Layer 2, satisfying the isolation requirement. Unlike NIOC, which only prioritises bandwidth on a shared uplink, a separate VLAN keeps vMotion frames off other traffic types entirely, preventing contention with management, vSAN or VM traffic.

Why this answer

To isolate vMotion traffic on a vSphere Distributed Switch, the administrator should create a dedicated distributed port group with its own VLAN ID and assign the vMotion VMkernel adapter to that port group. This separates vMotion traffic at Layer 2 from management, vSAN, and VM traffic, which is the standard best practice for traffic isolation. The other options either do not isolate vMotion or address unrelated features.

Exam trap

VCP-VVF often tests the difference between traffic isolation (separate port groups/VLANs) and traffic prioritization (NIOC shares), causing candidates to pick NIOC when isolation is actually required.

How to eliminate wrong answers

Option A is wrong because Private VLANs are configured on distributed port groups (and their associated VLANs), not on physical switch uplinks alone, and PVLANs are not the standard mechanism for isolating vMotion traffic. Option C is wrong because IPFIX netflow sampling is a monitoring/visibility feature; it does not isolate or separate traffic types. Option D is wrong because Network I/O Control with a Low share level only controls bandwidth allocation during contention; it does not provide traffic isolation, and setting vMotion to Low would actually deprioritize it.

Practice this question →

8

MCQmedium

An administrator is configuring a new Supervisor cluster in vSphere Foundation 9.0 using vSphere Distributed Switch (VDS). Which networking parameter must be verified prior to enabling the Supervisor?

A.The underlying vSphere Distributed Switch must be upgraded to version 6.5 minimum, with LLDP disabled globally.

B.All ESXi hosts in the cluster must have at least four physical uplinks configured in an active/active port channel.

C.IPv6 must be enforced as the primary transport protocol for all internal Supervisor control plane communication.

D.A dedicated, non-overlapping management network IP block must be allocated for the Supervisor control plane VMs.

AnswerD

Supervisor control plane VMs require their own dedicated management network IP block that does not overlap existing vSphere networks, since each control plane node consumes an address. Verifying this allocation before enabling the Supervisor prevents address conflicts and deployment failures.

Why this answer

The Supervisor control plane VMs require their own dedicated IP addresses on a management network, and that IP block must not overlap with the workload network, pod/service CIDRs, or any existing infrastructure. Verifying a non-overlapping management IP block is a hard prerequisite because the Supervisor's control plane VMs are assigned static IPs from this block and cannot function if there is overlap or exhaustion.

Exam trap

VCP-VVF often tests the misconception that IPv6 or specific VDS versions are mandatory for Supervisor — candidates pick the most 'advanced-sounding' networking option instead of the actual prerequisite, which is a dedicated non-overlapping management IP block.

How to eliminate wrong answers

Option A is wrong because VDS version 6.5 is not the minimum for Supervisor in vSphere 9.0 (much newer versions are required), and LLDP does not need to be disabled globally — it is often used for uplink discovery. Option B is wrong because four physical uplinks in an active/active port channel is not a Supervisor requirement; the number of uplinks depends on redundancy design, and LACP/port channels are optional. Option C is wrong because IPv6 is not enforced as the primary transport for Supervisor control plane communication — IPv4 is the default and IPv6 is optional.

Practice this question →

9

MCQeasy

Which interface is used to perform basic operational tasks like host shutdown, management network configuration, and service restarts on an individual ESXi host?

A.Direct Console User Interface (DCUI)

B.vSphere Client

C.vCenter Management Portal

D.ESXi Shell

AnswerA

The Direct Console User Interface runs locally on the ESXi host console, providing exactly the basic operational tasks named: shutting down or restarting the host, configuring the management network, and restarting services. It requires no vCenter Server or network connectivity, satisfying the stem's requirement for per-host administration.

Why this answer

The Direct Console User Interface (DCUI) provides direct local access for these fundamental management tasks.

Practice this question →

10

MCQhard

When configuring identity sources, what is the primary benefit of using LDAPS over LDAP?

A.Prevents domain controller overload

B.Allows usage of non-standard ports

C.Faster synchronization with Active Directory

D.Encryption of the authentication traffic

AnswerD

LDAPS wraps directory authentication in TLS, encrypting credentials and queries in transit, whereas plain LDAP transmits them in cleartext. This directly satisfies the stem's security constraint by preventing credential interception during bind operations against Microsoft Entra ID-integrated or on-premises directory services.

Why this answer

LDAPS (LDAP over SSL) provides encryption for sensitive credentials during authentication.

Practice this question →

11

MCQeasy

An administrator needs to check the current license capacity and expiration date for a vSphere Foundation deployment. Which dashboard or tool provides a consolidated view of all software licenses across the SDDC?

A.ESXi host Summary tab under Hardware Details

B.vSphere Lifecycle Manager Compliance Overview

C.VMware Aria Operations License Usage report widget

D.vCenter Server Administration > Licensing dashboard

AnswerD

The vCenter Server Licensing dashboard aggregates all licence keys across the SDDC, showing capacity and expiration dates in one consolidated view. This directly satisfies the requirement to check vSphere Foundation licence capacity and expiry, since vSphere Foundation licensing is managed through vCenter Server rather than separate per-component interfaces.

Why this answer

The vCenter Server Administration > Licensing dashboard provides a consolidated, centralized view of all software licenses across the SDDC, including vSphere Foundation, vSAN, and add-on licenses. It displays license capacity (CPU cores), expiration dates, and assignment status for each license key. This is the authoritative location for license management in vSphere.

Exam trap

VCP-VVF often tests the misconception that license information is available on the ESXi host Summary tab or via Lifecycle Manager, when in fact all consolidated licensing data lives in vCenter Server's Administration > Licensing dashboard.

How to eliminate wrong answers

Option A is wrong because the ESXi host Summary tab under Hardware Details shows hardware inventory (CPU, memory, NICs) and does not provide license capacity or expiration information. Option B is wrong because vSphere Lifecycle Manager Compliance Overview reports on image/ baseline compliance for hosts, not software licensing. Option C is wrong because VMware Aria Operations License Usage report widget focuses on operational metrics and capacity analytics for Aria Operations itself, not on vSphere Foundation license keys and expiration dates.

Practice this question →

12

MCQmedium

An administrator is managing vSphere Foundation licenses. If the cluster grows beyond the capacity covered by the current VVF license, what happens?

A.The vCenter service will immediately shut down.

B.The host will lose network connectivity.

C.The cluster will enter a non-compliant state.

D.Virtual machines will be suspended.

AnswerC

Exceeding licensed VVF capacity places the cluster in a non-compliant state, satisfying the stem's constraint on over-capacity growth. vSphere Foundation licensing is capacity-based, so adding hosts beyond entitlement breaches the licence terms; vCenter reports non-compliance rather than blocking workloads, preserving operations while flagging remediation.

Why this answer

vSphere Foundation licensing is capacity-based; exceeding CPU count requires additional license purchase to maintain compliance, though the system will not immediately shut down.

Practice this question →

13

MCQeasy

What is the primary function of a 'Host Profile' in vSphere?

A.To backup virtual machines

B.To patch ESXi hosts

C.To monitor hardware sensors

D.To standardize host configuration

AnswerD

Host Profiles capture a reference host's configuration—networking, storage, security and advanced settings—then remediate other hosts against it, satisfying the requirement to standardise configuration across the cluster. Compliance checking flags drift, and remediation reapplies the reference values, ensuring consistent, repeatable host settings without manual reconfiguration.

Why this answer

Host Profiles allow for the standardization of host configurations across a cluster.

Practice this question →

14

MCQhard

An administrator is troubleshooting a failure during an automated VVF cluster expansion in SDDC Manager. The task fails while attempting to configure the new ESXi host's Distributed Switch uplinks. Which log file on SDDC Manager should the administrator examine first to diagnose the API payload failure?

A./var/log/vmware/nsx-manager/cluster.log

B./var/log/vmware/vcf/sddc-manager/sddc-manager.log

C./var/log/vmware/loudmouth.log

D./var/log/vmware/vpxd.log

AnswerB

The sddc-manager.log records SDDC Manager's internal operations and outbound API calls, including the payloads sent when configuring a new host's Distributed Switch uplinks. It is therefore the first place to inspect for the failing API payload during cluster expansion.

Why this answer

The SDDC Manager log file /var/log/vmware/vcf/sddc-manager/sddc-manager.log is the primary log for SDDC Manager operations, including cluster expansion tasks and API calls. When a cluster expansion fails during Distributed Switch uplink configuration, this log captures the API payload, error responses, and orchestration details needed to diagnose the failure. It is the first place to look for SDDC Manager orchestrated task failures.

Exam trap

VCP-VVF often tests the confusion between SDDC Manager logs and vCenter/NSX logs, tempting candidates to pick vpxd.log because it's the most familiar VMware log.

How to eliminate wrong answers

Option A is wrong because /var/log/vmware/nsx-manager/cluster.log is specific to NSX Manager clustering, not SDDC Manager cluster expansion or vSphere Distributed Switch configuration. Option C is wrong because /var/log/vmware/loudmouth.log is related to VCF's loudmouth service (used for password rotation and credential management), not cluster expansion. Option D is wrong because /var/log/vmware/vpxd.log is the vCenter Server log, which may contain related errors but is not the first place to check for SDDC Manager API payload failures.

Practice this question →

15

MCQmedium

An administrator is utilizing vSphere Lifecycle Manager (vLCM) in vSphere Foundation 9.0 to manage ESXi host updates across a cluster. The cluster is configured with a single software image. The administrator attempts to remediate the cluster, but pre-checks report that a third-party ESXi IOVP driver installed on the hosts is not compatible with the target ESXi version. What is the correct procedure to remediate this issue?

A.Bypass the vLCM pre-check by enabling override mode in the vSphere Client advanced settings.

B.Revert the cluster to a manual baseline configuration and disable vSphere Lifecycle Manager.

C.Uninstall the third-party driver manually using ESXCLI on each host, then perform an upgrade using legacy Update Manager baselines.

D.Update the vLCM cluster image specification to include a compatible vendor add-on or updated component version that supports the target ESXi release.

AnswerD

vLCM image remediation fails because the third-party IOVP driver is absent from the target image; adding a compatible vendor add-on or updated component version to the cluster image specification supplies a driver version matching the target ESXi release.

Why this answer

vSphere Lifecycle Manager (vLCM) uses a declarative image model where the desired state is defined in a cluster image specification. If a third-party driver is incompatible, the correct procedure is to update the image specification to include a compatible vendor add-on or updated component version that supports the target ESXi release. This ensures the driver is either replaced or updated as part of the remediation, maintaining the desired state.

Exam trap

The trap is thinking that manual intervention or bypassing checks is acceptable, but the exam expects knowledge that vLCM requires updating the image specification to resolve incompatibilities.

How to eliminate wrong answers

Option A is wrong because bypassing pre-checks is not supported and can lead to an unstable or unbootable host; vLCM pre-checks are designed to prevent incompatible upgrades. Option B is wrong because reverting to manual baselines and disabling vLCM abandons the benefits of image-based management and does not solve the driver incompatibility. Option C is wrong because manually uninstalling the driver and using legacy baselines is a step backward and not the recommended vLCM workflow; it also may not guarantee compatibility.

Practice this question →

16

MCQeasy

An administrator is configuring vSphere Lifecycle Manager (vLCM) in a VVF 9.0 environment. The administrator wants to ensure that all hosts in a cluster are remediated to the same ESXi version and firmware level, and that any drift is automatically detected. Which vLCM feature should the administrator use?

A.vSphere Configuration Profiles

B.Baseline-based remediation

C.Image-based remediation

D.Host profiles

AnswerC

Image-based remediation uses a single image that defines the desired ESXi version, firmware, and drivers for all hosts in the cluster. vLCM continuously monitors hosts for compliance with the image and reports drift. Remediation applies the image to bring hosts back into compliance, ensuring uniformity across the cluster.

Why this answer

Image-based remediation in vLCM uses a cluster-wide image that specifies the exact ESXi base image, firmware add-ons, and OEM add-ons. vLCM checks hosts against this image and reports compliance. Remediation applies the image to any non-compliant host, ensuring all hosts run the same software and firmware. This provides automatic drift detection and enforcement of a uniform state.

Exam trap

The trap here is confusing configuration management features like host profiles or vSphere Configuration Profiles with software and firmware lifecycle management, which is exclusively handled by vLCM images or baselines.

Practice this question →

17

MCQhard

You are managing certificate lifecycles in VVF. Where should you update the trusted root CA for the vCenter Server to ensure secure communication?

A.Host Profile

B.vLCM Image

C.Aria Operations Settings

D.vSphere Client Certificate Management

AnswerD

The vSphere Client Certificate Management interface is where trusted root CA certificates are imported and mapped to vCenter Server, establishing the trust chain for secure communication. Updating the root CA here propagates trust to services and ESXi, satisfying the stem's certificate lifecycle requirement.

Why this answer

The vSphere Certificate Authority (VMCA) or the vCenter Certificate Management tool is used to manage trusted roots.

Practice this question →

18

MCQmedium

An administrator is configuring vSphere Supervisor in a VVF cluster and needs to assign permissions so that a specific developer team can manage namespaces. Where in the vSphere Client are namespace permissions managed?

A.vCenter Server -> Administration -> Access Control -> Roles.

B.SDDC Manager -> Supervisor -> Access Control.

C.Cluster -> Configure -> Workload Management -> Namespaces -> Select Namespace -> Permissions.

D.NSX Manager -> System -> Identity -> Namespace Role Bindings.

AnswerC

Namespace permissions in vSphere Supervisor are scoped per namespace, not per cluster or user. Selecting the target namespace under Workload Management exposes its own Permissions tab, letting the developer team be granted the namespace-scoped role the stem requires, without granting cluster-wide rights.

Why this answer

Namespace permissions in vSphere Supervisor are managed per-namespace from the cluster's Workload Management configuration. The path Cluster -> Configure -> Workload Management -> Namespaces -> Select Namespace -> Permissions lets an administrator grant vSphere users or groups roles scoped to that specific namespace. This is the supported location for assigning developer team access to Kubernetes namespaces in a VVF environment.

Exam trap

VCP-VVF often tests the confusion between global vCenter role management and per-namespace Supervisor permissions, causing candidates to pick the vCenter Access Control path instead of the Workload Management namespace path.

How to eliminate wrong answers

Option A is wrong because vCenter Server -> Administration -> Access Control -> Roles is where global vCenter roles are defined, not where per-namespace Supervisor permissions are assigned. Option B is wrong because SDDC Manager does not host a Supervisor access control UI; it manages lifecycle and inventory, not namespace RBAC. Option D is wrong because NSX Manager identity and role bindings govern NSX objects and principal identities, not vSphere Supervisor namespace permissions.

Practice this question →

19

MCQeasy

An administrator needs to review the history of user logins and administrative tasks performed in vCenter Server over the past 30 days. Which vCenter feature or view provides this audit trail?

A.vCenter -> Monitor -> Tasks and Events.

B.Host -> Configure -> Advanced Settings -> Audit.Log.

C.SDDC Manager -> Audit -> Activity Log.

D.VCF Operations -> Administration -> Access Audit.

AnswerA

vCenter's Tasks and Events view retains task and event records, capturing user logins and administrative operations with timestamps and initiating user. It satisfies the 30-day audit requirement because events persist in the vCenter database per retention settings, giving the administrator the required historical trail.

Why this answer

In vCenter Server, the Monitor tab's Tasks and Events view aggregates recent task history and event logs, including user logins (via event types like UserLoginSessionEvent) and administrative operations. This is the built-in audit trail for vCenter activity and can be filtered by user, time range, and event type. It is the correct place to review the last 30 days of activity.

Exam trap

VCP-VVF often tests the confusion between vCenter's native Tasks and Events audit view and external tools like Aria Operations or SDDC Manager, which do not hold the authoritative vCenter audit trail.

How to eliminate wrong answers

Option B is wrong because Host > Configure > Advanced Settings > Audit.Log is not a standard vCenter audit view; ESXi shell/SSH auditing is configured differently and does not aggregate vCenter-wide user activity. Option C is wrong because SDDC Manager is part of VMware Cloud Foundation's management plane for lifecycle management, not the vCenter audit trail for user logins and admin tasks. Option D is wrong because VCF Operations (Aria Operations) focuses on performance monitoring and alerting, not the authoritative vCenter audit log of user actions.

Practice this question →

20

MCQmedium

An administrator needs to check if a host is compliant with the desired image in vLCM. What is the process to trigger a compliance check?

A.Select Cluster > Updates > Check Compliance

B.Select Host > Remediate

C.vCenter > Settings > Lifecycle

D.Host > Monitor > Lifecycle

AnswerA

Selecting Cluster > Updates > Check Compliance triggers vLCM's desired-state reconciliation, comparing each host's installed firmware and software against the cluster's image specification. This directly satisfies the scenario's requirement to verify host compliance with the desired image, initiating the scan from the cluster-level Updates tab where image drift is reported.

Why this answer

The 'Check Compliance' button under the Updates tab allows manual verification of image state.

Practice this question →

21

MCQeasy

Which administrative role in vSphere has the most privileges by default?

A.Administrator

B.Resource Pool Administrator

C.No Cryptographic Administrator

D.Read Only

AnswerA

Administrator holds the most privileges by default, including full control over all inventory objects, permissions, and system configuration. Other roles such as Read Only or No Access grant strictly narrower scopes, making Administrator the highest-privilege built-in role.

Why this answer

The Administrator role has full access to all objects and settings.

Practice this question →

22

MCQmedium

An administrator is configuring a new alert in vSphere 9.0 to monitor when an ESXi host loses connection to a primary storage datastore. After saving the alarm, they want to test it. What is the safest method to verify the alarm triggers correctly without causing an outage?

A.Unmount the production VMFS datastore from all ESXi hosts simultaneously during peak business hours.

B.Disconnect the physical Fibre Channel cables from the core SAN switch.

C.Trigger a test notification action directly from the vSphere Client alarm definition menu if available, or simulate the event in a test cluster.

D.Restart the vpxd service on vCenter while I/O is running.

AnswerC

Triggering the notification action from the alarm definition menu exercises the alerting path without altering host or datastore state, so no production outage occurs. Simulating the event in a test cluster provides the same verification while satisfying the stem's constraint of testing safely.

Why this answer

The safest method to test an alarm for ESXi host datastore connectivity loss is to trigger a test notification from the alarm definition menu if available, or simulate the event in a non-production test cluster. This avoids any impact on production storage and ensures the alarm logic works without risking an outage.

Exam trap

The trap is thinking that the only way to test an alarm is to cause the actual failure, leading candidates to choose disruptive actions, when safe testing options like test notifications or lab simulations are available.

How to eliminate wrong answers

Option A is wrong because unmounting a production VMFS datastore from all hosts during peak hours would cause a major outage and data unavailability. Option B is wrong because disconnecting physical Fibre Channel cables from the core SAN switch would disrupt storage access for all connected hosts, leading to a severe outage. Option D is wrong because restarting the vpxd service on vCenter while I/O is running could disrupt management operations and potentially affect running workloads, and it does not directly test the datastore connectivity alarm.

Practice this question →

23

MCQhard

An administrator is configuring identity federation using Microsoft Entra ID (Azure AD) with vCenter 9.0. During authentication, users receive an OIDC token validation error. Upon checking the vCenter sso log (/var/log/vmware/sso/sso.log), it indicates a clock skew issue between vCenter and the IdP. How should the administrator resolve this?

A.Configure and synchronize Network Time Protocol (NTP) on both the vCenter Server appliance and the external Identity Provider.

B.Regenerate the vCenter machine SSL certificate using the Certificate Manager utility.

C.Modify the sso.properties file on vCenter to increase the token lifetime tolerance to 72 hours.

D.Disable OAuth token verification in the advanced vCenter SSO configuration settings.

AnswerA

Clock skew between vCenter and the external Identity Provider invalidates OIDC token timestamps, causing validation failures. Synchronising NTP on both the vCenter Server appliance and the IdP aligns their clocks, restoring successful token validation during federated authentication.

Why this answer

Clock skew between vCenter and the external IdP causes OIDC token validation failures because token timestamps (iat, exp, nbf) fall outside the allowed tolerance. The fix is to configure and synchronize NTP on both the vCenter Server appliance and the IdP so their clocks agree.

Exam trap

The trap is treating OIDC token errors as certificate or configuration problems, when the log explicitly points to clock skew and the correct fix is NTP synchronization on both sides.

How to eliminate wrong answers

Option B is wrong because regenerating the machine SSL certificate addresses TLS trust, not OIDC token timestamp validation. Option C is wrong because increasing token lifetime tolerance to 72 hours is not a supported or sane fix and does not address the root clock skew. Option D is wrong because disabling OAuth token verification would break authentication security and is not a valid resolution.

Practice this question →

24

MCQhard

An administrator is configuring a new vSphere Foundation cluster and needs to enable Workload Management. What is the prerequisite for the storage policy used by the Supervisor cluster?

A.The storage policy must be a standard VMFS policy.

B.The storage policy must be applied to all existing VMs in the cluster.

C.The storage policy must be defined with tags.

D.The storage policy must be associated with a compatible datastore (e.g., vSAN).

AnswerD

The Supervisor cluster's storage policy must reference a datastore that supports the required capabilities, such as vSAN, because Workload Management provisions control plane and Tanzu Kubernetes Grid nodes on that backing storage. A policy tied to an incompatible datastore fails validation.

Why this answer

The Supervisor control plane needs a storage policy to ensure that its internal components are placed on supported datastores, typically vSAN.

Practice this question →

25

MCQeasy

An administrator is reviewing the monitoring configuration in vSphere Foundation 9.0 and wants to check the health status of vSAN storage services across the cluster. Where is the primary vSAN health and performance dashboard located in the vSphere Client?

A.Cluster > Monitor > vSAN > Health and Performance

B.Lifecycle Management > vSAN > Status

C.Administration > vSAN Services > Monitoring

D.Storage > Datastores > vSAN Datastore > Configure > Hardware Health

AnswerA

vSAN health and performance monitoring is surfaced under the cluster object's Monitor tab, in the vSAN section. Cluster > Monitor > vSAN > Health and Performance is the primary dashboard location, satisfying the requirement to check vSAN storage service health across the cluster.

Why this answer

vSAN health and performance metrics are integrated directly into the vSphere Client under the Cluster > Monitor > vSAN tab.

Practice this question →

26

Multi-Selecthard

An administrator is managing certificates in a vSphere Foundation 9.0 environment and needs to renew or replace certificates using the certificate management utility. Which THREE certificate types are managed by vSphere Certificate Manager? (Choose three.)

Select 3 answers

A.Aria Operations collector SSL certificate

B.VMCA Root Certificate (acting as the internal certificate authority)

C.Solution User certificates (such as vpxd, rhttpproxy, and vpxd-extension)

D.Machine SSL certificate (securing HTTPS traffic to vCenter Server)

E.ESXi Host Hardware IPMI Management Controller SSL certificate

AnswersB, C, D

The VMCA Root Certificate is one of the three certificate types vSphere Certificate Manager handles, allowing renewal or replacement of the internal certificate authority that signs all other vSphere certificates. This satisfies the stem's requirement to identify a managed certificate type.

Why this answer

The vSphere Certificate Manager utility is designed to manage the core certificate infrastructure of vCenter Server, and it explicitly handles three certificate categories. Option B, the VMCA Root Certificate, is correct because VMCA (VMware Certificate Authority) acts as the internal CA that signs all other vSphere certificates, and Certificate Manager provides options to replace it (e.g., with a custom CA-signed root) or regenerate it. Option C, Solution User certificates (such as vpxd, rhttpproxy, and vpxd-extension), is correct because these are issued to vCenter services for authentication and Certificate Manager can renew or replace them individually or in bulk.

Option D, the Machine SSL certificate securing HTTPS traffic to vCenter Server, is correct because Certificate Manager offers the option to replace the machine SSL certificate with a custom CA-signed certificate or regenerate it using VMCA. Option A is not managed by vSphere Certificate Manager because Aria Operations collector certificates are handled within the Aria Operations product's own certificate management interface, not vCenter's utility. Option E is also incorrect because ESXi host IPMI/BMC SSL certificates are managed on the ESXi host itself (or via vendor tools) and are outside the scope of vSphere Certificate Manager.

Practice this question →

27

MCQeasy

An administrator needs to monitor the real-time CPU and memory usage of a specific virtual machine in the vSphere Client. Which tab under the virtual machine view displays these real-time performance graphs?

A.Configure tab -> Resource Allocation.

B.Monitor tab -> Performance -> Advanced.

C.Actions menu -> Export Performance Logs.

D.Summary tab -> Hardware Overview.

AnswerB

The Monitor tab's Performance view, switched to Advanced, renders real-time CPU and memory charts for the selected VM, satisfying the requirement to observe live usage in the vSphere Client. Advanced mode exposes per-metric counters and time ranges that the Summary overview omits, giving the granular real-time graphs requested.

Why this answer

Real-time CPU and memory graphs for a single VM are found under the VM's Monitor tab, then Performance, then the Advanced view, which exposes live metrics and per-metric charts. The Advanced performance view is the correct location for granular real-time monitoring of a specific VM in the vSphere Client. Other tabs either configure resources or export logs rather than display live graphs.

Exam trap

The trap here is confusing configuration views (Resource Allocation) or export functions with the actual live-graph location, causing candidates to pick a tab that manages settings rather than displays real-time performance.

How to eliminate wrong answers

Option A is wrong because Configure -> Resource Allocation is where you set shares, reservations, and limits, not where you view live performance data. Option C is wrong because Actions -> Export Performance Logs exports historical data to a file; it does not display real-time graphs. Option D is wrong because the Summary tab's Hardware Overview shows static configuration (CPU count, memory size), not dynamic utilization graphs.

Practice this question →

28

MCQeasy

An administrator needs to integrate an external Active Directory identity provider with vCenter Server 9.0 for vSphere Foundation. Which authentication mechanism should be configured to allow users to log in with multi-factor authentication (MFA)?

A.Integrated Windows Authentication (IWA) via direct Kerberos ticket exchange.

B.Identity Provider (IdP) federation using OpenID Connect (OIDC) or SAML 2.0.

C.Anonymous bind LDAP configuration with certificate-based client pinning.

D.Local OS user database synchronization over insecure LDAP ports.

AnswerB

Configuring an external identity provider through OIDC or SAML 2.0 federation delegates authentication to Active Directory, where MFA is enforced. This satisfies the stem's MFA requirement, as vCenter's native AD-over-LDAP integration cannot broker multi-factor challenges.

Why this answer

vCenter Server 9.0 supports external identity provider federation using OIDC or SAML 2.0, which lets vCenter delegate authentication to an enterprise IdP (such as Entra ID, Okta, or ADFS). Because the IdP owns the authentication flow, MFA policies enforced there (push, TOTP, FIDO2) apply to vCenter logins without vCenter needing to implement MFA itself. This is the supported path for MFA with vSphere Foundation.

Exam trap

VCP-VVF often tests the confusion between IWA (Kerberos SSO, no MFA) and IdP federation (OIDC/SAML, MFA-capable) — candidates pick IWA thinking 'Active Directory integration' equals MFA support.

How to eliminate wrong answers

Option A is wrong because IWA/Kerberos provides SSO via domain tickets but does not itself deliver MFA — it authenticates silently based on the workstation session. Option C is wrong because anonymous LDAP bind is insecure and unsupported for identity federation; certificate pinning does not provide user authentication or MFA. Option D is wrong because local OS user database sync over insecure LDAP is neither a supported federation method nor an MFA mechanism.

Practice this question →

29

MCQeasy

An administrator wants to view the real-time network throughput and packet drop rates on a specific Distributed Port Group in a VDS. Where can this be monitored in the vSphere Client?

A.Distributed Port Group -> Monitor -> Performance tab.

B.ESXi Host Client -> Networking -> Ports.

C.Cloud Builder -> Network Monitoring.

D.SDDC Manager -> Networking -> Port Group Health.

AnswerA

The Distributed Port Group's Monitor tab exposes per-port-group performance charts, including network throughput and packet drop rate. This is the only location in the vSphere Client showing real-time statistics scoped to that specific port group.

Why this answer

The vSphere Client exposes per-Distributed Port Group performance counters (throughput, packets dropped, broadcast, multicast) under the Monitor tab of the port group object. Selecting the Performance sub-tab lets an administrator view real-time and historical network I/O graphs scoped to that specific DVPort Group, which is exactly what the question asks for. This is the native vCenter monitoring path for VDS-level traffic.

Exam trap

VCP-VVF often tests whether candidates confuse host-level vSwitch monitoring (ESXi Host Client) with vCenter-level Distributed Switch monitoring, causing them to pick the per-host Ports view instead of the DVPort Group Performance tab.

How to eliminate wrong answers

Option B is wrong because the ESXi Host Client -> Networking -> Ports view only lists individual uplinks, VMkernel adapters, and connected VMs on a single host, and does not aggregate Distributed Port Group throughput or drop statistics. Option C is wrong because Cloud Builder is a first-boot appliance used to deploy and validate the SDDC management domain, not a runtime network monitoring tool. Option D is wrong because SDDC Manager -> Networking manages NSX edge/uplink configuration and host networking for the management domain, not per-port-group packet drop telemetry.

Practice this question →

30

MCQeasy

An administrator needs to back up the vCenter Server Appliance configuration in a vSphere Foundation 9.0 deployment. Where is this backup feature accessed and initiated?

A.Access the vCenter Server Appliance Management Interface (VAMI) at port 5480, log in as root, and select Backup to configure scheduled or manual backups.

B.Navigate to Lifecycle Manager in the vSphere Client and create a Backup Baseline.

C.Open the vSphere Client, right-click the vCenter root object, and select Export vCenter Appliance Backup.

D.Log in to the ESXi host hosting the vCenter VM and run `vim-cmd vcenter/backup`.

AnswerA

Appliance configuration backup is initiated from VAMI on port 5480, where root logs in and selects Backup to configure scheduled or manual jobs, since this interface manages the appliance itself rather than vSphere Client inventory.

Why this answer

vCenter Server Appliance native file-based backups are managed through the vCenter Server Appliance Management Interface (VAMI) accessible on port 5480.

Practice this question →

31

MCQhard

You have a VVF license assigned. If you need to troubleshoot a Certificate Authority (CA) issue involving 'vmca', where are the logs typically located within the VCSA file system?

A./var/log/vmware/eam/

B./var/log/vmware/sso/

C./var/log/vmware/vmca/

D./var/log/vmware/vpxd/

AnswerC

VMware Certificate Authority service logs reside under /var/log/vmware/vmca/ on the VCSA appliance, so this path satisfies the stem's requirement to locate vmca troubleshooting logs. Other VMware services use sibling directories such as /var/log/vmware/vpxd/, making this the specific location for CA-related diagnostics.

Why this answer

The VMware Certificate Authority (VMCA) service, which is part of the vSphere Certificate Manager, writes its operational and error logs to the /var/log/vmware/vmca/ directory on the VCSA. This is the standard location for troubleshooting CA-related issues such as certificate signing, root certificate replacement, or VMCA service failures. Other directories like /var/log/vmware/sso/ are for SSO, not VMCA.

Exam trap

VCP-VVF often tests the ability to distinguish between log directories for different vSphere services, so candidates may confuse the VMCA log path with that of SSO or vpxd.

How to eliminate wrong answers

Option A is wrong because /var/log/vmware/eam/ contains logs for the ESXi Agent Manager (EAM), which handles agent VIBs and not certificate services. Option B is wrong because /var/log/vmware/sso/ holds logs for the Single Sign-On service, which manages authentication and token issuance, not CA operations. Option D is wrong because /var/log/vmware/vpxd/ is the log directory for vCenter Server (vpxd), responsible for core vCenter management, not the VMCA service.

Practice this question →

32

Multi-Selecthard

An administrator is troubleshooting a Supervisor cluster deployment failure in vSphere Foundation 9.0 where control plane VMs fail to power on. Which THREE log files or diagnostic locations should the administrator inspect on the vCenter Server Appliance? (Choose three)

Select 3 answers

A./var/log/vmware/vpxd/vpxd.log

B./var/log/samba/smbd.log

C./var/log/vmware/wcp/wcp.log

D./var/log/cups/error_log

E./var/log/vmware/clcm/clcm.log

AnswersA, C, E

vpxd.log tracks core vCenter operations and virtual machine provisioning tasks.

Why this answer

Option A, /var/log/vmware/vpxd/vpxd.log, is correct because vpxd is the vCenter Server service that manages VM provisioning and power operations, so failures to power on the Supervisor control plane VMs would be recorded there. Option C, /var/log/vmware/wcp/wcp.log, is correct because the VMware Workload Control Plane (WCP) service orchestrates Supervisor cluster deployment and its log captures control plane VM creation and power-on errors. Option E, /var/log/vmware/clcm/clcm.log, is correct because the Cluster Lifecycle Manager (CLCM) service handles Supervisor cluster lifecycle and deployment tasks, logging failures during control plane bring-up.

Option B, /var/log/samba/smbd.log, is incorrect because Samba is an SMB/CIFS file-sharing service unrelated to vSphere Supervisor operations. Option D, /var/log/cups/error_log, is incorrect because CUPS is a printing service and has no role in vCenter or Supervisor cluster deployment.

Exam trap

VCP-VVF often tests the specific log file locations for Supervisor components, causing candidates to select generic or unrelated logs (like samba or cups) instead of the vSphere-specific vpxd, wcp, and clcm logs.

Practice this question →

33

MCQmedium

An administrator is configuring an alert for high CPU usage on a host. Which vSphere feature is used to send this notification to an external email server?

A.vSphere Licensing Service

B.vCenter Server Mail Settings

C.Operations Log Forwarder

D.ESXi Host SMTP Agent

AnswerB

vCenter Server Mail Settings hold the SMTP server, sender address, and port that vCenter uses to dispatch alarm notifications. Configuring them lets the high-CPU alarm trigger an email to the external mail server, satisfying the external notification requirement.

Why this answer

vCenter Server Mail Settings (Administration -> Deployment -> Mail) configure the SMTP sender, port, and authentication that vCenter uses to dispatch alarm notifications to an external email server. Alarms defined on hosts, VMs, or datastores reference this global mail configuration when the 'Send email notification' action is triggered. Without valid Mail Settings, no alarm email can leave vCenter regardless of how the alarm is scoped.

Exam trap

The trap here is assuming ESXi hosts send alarm emails themselves; candidates forget that alarm notification is a vCenter Server function governed by the global Mail Settings.

How to eliminate wrong answers

Option A is wrong because the vSphere Licensing Service manages license keys and entitlement, not outbound notifications. Option C is wrong because the Operations Log Forwarder ships logs to remote syslog destinations, not SMTP email alerts. Option D is wrong because there is no per-host 'ESXi Host SMTP Agent' — ESXi itself does not send alarm emails; vCenter owns alarm notification delivery.

Practice this question →

34

MCQhard

An administrator is troubleshooting a certificate validation error between vCenter Server 9.0 and an external third-party Identity Provider. The error points to an untrusted root certificate. Where must the administrator upload the custom root CA certificate to establish trust within vCenter's SSO subsystem?

A.Host -> Configure -> Security Profile -> Trusted Certificates.

B.VMware Cloud Builder -> Security -> Certificate Authority Store.

C.Administration -> Single Sign-On -> Configuration -> Certificates -> Trusted Root Certificates.

D.SDDC Manager -> Security -> Certificate Management -> Root Store.

AnswerC

vCenter's SSO subsystem validates external Identity Provider certificates against its own trusted root store, reached via Administration, Single Sign-On, Configuration, Certificates, Trusted Root Certificates. Uploading the third-party root CA there establishes the trust chain the error demands.

Why this answer

In vCenter Server 9.0, custom root CA certificates for SSO trust are uploaded under Administration -> Single Sign-On -> Configuration -> Certificates -> Trusted Root Certificates. This stores the CA in vCenter's SSO trust store so that assertions signed by the external IdP's certificate chain validate successfully.

Exam trap

VCP-VVF often tests the confusion between vCenter SSO trusted roots and ESXi host trusted certificates — candidates pick the host security profile path because it also mentions 'Trusted Certificates.'

How to eliminate wrong answers

Option A is wrong because Host -> Configure -> Security Profile -> Trusted Certificates manages ESXi host-level trust for things like smart card or SSL, not vCenter SSO IdP trust. Option B is wrong because VMware Cloud Builder is a deployment appliance, not the runtime trust store for vCenter SSO. Option D is wrong because SDDC Manager certificate management applies to VMware Cloud Foundation's management domain components, not to a standalone vCenter SSO trust configuration.

Practice this question →

35

Multi-Selectmedium

An administrator is deploying and configuring a new VVF 9.0 environment. Which TWO tasks must be completed prior to initiating the Cloud Builder bring-up process? (Choose two.)

Select 2 answers

A.Deploy an external Microsoft SQL clustering group for vCenter database persistence.

B.Configure forward and reverse DNS records for all ESXi hosts, vCenter, NSX, and SDDC Manager components.

C.Upgrade all ESXi hosts to the latest community-supported community VIB drivers via esxcli.

D.Configure vSphere Trust Authority clusters on physical hardware management cards.

E.Prepare and validate the JSON deployment parameter file with correct IP allocations and network settings.

AnswersB, E

Cloud Builder validates name resolution for every management component during bring-up, so forward and reverse DNS records must exist beforehand. Missing PTR or A records cause validation to fail before deployment starts, making this a genuine prerequisite rather than a post-deployment task.

Why this answer

Option B is correct because the Cloud Builder bring-up requires fully resolvable forward (A/AAAA) and reverse (PTR) DNS records for every management component — ESXi hosts, vCenter Server, NSX Manager/Edge, and SDDC Manager — since hostname resolution failures cause validation to fail before deployment begins. Option E is correct because Cloud Builder consumes a validated JSON deployment parameter workbook (the VVF/VCF deployment parameter file) that defines management network settings, IP pools, VLANs, hostnames, and credentials; this file must be prepared and pass Cloud Builder's pre-validation checks before bring-up can start. Option A is not required because VVF 9.0 uses the embedded PostgreSQL-based vCenter Server Appliance database by default, and an external Microsoft SQL clustering group is neither needed nor supported for this bring-up.

Option C is not required because ESXi image and VIB/driver compliance is handled by the VVF-managed image and SDDC Manager lifecycle management, not by manually installing community VIBs via esxcli before bring-up. Option D is not required because vSphere Trust Authority is an optional security feature configured after the environment is operational, not a prerequisite for Cloud Builder bring-up.

Exam trap

VCP-VVF often tests the assumption that external databases or optional security features are required before bring-up, when the real prerequisites are DNS and a validated JSON deployment parameter file.

Practice this question →

36

Multi-Selecthard

An administrator is configuring identity federation in vSphere Foundation 9.0 using an OIDC-compliant identity provider. Which THREE configuration parameters must be supplied in the vSphere Client under Identity Provider settings? (Choose three)

Select 3 answers

A.Root ESXi host administrative SSH password

B.Physical Top-of-Rack switch IP address

C.Issuer URI (Discovery endpoint)

D.Redirect URI / Callback URL

E.Client ID and Client Secret

AnswersC, D, E

The Issuer URI points to the OIDC discovery document, from which vSphere retrieves the authorisation, token and JWKS endpoints automatically. This satisfies the stem's OIDC-compliant provider requirement, since discovery is mandatory for OIDC federation and cannot be omitted when configuring the Identity Provider settings.

Why this answer

In vSphere Foundation 9.0, configuring an OIDC-compliant identity provider in the vSphere Client requires the OIDC client registration details that the identity provider issues and the endpoints vCenter uses to communicate with it. Option C (Issuer URI / Discovery endpoint) is correct because vCenter uses this URL to fetch the OIDC discovery document (/.well-known/openid-configuration) to learn the provider's authorization, token, and JWKS endpoints. Option D (Redirect URI / Callback URL) is correct because this is the vCenter callback address that must be registered with the identity provider so the authorization code can be returned to vCenter after user authentication.

Option E (Client ID and Client Secret) is correct because these credentials identify and authenticate the vCenter OIDC client to the identity provider during the authorization code flow. Options A and B are incorrect because an ESXi host SSH root password and a Top-of-Rack switch IP address are unrelated to OIDC identity federation configuration in the vSphere Client.

Practice this question →

37

Multi-Selectmedium

Which TWO items are required to configure an Active Directory identity source in vCenter?

Select 2 answers

A.vCenter Server license key

B.Active Directory Domain Name

C.vSAN datastore path

D.Active Directory Service Account Credentials

E.SNMP community string

AnswersB, D

Configuring an Active Directory identity source in vCenter requires the AD domain name to locate domain controllers and bind for authentication. Without it, vCenter cannot resolve the directory, satisfying the stem's requirement for a required configuration item.

Why this answer

To join vCenter to an Active Directory domain as an identity source, you must supply the Active Directory Domain Name (option B), which tells vCenter which AD domain to authenticate against via LDAP/LDAPS. You must also provide Active Directory Service Account Credentials (option D), a user principal name (UPN) or domain\user with a password that vCenter uses to bind to AD and query users and groups. The vCenter Server license key (option A) is unrelated to identity source configuration; licensing is handled separately and does not affect AD integration.

A vSAN datastore path (option C) is storage configuration, not authentication, and an SNMP community string (option E) is for monitoring/traps, not directory services.

Practice this question →

38

MCQmedium

An administrator observes that log forwarding to a centralized server is not working. Where should they check the log settings in the vCenter Server Appliance?

A.SSH > /etc/syslog.conf

B.vSphere Client > Configure > Logging

C.vSphere Client > Administration > Log Browsing

D.Port 5480 > Administration > Syslog

AnswerD

Syslog forwarding configuration lives in the vCenter Server Appliance Management Interface on port 5480, under Administration > Syslog. This is the only place where remote syslog collectors and forwarding rules are set, so a broken forward is diagnosed there.

Why this answer

Log forwarding configuration on the vCenter Server Appliance is managed through the VAMI (vCenter Server Appliance Management Interface) on port 5480, under Administration > Syslog. This is where administrators set remote syslog hosts, protocols, and forwarding rules for the appliance's various services.

Exam trap

VCP-VVF often tests whether candidates know that VCSA log forwarding is configured via the VAMI on port 5480, not through the vSphere Client or by editing Linux syslog files directly.

How to eliminate wrong answers

Option A is wrong because /etc/syslog.conf is a legacy Linux syslog configuration file; VCSA uses VMware's own logging configuration managed via VAMI, not direct edits to syslog.conf. Option B is wrong because the vSphere Client's Configure > Logging tab applies to ESXi hosts, not the vCenter Server Appliance. Option C is wrong because Log Browsing in the vSphere Client is a read-only log viewer, not a configuration interface for forwarding.

Practice this question →

39

MCQeasy

An administrator needs to apply a VMware vSphere Foundation 9.0 license key to a newly deployed vCenter Server instance and its associated ESXi hosts. Which inventory view in the vSphere Client must the administrator use to manage and assign these licenses?

A.Go to Administration > Licensing to add the license keys and assign them to vCenter Server, ESXi hosts, and clusters.

B.Navigate to Lifecycle Manager > Updates > Licensing to synchronize keys with VMware Cloud Services.

C.Open Host Profiles and attach a license profile to each ESXi host.

D.Right-click the vCenter Server root object and select Edit Settings > Licensing.

AnswerA

vSphere Client licensing is managed centrally under Administration > Licensing, where keys are added and assigned to vCenter Server instances, ESXi hosts and clusters. This inventory view satisfies the requirement to apply the VMware vSphere Foundation 9.0 key to both vCenter and its hosts.

Why this answer

License keys in vSphere are managed centrally under Administration -> Licensing in the vSphere Client. From there you add the VVF 9.0 key, then assign it to vCenter Server, ESXi hosts, and clusters as needed. This is the single inventory view for license management in vCenter.

Exam trap

VCP-VVF often tests whether candidates know licensing lives under Administration -> Licensing, not under Lifecycle Manager, Host Profiles, or object Edit Settings — the trap is picking a plausible-sounding but wrong inventory path.

How to eliminate wrong answers

Option B is wrong because Lifecycle Manager is for image/update management, not license assignment, and there is no 'Updates > Licensing' path that synchronizes keys with VMware Cloud Services. Option C is wrong because Host Profiles are for configuration compliance, not licensing; there is no 'license profile' concept. Option D is wrong because right-clicking the vCenter root object and selecting Edit Settings does not expose licensing — licensing is under Administration, not the object's settings.

Practice this question →

40

MCQhard

During a firmware update via vSphere Lifecycle Manager, an ESXi host enters a non-compliant state. What is the first step the administrator should take to identify the root cause?

A.Remove the host from the cluster

B.Reboot the host

C.Check the Image Compliance status in the Updates tab

D.Refresh the inventory

AnswerC

The Updates tab's Image Compliance status shows precisely which firmware or driver component caused the host to diverge from the desired image. Checking it first satisfies the stem's requirement to identify the root cause before remediating the non-compliant ESXi host.

Why this answer

Viewing the 'Image Compliance' status in the cluster's 'Updates' tab provides detailed information about why a host is non-compliant.

Practice this question →

41

MCQhard

An administrator is managing a vSphere Foundation 9.0 cluster using vSphere Lifecycle Manager (vLCM) with an image-based approach. The compliance check reports that several ESXi hosts are non-compliant because their firmware versions do not match the vendor add-on specification. However, the hardware vendor's Hardware Support Manager (HSM) extension is not showing any available firmware updates. What is the most likely cause?

A.The Hardware Support Manager (HSM) vCenter extension is offline, unregistered, or experiencing authentication issues with the vendor's firmware repository.

B.Firmware updates require a legacy Update Manager baseline attached alongside the vLCM image.

C.The ESXi hosts are running in maintenance mode, which temporarily suspends HSM firmware polling.

D.The vCenter Server firewall is blocking inbound TCP port 443 traffic from the ESXi host management vmknics.

AnswerA

Firmware remediation in vLCM flows through the vendor's HSM extension, which queries the vendor repository and stages updates. If that extension is offline, unregistered, or failing authentication, no firmware packages surface, so hosts remain non-compliant despite the image specifying a vendor add-on.

Why this answer

The Hardware Support Manager (HSM) is a vCenter extension that vLCM relies on to query the vendor's firmware repository and return available firmware packages. If the extension is offline, unregistered, or failing authentication to the vendor's repository, vLCM can still detect that firmware doesn't match the add-on spec (from cached metadata) but cannot retrieve the updates needed to remediate. Restoring the HSM extension's connectivity and credentials resolves the missing firmware list.

Exam trap

VCP-VVF often tests the misconception that vLCM itself fetches firmware directly, when in fact firmware enumeration and download depend entirely on a healthy, authenticated Hardware Support Manager extension.

How to eliminate wrong answers

Option B is wrong because vLCM image-based firmware updates are delivered through the HSM vendor add-on, not legacy baselines — mixing baseline and image approaches is unsupported. Option C is wrong because maintenance mode does not suspend HSM firmware polling; hosts in maintenance mode are actually the correct state for remediation. Option D is wrong because the HSM extension communicates outbound from vCenter to the vendor repository, not inbound from ESXi management vmknics on TCP 443.

Practice this question →

42

Multi-Selecteasy

An administrator is reviewing vSphere Foundation 9.0 licensing and deployment components. Which TWO features are typically unlocked or enhanced when deploying the complete vSphere Foundation suite compared to standalone vSphere Standard? (Choose two)

Select 2 answers

A.Free unlimited perpetual hardware warranties from server vendors

B.Automatic physical server rack assembly and cabling automation

C.Direct database write access to the vCenter embedded PostgreSQL database

D.VMware Aria Operations and Aria Operations for Logs integration

E.Advanced vSphere Lifecycle Manager (vLCM) image-based cluster management

AnswersD, E

VMware Aria Operations and Aria Operations for Logs integration is bundled with vSphere Foundation, not vSphere Standard. This satisfies the stem's requirement for features unlocked by the complete suite: Aria Operations delivers AI-driven performance monitoring and capacity analytics, while Aria Operations for Logs provides centralised log management and troubleshooting.

Why this answer

Option D is correct because vSphere Foundation bundles VMware Aria Operations and Aria Operations for Logs, giving centralized performance monitoring, capacity analytics, and log management that standalone vSphere Standard does not include. Option E is correct because vSphere Foundation unlocks the full image-based cluster lifecycle management in vSphere Lifecycle Manager (vLCM), including desired-state images, firmware add-ons via Hardware Support Managers, and cluster remediation, whereas vSphere Standard is limited to baseline-based patching. Option A is wrong because hardware warranties are contractual offerings from server OEMs and are never unlocked by a software license.

Option B is wrong because rack assembly and cabling are physical data center services, not software features of any vSphere edition. Option C is wrong because direct write access to the vCenter embedded PostgreSQL database is neither provided nor supported in vSphere Foundation; database access is restricted to protect vCenter integrity.

Exam trap

The trap is selecting options that are not software features (warranties, rack assembly) or are unsupported (direct database access), instead of the actual suite components like Aria Operations and vLCM.

Practice this question →

43

MCQmedium

An administrator is replacing certificates in a vSphere Foundation 9.0 environment and needs to verify the status of the VMware Certificate Authority (VMCA). Which CLI command executed via SSH on the vCenter Server Appliance checks the VMCA service status?

A.certool --query-status

B.service-control --status vmware-vmca

C.vpxd -check-vmca-status

D.esxcli vmca status get

AnswerB

`service-control --status vmware-vmca` queries the VMware Service Lifecycle Manager directly, reporting whether the VMCA daemon is running, stopped or errored on the vCenter Server Appliance. This satisfies the stem's requirement to verify VMCA status via SSH, since VMCA runs as a managed appliance service rather than a certificate file or API endpoint.

Why this answer

The correct command is `service-control --status vmware-vmca`, executed via SSH on the VCSA, because VMCA runs as a VMware service managed by the service-control framework (vmon). This command reports whether the vmware-vmca service is running, stopped, or in an error state, which is exactly what's needed to verify VMCA status.

Exam trap

VCP-VVF often tests whether candidates know the correct service-control syntax for VCSA services versus certool or esxcli commands, catching those who confuse certificate management tools with service status tools.

How to eliminate wrong answers

Option A is wrong because `certool --query-status` is not a valid certool operation — certool manages certificates (--gencert, --view, etc.) but does not query VMCA service status. Option C is wrong because `vpxd -check-vmca-status` is not a real vpxd option; vpxd manages the vCenter service, not VMCA status checks. Option D is wrong because `esxcli vmca status get` is not a valid esxcli namespace — esxcli runs on ESXi hosts and does not manage VCSA services.

Practice this question →

44

MCQmedium

You are deploying a VVF cluster and need to configure the Supervisor. Which tool is primarily used to enable the Supervisor service on a vSphere Cluster?

A.vSphere Client

B.vSphere Lifecycle Manager

C.vCenter Server CLI

D.Aria Operations

AnswerA

The vSphere Client is the primary interface for enabling the Supervisor on a cluster, exposing the configuration workflow under the cluster's Configure tab. It satisfies the stem's requirement by providing the supported method to activate Supervisor services during VVF cluster deployment.

Why this answer

The vSphere Client is the primary administrative interface for enabling and configuring the Supervisor service on a cluster.

Practice this question →

45

MCQeasy

An administrator is configuring vSphere HA on a VVF cluster and wants to ensure that critical virtual machines are restarted with higher priority than non-critical virtual machines during a host failure. Where is this configured?

A.VCF Operations -> Policies -> High Availability Rules.

B.Cluster -> Configure -> vSphere Availability -> VM Restart Priority.

C.SDDC Manager -> Cluster Settings -> HA Policy.

D.Virtual Machine -> Edit Settings -> VM Options -> Boot Options.

AnswerB

VM Restart Priority is a cluster-level vSphere HA setting, reached via Cluster, Configure, vSphere Availability. Assigning critical VMs a higher priority (for example High) makes HA restart them before lower-priority VMs after a host failure, satisfying the stated ordering requirement.

Why this answer

vSphere HA VM Restart Priority is configured at the cluster level under Cluster -> Configure -> vSphere Availability -> VM Restart Priority. This setting allows administrators to define restart priority (e.g., Highest, High, Medium, Low, Lowest) for virtual machines, ensuring critical VMs are restarted first during a host failure. It can be set per-VM or via VM overrides, but the primary configuration location is the cluster's vSphere Availability settings.

Exam trap

VCP-VVF often tests the confusion between cluster-level HA settings and VM-level boot options, tempting candidates to pick VM Edit Settings because it's a familiar per-VM configuration location.

How to eliminate wrong answers

Option A is wrong because VCF Operations (formerly vRealize Operations) is a monitoring and analytics platform, not where vSphere HA restart priority is configured. Option C is wrong because SDDC Manager manages VCF lifecycle and cluster provisioning, not vSphere HA VM restart priority. Option D is wrong because VM Boot Options control boot delay, firmware, and boot device order — not HA restart priority.

Practice this question →

46

MCQmedium

An administrator wants to configure an alarm in vSphere 9.0 to trigger an email notification when a datastore's free space drops below 15%. After creating the alarm definition and specifying the trigger condition, no emails are received when the threshold is breached. What is the most likely missing configuration?

A.The datastore was formatted with VMFS-5 instead of VMFS-6.

B.The ESXi firewall is blocking outbound TCP port 443 to the mail server.

C.SNMP traps must be enabled on the physical switch interconnecting the management network.

D.The vCenter mail server (SMTP) settings have not been defined in vCenter Server settings.

AnswerD

Alarm actions cannot deliver email unless vCenter has a configured SMTP server; without it, the alarm triggers but notification silently fails. Defining the mail sender settings in vCenter Server settings is the prerequisite the administrator omitted.

Why this answer

In vSphere, an alarm definition only specifies the trigger condition and the action to take (e.g., send an email). For the email action to actually work, vCenter Server must be configured with a valid SMTP mail server. Without the mail server settings defined under vCenter Server > Configure > General > Mail, vCenter has no way to send the notification, so the alarm fires but no email is delivered.

The alarm itself is correctly configured; the missing piece is the global mail configuration.

Exam trap

VCP-VVF often tests the distinction between alarm definition and global notification settings, tricking candidates into selecting network or storage-specific causes instead of the missing vCenter mail server configuration.

How to eliminate wrong answers

Option A is wrong because the datastore's VMFS version (VMFS-5 vs. VMFS-6) has no bearing on vCenter's ability to send email notifications; alarms trigger on capacity metrics regardless of the filesystem version. Option B is wrong because vCenter does not use TCP port 443 to send email; SMTP uses port 25 (or 587 for submission), and the ESXi firewall is not involved in vCenter's outbound SMTP traffic.

Option C is wrong because SNMP traps on a physical switch are unrelated to vCenter email notifications; SNMP is a separate monitoring protocol and would not affect SMTP delivery.

Practice this question →

47

MCQeasy

Which vSphere Foundation feature provides a unified view of resource consumption across multiple clusters?

A.vSphere Lifecycle Manager

B.Host Profiles

C.vCenter Server Performance Charts

D.Aria Operations Dashboards

AnswerD

Aria Operations Dashboards aggregate metrics from every connected vCenter instance, presenting cross-cluster capacity, demand and health in one interface. This satisfies the stem's requirement for a unified view of resource consumption across multiple clusters, which single-cluster vSphere Client views cannot deliver.

Why this answer

Aria Operations Dashboards (formerly vRealize Operations) provide a unified, cross-cluster view of resource consumption by aggregating metrics from multiple vCenter Server instances and clusters. Unlike native vCenter tools that are scoped to a single vCenter, Aria Operations collects data from all connected vCenters and presents it in customizable dashboards, enabling capacity planning and performance analysis across the entire vSphere Foundation environment. This is a core capability of vSphere Foundation, which includes Aria Operations for unified management.

Exam trap

VCP-VVF often tests the distinction between native vCenter Server monitoring tools (which are limited to a single vCenter) and Aria Operations, which provides cross-vCenter, cross-cluster visibility; candidates may incorrectly assume vCenter Performance Charts can aggregate data from multiple vCenters.

How to eliminate wrong answers

Option A is wrong because vSphere Lifecycle Manager (vLCM) is used for image-based cluster lifecycle management, including patching, upgrading, and firmware updates, not for monitoring resource consumption across clusters. Option B is wrong because Host Profiles are used to enforce consistent configuration across ESXi hosts, not to provide a unified view of resource usage. Option C is wrong because vCenter Server Performance Charts are limited to the scope of a single vCenter Server and do not aggregate data across multiple vCenter instances or clusters; they provide per-object performance data, not a unified cross-cluster view.

Practice this question →

48

MCQmedium

You need to ensure that specific administrators can only manage virtual machines in a specific folder. What is the correct way to implement this in VVF?

A.Use the vCenter Server permission model to assign roles at the folder level

B.Enable folder-based lockdown mode

C.Configure vSphere Tags to restrict access

D.Modify the global administrator group to exclude specific folders

AnswerA

vCenter Server's permission model supports assigning roles on inventory objects, including folders. Granting a role at the folder level propagates to contained VMs, satisfying the stem's constraint that administrators manage only VMs within that specific folder.

Why this answer

Permissions are applied by creating a role and assigning it to a user/group at the specific object level in the inventory.

Practice this question →

49

Multi-Selecteasy

An administrator needs to monitor cluster resource utilization and set up alerts using VMware Aria Operations in a vSphere Foundation environment. Which TWO object types can have custom alert definitions applied to them? (Choose two)

Select 2 answers

A.Physical Top-of-Rack Switch port cables

B.Individual user passwords in vCenter SSO

C.Virtual Machines

D.ESXi Clusters

E.vCenter database transaction log files

AnswersC, D

Aria Operations applies custom alert definitions to Virtual Machines, since they are first-class objects with collected metrics such as CPU, memory and disk usage. Defining alerts here satisfies the requirement to monitor cluster resource utilisation and trigger notifications.

Why this answer

Option C (Virtual Machines) is correct because VMware Aria Operations supports custom alert definitions on Virtual Machine objects, allowing administrators to monitor per-VM resource utilization metrics such as CPU, memory, and storage and trigger alerts when thresholds are breached. Option D (ESXi Clusters) is correct because Aria Operations also supports custom alert definitions on Cluster compute resource objects, enabling aggregate monitoring of cluster-level resource utilization and capacity across the ESXi hosts within the cluster. Option A is incorrect because physical Top-of-Rack switch port cables are not managed objects in Aria Operations; the platform monitors vSphere and related software-defined objects, not physical cabling.

Option B is incorrect because individual vCenter SSO user passwords are not monitored objects in Aria Operations and cannot have alert definitions applied to them. Option E is incorrect because vCenter database transaction log files are not Aria Operations object types; the platform does not expose database log files as alertable objects.

Exam trap

The trap is selecting objects that Aria Operations does not monitor, such as physical cables or SSO passwords; candidates may overestimate the scope of Aria Operations' monitoring capabilities.

Practice this question →

50

MCQmedium

Which component is responsible for orchestrating the lifecycle of ESXi hosts in a cluster?

A.vSphere Lifecycle Manager

B.vCenter Update Manager

C.VMware Aria Automation

D.Host Profile Manager

AnswerA

vSphere Lifecycle Manager orchestrates ESXi host lifecycle within a cluster by enforcing a single desired-state image across all members, remediating drift and coordinating firmware and driver baselines. This directly satisfies the stem's requirement for cluster-wide host lifecycle orchestration, unlike per-host update tools that lack cluster-level desired-state enforcement.

Why this answer

vSphere Lifecycle Manager (vLCM) is the component that orchestrates ESXi host lifecycle in a cluster — it manages base images, vendor add-ons, firmware, and component compliance, and drives remediation (upgrades, patches, driver/firmware updates) across hosts. It replaced the legacy Update Manager baseline model with a declarative image-based approach.

Exam trap

VCP-VVF often tests the distinction between vLCM (image-based, current) and the deprecated Update Manager baseline model — candidates pick the familiar 'Update Manager' name out of habit.

How to eliminate wrong answers

Option B is wrong because 'vCenter Update Manager' is the legacy name for the baseline-based patching feature that vLCM superseded; it is not the current lifecycle orchestrator. Option C is wrong because VMware Aria Automation handles infrastructure-as-code provisioning and cloud automation, not ESXi host patching. Option D is wrong because Host Profiles manage configuration consistency (settings, networking, security), not software/firmware lifecycle.

Practice this question →

51

MCQeasy

An administrator needs to apply a license key to a new vSphere Foundation deployment. Where should this task be performed in the vSphere Client?

A.Global Inventory Lists > vCenter Servers > Licensing

B.Administration > Licensing > Licenses

C.Host and Clusters > Configure > Licensing

D.Workload Management > Licensing

AnswerB

Licence keys are applied under Administration > Licensing > Licenses, which is the central inventory for all vSphere Foundation entitlements. Adding the key here assigns it to the deployment, satisfying the requirement to license a new vSphere Foundation instance without touching individual hosts or clusters first.

Why this answer

License keys in the vSphere Client are applied under Administration > Licensing > Licenses. This central location allows administrators to add, assign, and manage license keys for vCenter, ESXi, and other vSphere Foundation components.

Exam trap

VCP-VVF often tests the exact navigation path in the vSphere Client for licensing tasks, so candidates must remember that all license management is centralized under Administration > Licensing, not under host or workload views.

How to eliminate wrong answers

Option A is wrong because Global Inventory Lists > vCenter Servers > Licensing is not the correct path for applying license keys; licensing is managed centrally under Administration. Option C is wrong because Host and Clusters > Configure > Licensing is not a valid licensing path in the vSphere Client. Option D is wrong because Workload Management > Licensing is not where vSphere Foundation license keys are applied; Workload Management relates to Tanzu/Kubernetes functionality.

Practice this question →

52

MCQhard

An administrator is integrating VMware Aria Operations with a vSphere Foundation 9.0 cluster and wants to create a custom super metric to calculate aggregate CPU and memory stress across all virtual machines. Where must the super metric be enabled after creation to make it available for dashboard widgets and alerts?

A.Via the SDDC Manager dashboard under Workload Domains > Policies > Metrics.

B.Within the active Policy in Aria Operations under the Super Metrics configuration section.

C.In the ESXi host advanced configuration parameter 'Aria.SuperMetrics.Enable'.

D.In the vCenter Global Settings > Super Metrics activation table.

AnswerB

Super metrics are defined globally but only become active when enabled within a policy's Super Metrics section. The active policy governs the objects being monitored, so enabling it there exposes the metric to dashboard widgets and alerts, satisfying the stem's availability requirement.

Why this answer

In VMware Aria Operations, a newly created super metric must be enabled within the active policy under the Super Metrics configuration section to be evaluated and made available to dashboards and alerts. Policies determine which metrics are collected and calculated for the objects they apply to, so enabling the super metric there activates it.

Exam trap

VCP-VVF often tests where super metrics are activated, so candidates pick vCenter or SDDC Manager settings instead of the Aria Operations policy configuration where super metrics are actually enabled.

How to eliminate wrong answers

Option A is wrong because SDDC Manager does not manage Aria Operations super metrics; it handles lifecycle management for the SDDC stack. Option C is wrong because there is no ESXi advanced setting named 'Aria.SuperMetrics.Enable'; super metrics are computed in Aria Operations, not on the host. Option D is wrong because vCenter Global Settings does not contain a super metrics activation table; that functionality belongs to Aria Operations policies.

Practice this question →

53

Multi-Selectmedium

An administrator is troubleshooting a storage performance issue on a vSAN datastore in a VVF cluster. Which TWO tools or views in the vSphere Client and VCF Operations can be used to inspect vSAN health and performance? (Choose two.)

Select 2 answers

A.ESXi DCUI hardware sensor reboot menu.

B.NSX Manager transport node storage status panel.

C.VCF Operations vSAN Performance and Capacity dashboards.

D.Cluster -> Monitor -> vSAN -> Health and Performance views in the vSphere Client.

E.Cloud Builder storage inventory wizard.

AnswersC, D

VCF Operations provides specialized vSAN dashboards for deep analytical metric tracking.

Why this answer

Option C is correct because VCF Operations (formerly vRealize Operations) provides dedicated vSAN Performance and Capacity dashboards that surface metrics such as IOPS, latency, throughput, congestion, and capacity usage across the vSAN cluster, which is exactly what is needed to inspect vSAN health and performance. Option D is correct because in the vSphere Client, navigating to Cluster -> Monitor -> vSAN exposes the vSAN Health and Performance views, including health checks, performance charts, and Skyline Health diagnostics for the vSAN datastore. Option A is not relevant because the ESXi DCUI hardware sensor reboot menu deals with physical hardware sensors and host reboot actions, not vSAN storage health or performance.

Option B is not relevant because NSX Manager's transport node storage status panel relates to NSX transport node configuration and NSX-managed storage, not vSAN datastore performance. Option E is not relevant because the Cloud Builder storage inventory wizard is used during SDDC bring-up/validation to inventory hosts and storage for deployment, not for ongoing vSAN performance troubleshooting.

Exam trap

VCP-VVF often tests whether candidates can distinguish native vSphere Client vSAN views from unrelated tools (DCUI, NSX Manager, Cloud Builder) — the trap is picking a tool that sounds storage-related but isn't vSAN monitoring.

Practice this question →

54

MCQmedium

An administrator is configuring an alarm in vSphere to notify them when a virtual machine's CPU usage remains above 95% for 10 minutes. However, they want the alarm to automatically clear when the CPU drops below 80% for 5 minutes. Where is the reset/clear condition configured?

A.In the advanced vCenter setting 'Alarm.Reset.Threshold'.

B.In the VCF Operations policy management console.

C.Under the Alarm Definition -> Reset condition or tolerance panel.

D.Via esxcli alarm reset-rule configure.

AnswerC

The Reset condition or tolerance panel defines the separate threshold and duration that clears a triggered alarm. Setting CPU below 80% for 5 minutes there satisfies the stem's automatic-clear requirement, independent of the 95%/10-minute trigger.

Why this answer

In vSphere alarms, the reset/clear behavior is configured as part of the alarm definition itself, specifically in the Reset condition (also called the tolerance or 'Reset to green' condition) panel. This lets you define a separate threshold and duration that must be met before the alarm returns to a normal state, independent of the triggering condition.

Exam trap

VCP-VVF often tests whether candidates know that alarm reset/clear logic lives inside the alarm definition's Reset condition panel, not in a global advanced setting or external product.

How to eliminate wrong answers

Option A is wrong because there is no advanced vCenter setting named 'Alarm.Reset.Threshold' — alarm reset logic is per-alarm, not a global advanced setting. Option B is wrong because VCF Operations policy management is a separate product with its own symptom/alert model; the question is about a native vSphere alarm in vCenter. Option D is wrong because esxcli has no 'alarm reset-rule configure' command; esxcli manages host-level configuration, not vCenter alarm definitions.

Practice this question →

55

MCQmedium

An administrator is tasked with updating ESXi hosts using vSphere Lifecycle Manager (vLCM) in vSphere Foundation 9.0. The cluster is managed using a single image. After importing a new vendor addon and base image, the compliance check reports a non-compliant state due to a missing component. How should the administrator resolve this?

A.Edit the cluster image specification to include the required component or vendor addon, then trigger remediation.

B.Restart the vCenter Server Appliance management services to force an immediate cache refresh of host compliance.

C.Convert the cluster from image-based management to baseline-based management to bypass component validation.

D.Manually install the missing component on each ESXi host via an interactive SSH session using esxcli software.

AnswerA

A single-image cluster's desired state is defined by its image specification; the missing component must be added there before remediation can converge hosts. Editing the image spec to include the required component or vendor addon satisfies the compliance constraint.

Why this answer

vLCM image-based clusters enforce a declarative desired state defined by the cluster image specification. When a compliance check flags a missing component, the fix is to update the image spec (base image, vendor addon, or individual component) so the desired state matches what the hosts require, then remediate the cluster. This preserves the image-based management model and applies the change consistently across all hosts.

Exam trap

VCP-VVF often tests the misconception that compliance failures are caching or service issues, luring candidates toward restarting services instead of editing the image specification.

How to eliminate wrong answers

Option B is wrong because restarting vCenter services does not alter the cluster image specification and cannot resolve a genuine component mismatch — compliance is computed from the desired image, not a stale cache. Option C is wrong because converting to baselines abandons image-based management and does not 'bypass' validation; it is a disruptive architectural change that does not address the missing component. Option D is wrong because manually installing components via esxcli breaks the declarative image model — the next compliance scan will flag drift and remediation will overwrite the manual change.

Practice this question →

56

MCQeasy

An administrator is deploying a new VVF environment and needs to monitor resource utilization trends across multiple clusters over a 90-day period. Which component included in VVF provides this historical capacity planning and analytics capability?

A.vCenter Performance Charts

B.VMware Cloud Builder

C.VCF Operations (Aria Operations)

D.vSphere Lifecycle Manager (vLCM)

AnswerC

VCF Operations retains historical metrics and performs capacity analytics, forecasting and rightsizing across clusters, satisfying the 90-day trend requirement. It collects from vCenter and ESXi endpoints, whereas other VVF components handle lifecycle management, networking or automation rather than long-term capacity planning.

Why this answer

VCF Operations (formerly Aria Operations) is the component included in VMware Cloud Foundation that provides historical capacity planning, analytics, and resource utilization trending across clusters. It collects metrics over time, applies analytics to forecast capacity, and can report on 90-day or longer trends across multiple clusters. vCenter Performance Charts only shows short-term, per-object real-time or recent historical data and does not aggregate multi-cluster long-term capacity analytics.

Exam trap

VCP-VVF often tests the confusion between vCenter Performance Charts (short-term, per-object) and VCF Operations/Aria Operations (long-term, cross-cluster capacity analytics), causing candidates to pick vCenter when the scenario demands 90-day multi-cluster historical trending.

How to eliminate wrong answers

Option A is wrong because vCenter Performance Charts provides only short-term, per-object performance data (typically up to a limited retention window) and lacks the cross-cluster, long-term capacity planning and analytics engine that VCF Operations delivers. Option B is wrong because VMware Cloud Builder is a deployment and bring-up tool used to install and configure the SDDC, not a monitoring or capacity analytics component. Option D is wrong because vSphere Lifecycle Manager (vLCM) manages host image compliance, patching, and firmware/software lifecycle, not resource utilization trending or capacity planning.

Practice this question →

57

MCQeasy

An administrator needs to verify the health status and cluster state of NSX Manager nodes in a VVF deployment. Where in the NSX Manager UI is this information located?

A.vCenter -> Monitor -> NSX Cluster Health.

B.System -> Fabric -> Nodes -> NSX Managers (or Cluster Management).

C.SDDC Manager -> Infrastructure -> NSX Health.

D.Cloud Builder -> Appliance Status.

AnswerB

NSX Manager health and cluster state are exposed under System, then Fabric, then Nodes, where the NSX Managers view lists each node's status and cluster condition. This is the location for verifying node health in a VVF deployment.

Why this answer

In the NSX Manager UI, cluster health and node status for NSX Manager nodes are found under System -> Fabric -> Nodes -> NSX Managers (or the Cluster Management tab within that view). This is the authoritative location for checking NSX Management Cluster state, including node connectivity, cluster quorum, and service health. The other options reference interfaces that either do not exist or belong to different VMware products (vCenter, SDDC Manager, Cloud Builder).

Exam trap

VCP-VVF often tests the specific navigation path within NSX Manager for cluster health, and candidates may confuse it with vCenter or SDDC Manager interfaces because those also provide some NSX-related health information in VCF contexts.

How to eliminate wrong answers

Option A is wrong because vCenter does not have a 'Monitor -> NSX Cluster Health' section; NSX health is not exposed there, and vCenter monitors vSphere objects, not NSX Manager cluster internals. Option C is wrong because SDDC Manager is part of VMware Cloud Foundation (VCF) and manages the lifecycle of VCF components, but it does not provide a direct 'Infrastructure -> NSX Health' view for NSX Manager cluster state; that detail resides in NSX Manager itself. Option D is wrong because Cloud Builder is a deployment-time tool for bringing up VCF/NSX-T, not a runtime health monitoring interface; it has no 'Appliance Status' page for ongoing cluster health.

Practice this question →

58

Multi-Selecteasy

Which TWO of the following tasks can be performed using the vCenter Server Appliance Management Interface (VAMI)? (Choose two.)

Select 2 answers

A.Monitoring vCenter resource usage

B.Configuring DRS automation levels

C.Performing vCenter updates and patching

D.Configuring vSphere Distributed Switch settings

E.Creating virtual machines

AnswersA, C

VAMI exposes the appliance's own CPU, memory, storage and database statistics through its Monitor tab, letting administrators track vCenter resource consumption without vSphere Client access. This directly satisfies the stem's requirement, since monitoring vCenter resource usage is one of the two management tasks VAMI uniquely provides on port 5480.

Why this answer

Option A (Monitoring vCenter resource usage) is correct because the VAMI at port 5480 provides built-in monitoring views for the appliance's CPU, memory, storage, and database utilization, allowing administrators to track the health and resource consumption of the vCenter Server Appliance itself. Option C (Performing vCenter updates and patching) is correct because the VAMI includes an Update section that lets administrators check for, stage, and install software updates and patches for the vCenter Server Appliance directly from the appliance management interface. The remaining options do not belong: DRS automation levels (B) are configured in the vSphere Client under cluster settings, not in VAMI; vSphere Distributed Switch settings (D) are managed through the vSphere Client networking configuration; and creating virtual machines (E) is performed in the vSphere Client, not through the appliance management interface.

Practice this question →

59

MCQmedium

An administrator is configuring a new user role in vCenter Server 9.0 that requires permission to manage virtual machine snapshots, but nothing else. Where should the administrator create this custom role?

A.NSX Manager -> System -> Users -> Roles.

B.VCF Operations -> Administration -> Access Control -> Roles.

C.Administration -> Access Control -> Roles -> Create Role.

D.SDDC Manager -> Administration -> IAM -> Custom Roles.

AnswerC

Custom roles are created at the vCenter Server system level, not on individual objects, because roles form the reusable permission definitions later paired with objects. Navigating Administration -> Access Control -> Roles -> Create Role lets the administrator define only the snapshot-management privileges required, satisfying the least-privilege constraint.

Why this answer

Custom roles in vCenter Server are created and managed from the vSphere Client under Administration -> Access Control -> Roles, where the administrator clicks 'Create Role' and selects the specific privileges (e.g., Virtual Machine -> Snapshot Management) needed. This is the native RBAC location for defining granular roles that can then be assigned to users or groups on inventory objects.

Exam trap

VCP-VVF often tests whether candidates confuse vCenter RBAC with NSX or SDDC Manager IAM, so the trap is picking a management-plane tool (NSX Manager, VCF Operations, SDDC Manager) when the question is specifically about vCenter custom roles.

How to eliminate wrong answers

Option A is wrong because NSX Manager's Users/Roles section manages NSX-specific roles and permissions for NSX objects, not vCenter Server RBAC roles. Option B is wrong because VCF Operations (formerly Aria Operations) handles monitoring, capacity, and reporting access control, not vCenter authorization roles. Option D is wrong because SDDC Manager IAM manages VCF-level user and role assignments for lifecycle management, not vCenter custom roles for VM snapshot privileges.

Practice this question →

60

MCQhard

An administrator is managing license keys across multiple vCenter instances in a vSphere Foundation 9.0 deployment. Some licenses are assigned to clusters, while others are assigned directly to individual ESXi hosts. What is the licensing inheritance rule when a host is added to a cluster that already has a vSphere Foundation license assigned?

A.The cluster-level license overrides the host-level license, and the host adopts the cluster licensing assignment.

B.The operation fails, requiring the administrator to manually remove the host license before joining the cluster.

C.Both licenses merge their capacity pools, doubling the available core count for that specific host.

D.The host retains its standalone license key, which causes a licensing compliance warning on the cluster.

AnswerA

Cluster licenses automatically apply to all member hosts upon joining, superseding any existing standalone host licenses.

Why this answer

In vSphere licensing, when a host with a standalone license is added to a cluster that already has a cluster-level license assigned, the cluster-level license takes precedence and the host adopts the cluster's licensing assignment. This is the documented inheritance rule for cluster vs. host licensing.

Exam trap

VCP-VVF often tests licensing inheritance rules, and the trap is assuming the host keeps its standalone license or that the operation fails, when in fact the cluster license silently overrides the host license.

How to eliminate wrong answers

Option B is wrong because the operation does not fail; vSphere automatically reconciles the host license to the cluster license without requiring manual removal. Option C is wrong because licenses do not merge or pool capacity — each license has a defined core capacity and only one license applies to a given host at a time. Option D is wrong because the host does not retain its standalone license when joining a licensed cluster; the cluster license overrides it, so no compliance warning is generated for that reason.

Practice this question →

61

MCQeasy

An administrator wants to create a custom dashboard in vSphere Foundation 9.0 using vRealize Operations (Aria Operations) integration to monitor specific KPIs of Tier-1 database virtual machines. Which initial step must be performed to ensure the data from vCenter Server is available in Aria Operations?

A.Create a custom tag in vCenter Server and export it using Content Library templates.

B.Log in to Aria Operations, navigate to Data Sources > Integrations > Accounts, and add the vCenter Server instance as a vCenter Adapter.

C.Install the Aria Operations plugin directly inside the vCenter Server Appliance VAMI interface.

D.Enable vSphere HA heartbeat monitoring on the database cluster.

AnswerB

Adding the vCenter Server instance as a vCenter Adapter account in Aria Operations establishes the data collection path, so metrics from vCenter Server become available for dashboards. This satisfies the stem's requirement that vCenter Server data be available in Aria Operations first.

Why this answer

Before Aria Operations can collect any metrics from vCenter Server, the vCenter instance must be registered as an account under the vCenter Adapter in Aria Operations. This adapter establishes the management-plane connection that pulls inventory, performance counters, and events from vCenter, which are then used to build custom dashboards and KPI widgets. Without this account integration, no vSphere data flows into Aria Operations regardless of tags, plugins, or HA settings.

Exam trap

VCP-VVF often tests whether candidates confuse vCenter-side configuration (tags, HA, VAMI services) with the actual Aria Operations account integration step required to ingest vSphere data.

How to eliminate wrong answers

Option A is wrong because tags in vCenter are metadata objects used for policy and grouping, not a transport mechanism for exporting metrics to Aria Operations, and Content Library templates have nothing to do with analytics data ingestion. Option C is wrong because there is no Aria Operations plugin installed inside the vCenter Server Appliance VAMI; integration is configured from the Aria Operations management interface via the vCenter Adapter, not from VAMI. Option D is wrong because vSphere HA heartbeat monitoring is an availability feature for VM restart, not a data-collection path into Aria Operations.

Practice this question →

62

Multi-Selecthard

An administrator is configuring advanced alerting and notification rules in VMware Aria Operations for vSphere Foundation. Which THREE actions can be configured as outbound notifications when an alert triggers? (Choose three)

Select 3 answers

A.Directly modifying physical switch VLAN trunk configurations via SSH.

B.Invoking a Webhook to send JSON payloads to third-party incident management systems (e.g., ServiceNow, Slack).

C.Automatically executing a local Bash shell script directly on the ESXi host hypervisor kernel.

D.Generating and dispatching SNMP traps to an external network management system.

E.Sending an email notification via an SMTP server.

AnswersB, D, E

Webhook notifications let Aria Operations POST a JSON payload to an external HTTP endpoint, so alerts can be forwarded directly into ServiceNow or Slack. This satisfies the outbound notification requirement without needing a broker or agent on the target system.

Why this answer

Option B is correct because Aria Operations supports outbound Webhook notifications, which POST a JSON payload to an external HTTP/HTTPS endpoint such as ServiceNow or Slack for incident management integration. Option D is correct because Aria Operations can be configured to send SNMP traps to an external SNMP manager/trap receiver for network management system integration. Option E is correct because Aria Operations includes an outbound email notification action that relays alert messages through a configured SMTP server.

Option A is not a supported outbound notification action, as Aria Operations does not SSH into physical switches to alter VLAN trunking. Option C is also not supported, since Aria Operations cannot execute arbitrary Bash scripts directly on the ESXi host hypervisor kernel as an alert notification.

Exam trap

VCP-VVF often tests the misconception that Aria Operations can execute scripts or modify infrastructure directly, when in fact it only sends outbound notifications via webhook, SNMP, or email.

Practice this question →

63

Multi-Selectmedium

An administrator is configuring alarms and alert notifications in vSphere 9.0. Which TWO actions can be configured as a direct response to a triggered vSphere Alarm? (Choose two.)

Select 2 answers

A.Automatically re-license all hosts with trial keys.

B.Automatically migrate the vCenter Server VM to a secondary public cloud region.

C.Run a command or script on the vCenter Server appliance.

D.Send a notification email to specified administrative distribution lists.

E.Re-install the ESXi host hypervisor operating system from scratch.

AnswersC, D

vSphere alarms support a run-command action that executes a script on the vCenter Server appliance itself, not on the monitored ESXi host. This gives administrators automated remediation directly from the alarm definition, satisfying the stem's requirement for a configurable direct response to a triggered alarm.

Why this answer

Option C is correct because vSphere alarms support an action that runs a command or script on the vCenter Server appliance, allowing automated remediation or logging when the alarm triggers. Option D is correct because sending a notification email to configured recipients is one of the standard alarm actions in vSphere, letting administrators receive alerts about triggered conditions. These two are among the built-in alarm actions available when configuring an alarm in vSphere 9.0.

Option A is not a valid alarm action, as licensing operations such as applying trial keys are not triggered by alarms. Option B is not supported because vSphere alarms cannot orchestrate cross-cloud migration of the vCenter Server VM to a public cloud region. Option E is not an alarm action, since reinstalling an ESXi host's hypervisor is not an automated response available through vSphere alarms.

Exam trap

The trap is confusing vSphere alarm actions with unrelated administrative tasks like re-licensing or reinstalling hosts, when only email notification and script execution are valid alarm responses.

Practice this question →

64

MCQeasy

What is the recommended minimum number of hosts for a production vSphere cluster to ensure high availability during maintenance?

A.5

B.1

C.3

D.2

AnswerC

Three hosts let vSphere HA tolerate one host's maintenance or failure while retaining two for running workloads and maintaining quorum-style availability. This satisfies the stem's requirement for production high availability during maintenance, which a two-host cluster cannot sustain.

Why this answer

Three hosts are the minimum requirement to maintain N+1 redundancy when one host is down for maintenance.

Practice this question →

65

MCQmedium

An administrator is reviewing the VVF 9.0 software BOM (Bill of Materials) compatibility before initiating an upgrade via SDDC Manager. Where in SDDC Manager is the target software version bundle downloaded and validated?

A.Lifecycle Management -> Bundle Management or Repository dashboard.

B.vCenter -> Updates -> Lifecycle Manager -> Software Boms.

C.Cloud Builder -> Updates -> BOM Checker.

D.NSX Manager -> System -> Upgrades -> Bundle Store.

AnswerA

SDDC Manager's Lifecycle Management section hosts the Bundle Management and Repository dashboard, where target version bundles are downloaded, validated against the BOM, and staged before upgrade. This satisfies the stem's requirement to locate where the VVF 9.0 software bundle is retrieved and checked prior to initiating the SDDC Manager upgrade.

Why this answer

In SDDC Manager, the Lifecycle Management section contains the Bundle Management (also called the Repository) dashboard where target software version bundles for VVF/VCF are downloaded, validated, and staged before an upgrade. This is the single control point for BOM management in an SDDC Manager-managed environment. The administrator downloads the bundle there and SDDC Manager validates it against the current BOM before the upgrade can proceed.

Exam trap

VCP-VVF often tests whether candidates know that SDDC Manager (not vCenter Lifecycle Manager or Cloud Builder) is the control plane for VVF/VCF BOM bundle download and validation, so candidates who pick vCenter LCM fail.

How to eliminate wrong answers

Option B is wrong because vCenter's Lifecycle Manager manages ESXi host images and firmware, not the VVF/VCF software BOM bundles that SDDC Manager orchestrates. Option C is wrong because Cloud Builder is only used for the initial bring-up of the management domain and does not have an ongoing BOM checker for upgrades. Option D is wrong because NSX Manager's bundle store only handles NSX components, not the full VVF BOM that includes vCenter, ESXi, NSX, and SDDC Manager components.

Practice this question →

66

Multi-Selectmedium

An administrator is managing software lifecycle updates for a VVF environment. Which TWO tasks can be performed using SDDC Manager? (Choose two.)

Select 2 answers

A.Provision virtual machines and configure guest operating system user accounts.

B.Design custom virtual machine guest OS disk partitioning layouts.

C.Download and manage software update bundles from VMware online repositories.

D.Configure local user accounts and firewall rules on physical top-of-rack switches.

E.Execute automated lifecycle upgrades for vCenter Server, ESXi hosts, and NSX Manager as a unified stack.

AnswersC, E

SDDC Manager includes the bundle management workflow that contacts VMware online repositories, downloads software update bundles and stores them for later application. This directly satisfies the stem's lifecycle task of obtaining and managing update bundles.

Why this answer

Option C is correct because SDDC Manager includes the Bundle Management functionality that connects to the VMware Depot (online repository) to download, import, and manage software update bundles used for the SDDC stack. Option E is correct because SDDC Manager's Lifecycle Management performs automated, orchestrated upgrades of the full VMware Cloud Foundation stack — vCenter Server, ESXi hosts, NSX Manager, and SDDC Manager itself — as a unified, dependency-aware workflow. Option A is incorrect because provisioning VMs and configuring guest OS user accounts is done in vCenter Server (or guest OS tooling), not SDDC Manager.

Option B is incorrect because custom guest OS disk partitioning is a VM/guest-level design task handled in vCenter or by the OS installer, not by SDDC Manager. Option D is incorrect because configuring local accounts and firewall rules on physical top-of-rack switches is a network device administration task, outside SDDC Manager's scope.

Exam trap

VCP-VVF often tests the boundary of SDDC Manager's responsibilities, so candidates incorrectly attribute VM provisioning or switch configuration to it instead of recognizing its lifecycle and bundle management role.

Practice this question →

67

MCQmedium

An administrator is attempting to run a pre-upgrade health check using SDDC Manager before upgrading the VVF environment. The pre-check fails with an error stating that API connectivity to the vCenter Server is unreachable. What is the most appropriate troubleshooting step?

A.Verify network connectivity and ensure vCenter API services (vpxd and associated web services) are running and accessible on TCP port 443.

B.Re-configure the ESXi host direct management passwords via DCUI.

C.Reboot the SDDC Manager appliance into single-user recovery mode.

D.Re-install the NSX Policy Manager appliance.

AnswerA

The pre-check reaches vCenter over its API on TCP 443, so an unreachable error points to network or service failure. Confirming connectivity and that vpxd and its web services are running and listening on 443 directly addresses that constraint.

Why this answer

The error indicates that SDDC Manager cannot reach the vCenter Server API. The most appropriate first step is to verify network connectivity and ensure that vCenter's API services (vpxd and associated web services) are running and listening on TCP port 443. This directly addresses the unreachable API issue.

Exam trap

The trap is assuming that any connectivity error requires a reboot or reinstall, rather than methodically checking network and service status; candidates may overlook the specific port and service dependencies.

How to eliminate wrong answers

Option B is wrong because resetting ESXi host passwords via DCUI does not resolve vCenter API connectivity issues; it addresses host access, not vCenter service availability. Option C is wrong because rebooting SDDC Manager into single-user mode is a drastic measure that does not fix network or service problems on vCenter and could cause further disruption. Option D is wrong because reinstalling NSX Policy Manager is unrelated to vCenter API connectivity and would not resolve the pre-check failure.

Practice this question →

68

Multi-Selecthard

An administrator is troubleshooting a certificate management failure when replacing certificates on a vCenter 9.0 instance. Which THREE logs or utilities are critical for diagnosing certificate issues on the vCenter appliance? (Choose three.)

Select 3 answers

A./var/log/vmware/sso/sso.log for Security Token Service and STS certificate trust errors

B./var/log/vmware/nsx-manager/nsx-syslog.log

C./var/log/vmware/vcf/sddc-manager/sddc-manager.log

D./var/log/vmware/vmdird/vmdird.log for directory service and certificate store replication issues

E.vSphere Certificate Manager CLI utility logs and output prompts

AnswersA, D, E

The sso.log records Security Token Service activity and STS certificate trust errors, which are common causes of vCenter certificate replacement failures. Reviewing it reveals trust chain or token-signing problems that block the certificate-manager workflow on the vCenter appliance.

Why this answer

Option A is correct because /var/log/vmware/sso/sso.log records Security Token Service activity, including STS certificate trust and signing errors that commonly surface when vCenter certificates are replaced and the STS signing certificate chain is broken. Option D is correct because /var/log/vmware/vmdird/vmdird.log captures VMware Directory Service operations, including replication and certificate store updates in VMDIR, which are essential when diagnosing why a new certificate is not propagating across the vCenter services. Option E is correct because the vSphere Certificate Manager CLI (/usr/lib/vmware-vmca/bin/certificate-manager) is the supported utility for replacing and resetting vCenter certificates, and its interactive prompts and output logs directly reveal failures such as invalid SSO credentials, missing certificate files, or rejected certificate chains.

Option B does not belong because nsx-syslog.log pertains to NSX Manager components, not the vCenter appliance's certificate management. Option C does not belong because sddc-manager.log relates to VMware Cloud Foundation SDDC Manager orchestration, which is a separate product from a standalone vCenter 9.0 certificate replacement.

Exam trap

The trap is including logs from adjacent products (NSX, SDDC Manager) that sound plausible in a VCF context but are not part of vCenter's certificate subsystem — candidates must know which logs belong to vCenter itself.

Practice this question →

69

MCQhard

An administrator is troubleshooting a vSphere Foundation 9.0 cluster where vSphere Lifecycle Manager (vLCM) remediation fails with an error stating that the host cannot enter maintenance mode because certain virtual machines cannot be migrated. What is the most robust way to handle this during vLCM cluster remediation?

A.Configure the remediation settings to power off or suspend conflicting virtual machines, or temporarily disable conflicting DRS rules.

B.Permanently delete all virtual machines from the cluster inventory before triggering remediation.

C.Manually SSH into each VM and stop the guest OS services prior to running remediation.

D.Disable vSphere HA across the entire cluster to bypass maintenance mode checks.

AnswerA

vLCM remediation fails when DRS cannot evacuate VMs blocking maintenance mode. Configuring remediation to power off or suspend those VMs, or disabling conflicting DRS rules, removes the blocker directly, allowing the host to enter maintenance mode and complete remediation.

Why this answer

When vLCM encounters VMs that cannot be migrated (e.g., due to device connections or affinity rules), the administrator can configure remediation settings to power off those VMs or suspend them, or address the underlying migration block.

Practice this question →

70

Multi-Selecthard

An administrator is configuring role-based access control (RBAC) across a VVF 9.0 deployment. Which THREE statements regarding RBAC management across vCenter and NSX are correct? (Choose three.)

Select 3 answers

A.Assigning a role in vCenter automatically grants identical administrative privileges in NSX Manager.

B.Global Permissions in vCenter apply exclusively to a single ESXi host and cannot span across Linked Mode vCenters.

C.Administrators can create custom roles in vCenter with specific granular privileges (e.g., VM snapshot management only).

D.vCenter permissions applied to an inventory folder can be configured to propagate to child objects.

E.NSX Manager maintains its own separate RBAC and role assignment engine, independent of vCenter roles.

AnswersC, D, E

vCenter supports user-defined roles built from selected granular privileges, such as snapshot management alone. This satisfies the stem's RBAC configuration scenario by showing administrators can tailor permissions precisely rather than relying only on the predefined system roles.

Why this answer

Option C is correct because vCenter's RBAC model lets administrators define custom roles that bundle only the specific privileges needed, such as VirtualMachine.State.CreateSnapshot for snapshot management, rather than granting broad built-in roles. Option D is correct because permissions assigned at a folder (or datacenter) level can be propagated down the inventory hierarchy to child objects like VMs, hosts, and resource pools, which is how inheritance works in vCenter. Option E is correct because NSX Manager runs its own independent RBAC and role-assignment engine, so NSX roles and permissions are managed separately from vCenter roles even when the products are integrated.

Option A is wrong because assigning a vCenter role does not automatically grant identical administrative privileges in NSX Manager; the two systems have separate role engines. Option B is wrong because Global Permissions in vCenter are not limited to a single ESXi host and do span across Linked Mode vCenters, applying to all objects in the inventory.

Exam trap

The trap is assuming that vCenter and NSX share a unified RBAC model — candidates often think vCenter roles propagate to NSX, but NSX maintains its own independent authorization engine.

Practice this question →

71

MCQhard

An administrator is troubleshooting an issue where SDDC Manager fails to execute a life-cycle upgrade task because a pre-check reports an invalid vCenter SSO administrator password. The password was recently rotated. Where must the administrator update the stored credentials in SDDC Manager so the upgrade can proceed?

A.vCenter Server -> SSO -> Configuration -> Credentials.

B.Administration -> Credentials / Password Management in SDDC Manager.

C.Cloud Builder appliance configuration properties.

D.NSX Manager -> System -> Users -> Password Policy.

AnswerB

SDDC Manager stores the vCenter SSO administrator credential used for life-cycle pre-checks in its own credential store, not in vCenter. Rotating the password in vCenter leaves the stale value here, so updating it under Administration -> Credentials / Password Management restores the pre-check.

Why this answer

SDDC Manager maintains its own credential store for all managed components, including vCenter Server SSO accounts, and life-cycle upgrade pre-checks validate against this store. When a password is rotated outside SDDC Manager, the stored credential becomes stale, causing the pre-check failure. The administrator must update the password in SDDC Manager's credential management interface, typically found under Administration -> Credentials / Password Management, so that SDDC Manager can authenticate and proceed with the upgrade.

Exam trap

VCP-VVF often tests the misconception that credentials are updated within the managed component (e.g., vCenter SSO) rather than in SDDC Manager's centralized credential store, leading candidates to choose option A.

How to eliminate wrong answers

Option A is wrong because vCenter Server's SSO configuration only manages SSO policies and identity sources, not the credentials SDDC Manager uses for automation. Option C is wrong because Cloud Builder is used for initial deployment and host commissioning, not for ongoing credential rotation or life-cycle management. Option D is wrong because NSX Manager's user and password policy settings are specific to NSX components and have no bearing on SDDC Manager's stored vCenter credentials.

Practice this question →

72

MCQmedium

An administrator is auditing access control within a vSphere Foundation 9.0 environment. A specific group of security operators requires permission to view and manage VM snapshots across all production virtual machines, but they must not be allowed to power off virtual machines or modify networking settings. What is the best practice method to implement this?

A.Modify the default 'No Access' role to include snapshot creation rights for the production cluster.

B.Assign the built-in Administrator role to the security group and remove individual permissions via advanced host policies.

C.Grant the security group Read-Only access at the vCenter root and enable snapshot delegation in Host Profiles.

D.Create a custom vSphere role containing only the required snapshot privileges and assign it to the security group on the production VM folder with propagation enabled.

AnswerD

A custom role grants exactly the snapshot privileges required, and assigning it at the production VM folder with propagation inherits that permission to every VM beneath, without granting power-off or network privileges. This satisfies least privilege while covering all production virtual machines from one assignment.

Why this answer

The best practice is to create a custom role with only the required snapshot privileges (e.g., VirtualMachine.State.CreateSnapshot, RemoveSnapshot, RevertToSnapshot) and assign it to the security group on the production VM folder with propagation enabled. This follows the principle of least privilege, granting exactly the needed permissions without allowing power off or network changes. Assigning at the folder level with propagation ensures the role applies to all VMs within that folder and any subfolders.

Exam trap

VCP-VVF often tests the misconception that default roles can be modified or that host policies can override vCenter permissions, leading candidates to choose incorrect options that violate least privilege.

How to eliminate wrong answers

Option A is wrong because the default 'No Access' role cannot be modified; it is a system role that grants no permissions and is not editable. Option B is wrong because assigning the Administrator role grants full privileges, and removing individual permissions via host policies is not how vSphere permissions work—host policies do not override vCenter permissions. Option C is wrong because Read-Only access does not allow snapshot management, and snapshot delegation in Host Profiles is not a feature; Host Profiles are for host configuration, not permission delegation.

Practice this question →

73

Multi-Selecthard

Which THREE actions are part of the process when using vSphere Lifecycle Manager to update an ESXi cluster to a new baseline? (Choose three.)

Select 3 answers

A.Running a compliance check

B.Remediating the cluster hosts

C.Importing an ESXi image or baseline

D.Updating the vCenter Server version before the hosts

E.Manually SSHing into hosts to apply patches

AnswersA, B, C

A compliance check compares each host's current image against the target baseline, revealing which hosts require remediation. Running it is the prerequisite step that satisfies the stem's requirement, preceding staging, remediation and any required reboots during the cluster update process.

Why this answer

Option A (Running a compliance check) is correct because vSphere Lifecycle Manager must scan the cluster hosts against the attached baseline or image to determine which hosts are non-compliant before any remediation can occur. Option B (Remediating the cluster hosts) is correct because remediation is the actual operation that applies the baseline's updates to the ESXi hosts, bringing them into compliance. Option C (Importing an ESXi image or baseline) is correct because the desired update content must first be brought into vSphere Lifecycle Manager as an image or baseline before it can be attached and used for compliance checking and remediation.

Option D is incorrect because updating vCenter Server is a separate management-plane task and is not a required step of the ESXi cluster baseline update process. Option E is incorrect because vSphere Lifecycle Manager performs remediation through vCenter and ESXi APIs, not by manually SSHing into hosts to apply patches.

Practice this question →

74

MCQmedium

You want to automate the deployment of several similar VMs. Which feature in vCenter allows you to create a template and manage its versioning?

A.Datastore Browser

B.VMware Tools update manager

C.Content Library

D.Virtual Machine Snapshots

AnswerC

Content Library stores VM templates as library items and supports versioning, so updated templates can be published and tracked without overwriting prior versions. This satisfies the requirement to create a template and manage its versioning for automating similar VM deployments in vCenter.

Why this answer

Content Libraries are the designated way to store and version templates in vSphere.

Practice this question →

75

MCQhard

An administrator is configuring an alert in VMware Aria Operations to trigger when a datastore's free space drops below 10%. The administrator wants the notification email to include specific custom properties of the datastore, such as its assigned Tier and Business Owner. How can this be accomplished?

A.Hardcode the datastore properties into the static subject line of the email notification rule.

B.Use notification rule payload variables referencing the object's custom properties in the notification template.

C.Configure a syslog forwarding rule that translates custom properties into RFC 5424 structured data.

D.Edit the vCenter alarm definition script to query the vCenter database for custom attributes.

AnswerB

Notification rule payload variables resolve object properties at send time, so referencing the datastore's custom properties (Tier, Business Owner) injects those values directly into the email template. This satisfies the requirement to include object-specific custom property data in the alert notification.

Why this answer

To include custom properties of a datastore in an alert notification email, you must use notification rule payload variables that reference the object's custom properties. Aria Operations allows you to insert dynamic variables in the notification template, such as ${object.customProperties['Tier']}, which will be replaced with the actual value at send time. This enables personalized and context-rich alerts.

Exam trap

The trap is thinking that vCenter alarm scripts or static text can achieve dynamic property inclusion; candidates may not realize that Aria Operations has its own notification templating engine with variable substitution.

How to eliminate wrong answers

Option A is wrong because hardcoding properties into the subject line would make the notification static and not reflect the actual datastore's properties, defeating the purpose of dynamic alerting. Option C is wrong because syslog forwarding with RFC 5424 structured data is unrelated to email notifications and does not support custom property substitution in emails. Option D is wrong because editing vCenter alarm scripts to query the vCenter database is not how Aria Operations notifications work; Aria Operations uses its own notification rules and does not rely on vCenter alarm scripts for this purpose.

Practice this question →

Page 1 of 2 · 145 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Deploy Configure And Operate Vvf questions.

Start 20-question session