CCNA It Architectures Technologies Standards Questions

NFS 4.1 introduces session trunking and native client-side multipathing, allowing multiple TCP connections across paths for load balancing and failover. NFSv3 lacks this, relying on a single path, so this satisfies the stem's requirement for a key architectural advantage in vSphere.

Joining ESXi and vCenter Server to a directory domain relies on LDAP for directory queries and Kerberos for authentication and ticket issuance. This is the standard directory integration model in vSphere Foundation 9.0. It enables centralized authentication against the existing directory service and supports single sign-on for administrative access, matching the design requirement for an industry-standard protocol.

Stretched clusters require low-latency, high-bandwidth inter-site links because vMotion and storage traffic traverse the interswitch link continuously. Insufficient ISL capacity or latency degrades HA failover and vSAN performance across sites, so redundant ISLs sized for peak workload mobility and storage replication satisfy this design constraint.

A virtual TPM 2.0 device is supported on vSphere Foundation 9.0 virtual machines and enables guest features such as BitLocker and measured boot. Including it in the baseline ensures new workloads can use encryption and attestation without hardware changes later. It is a standard, broadly supported capability rather than a niche add-on.

NSX Distributed Firewall enforces stateful rules in the kernel of each ESXi host's virtual switch, inspecting east-west traffic at the vNIC before it leaves the host, so inter-VM filtering occurs in-guest-network without hairpinning to a physical appliance.

vLCM provides image-based cluster management, where a desired-state image defines ESXi base image, firmware add-ons and components, plus drift and compliance monitoring against that image. This satisfies the stem's requirement for centralised lifecycle management and image-based updates across the cluster.

VM Encryption encrypts virtual machine files and disks at rest using keys from a KMIP-compliant server, so stolen disks or servers yield unreadable data. This directly addresses the physical theft threat at the ROBO site.

In a 2-node direct-connect topology, neither host can hold quorum alone, so a Witness Node in a third failure domain supplies the tie-breaker vote. Without it, a network partition between the two hosts risks split-brain, with both sides claiming the vSAN datastore.

vSphere Foundation 9.0 supports NTP as the standard time synchronization protocol for both ESXi hosts and vCenter Server. Using NTP keeps host and vCenter clocks aligned, which is required for certificate validation, Kerberos authentication, and accurate log correlation. It is the protocol the architect should document as the supported baseline.

Secure Shell provides encrypted, authenticated command-line access to the ESXi host's shell, satisfying the requirement for secure administration and troubleshooting. Unlike the deprecated Telnet service, SSH encrypts all traffic, including credentials, and is enabled per host through the vSphere Client or ESXi Shell settings.

Round Robin cycles I/O across all active paths, using them simultaneously and distributing load. It is the recommended default path selection policy for active-active storage arrays and satisfies the design goal of leveraging every available path. This makes it the correct choice for the Fibre Channel array described.

Default DRS load balancing consumes active memory and CPU demand metrics, not configured static allocations, so it satisfies the stem's requirement to balance virtual machines on genuine utilisation. This is the standard metric set for Fully Automated clusters.

NVMe over RDMA with RoCEv2 uses Remote Direct Memory Access to transfer data directly between host and array memory, bypassing the CPU and TCP/IP stack. This minimizes CPU overhead and supports end-to-end congestion control through Explicit Congestion Notification, which is critical for latency-sensitive database workloads on a lossless Ethernet fabric.

Stretched vSAN clusters require synchronous replication, which is bounded by round-trip latency. VMware supports a maximum RTT of 5 milliseconds between sites; beyond this, writes cannot commit within tolerance and the stretched configuration is unsupported.

EVC masks CPU feature differences within a single vendor's processor family by presenting a common baseline; it cannot reconcile the fundamentally different instruction sets of Intel and AMD. Cross-vendor EVC is therefore architecturally unsupported, making this the design limitation for the mixed Ice Lake and EPYC clusters.

Block Zero and Full Copy are VAAI primitives offloaded to compliant arrays: the array zeroes thick disks and clones VMDKs natively, eliminating host-side write operations. This hardware acceleration satisfies the requirement for array-integrated advanced storage features.

ESXi management and vCenter Server must be reachable from administrators, DNS, Active Directory and other sites, so they need routable addresses. Other segments such as vMotion, vSAN or replication traffic can remain on isolated, non-routed VLANs, satisfying the cross-enterprise reachability constraint.

vSAN traffic is enabled via a dedicated VMkernel service checkbox, satisfying the requirement for storage traffic separation on a vSphere Foundation cluster. Each VMkernel adapter carries only the services ticked for it, so vSAN can share an adapter or use its own, matching the question's checkbox criterion.

vSAN stretched clusters require the witness host to sit at a third site, with witness traffic tolerating up to 100 ms round-trip latency and roughly 2 Mbps bandwidth per host. Meeting this RTT bound satisfies the stem's multi-site constraint, keeping quorum traffic viable without forcing a full data-site link.

Correct. VCHA protects the vCenter management plane across sites when deployed with proper node separation.

Storage vMotion relocates a running VM's virtual disk files between datastores while the VM stays powered on, with no downtime. This satisfies the stem's requirement for natively supported migration methods for moving running virtual machines in vSphere Foundation 9.0.

Manual automation makes DRS generate migration recommendations for initial placement and load balancing but never executes them; the administrator applies them. This satisfies the stem's requirement by naming one of the three configurable DRS automation levels.

Proactive HA integrates vendor hardware health providers (Dell, HPE, Cisco) through their SMASH/CMC interfaces; when a provider reports degraded components such as failing fans or memory, affected hosts are automatically evacuated into maintenance or quarantine mode before failure occurs.

The hardware support manager supplies vendor-validated firmware and driver packages that vLCM incorporates into the unified ESXi image, ensuring the desired state includes supported hardware components. This satisfies the requirement to manage firmware alongside software in one image.

VM Component Protection detects APD and PDL conditions on datastores and applies configured responses, such as restarting affected virtual machines on hosts with healthy storage paths. It is the specific vSphere HA setting governing VM handling during all-paths-down events.

RoCEv2 uses RDMA to move data directly between host and target memory, so the kernel network stack and CPU copy operations are bypassed. This cuts per-I/O latency and CPU overhead compared with NVMe-oF TCP, which still traverses the standard TCP/IP stack.

OIDC and SAML 2.0 are the two federation protocols vCenter Server supports for external identity providers. OIDC handles token-based authentication via providers like Okta and Microsoft Entra ID, while SAML 2.0 covers browser-based SSO assertions, satisfying the stem's federated identity management requirement.

VM-Host affinity and anti-affinity rules bind or separate virtual machines from specific ESXi hosts or host groups, typically using host DRS groups. This is a distinct rule type from VM-VM rules, satisfying the requirement to identify the two DRS affinity rule categories.

TPM 2.0 provides a hardware root of trust, storing cryptographic measurements of the ESXi boot process and enabling remote attestation. This satisfies the hardening requirement by detecting tampering with boot components before workloads run, anchoring integrity verification in silicon rather than software alone.

Host Profiles capture a reference ESXi host's configuration as a managed profile and continuously check compliance across cluster nodes, remediating drift in networking, storage and security settings — directly satisfying the requirement to prevent configuration divergence.

The Active Node runs the live vCenter Server services and holds the active database, serving all management traffic. It is one of the three required VCHA nodes, pairing with the Passive and Witness nodes to form the fault-tolerant cluster.

PVLANs enforce Layer 2 isolation at the port level: isolated secondary VLANs block all peer traffic, while community VLANs permit communication only within the group. This satisfies the strict multi-tenant separation requirement, since standard VLANs alone cannot prevent traffic between ports on the same subnet.

HotAdd attaches the source VM's virtual disks directly to a backup proxy VM, reading data through the proxy's SCSI stack rather than the network. This satisfies the transport requirement by moving blocks locally on the host, avoiding LAN and SAN paths.

Route Based on Physical NIC Load monitors each uplink's utilisation and dynamically rebalances flows when a link becomes saturated. This satisfies the dual-port 25GbE requirement by keeping both uplinks active for aggregate bandwidth while providing failover.

Resource pools allow you to group virtual machines and assign CPU and memory shares, reservations, and limits. By placing development virtual machines in a pool with lower shares and a limit, and production virtual machines in a pool with higher shares and no limit, you can enforce the required allocation and bursting behavior.

Layer 3 vMotion requires each VMkernel adapter to route across subnets, so it needs an IP address, subnet mask and a reachable default gateway. Without a gateway the adapter cannot reach remote subnets, so this configuration satisfies the routed multi-subnet design constraint.

VMkernel Management traffic carries host management, vCenter communication and ESXi services, so it is assigned its own VLAN-backed port group on the VDS. This isolates management plane traffic from guest and storage flows, satisfying the stem's requirement for distinct traffic-type port groups.

Mutual TLS authenticates both vCenter Server and the KMIP HSM cluster with certificates, so key material is exchanged over an encrypted channel without cleartext credentials, satisfying the stem's requirement for secure key establishment for VM encryption.

vSphere Trust Authority runs KMS access through a separate, hardened Trusted Cluster whose attestation services sit outside the general administrative network, so workload administrators cannot reach key servers directly — satisfying the compliance requirement for isolated key management.

A TPM 2.0 chip stores cryptographic measurements of the ESXi bootloader and kernel, enabling hardware-rooted verification during startup. This satisfies the stem's requirement for hardware-root-of-trust attestation, since the trust anchor resides in dedicated tamper-resistant silicon on the motherboard rather than in software, validating each boot stage before the hypervisor loads.

FC-NVMe replaces FCP's single queue per LUN with many parallel submission and completion queues, each with deep command depth. This matches NVMe devices' native parallelism, removing the SCSI queue bottleneck that throttles FCP under high random I/O.

DPU offload moves distributed firewalling, encapsulation and crypto processing off the host x86 cores onto dedicated SmartNIC hardware. This directly reclaims host CPU cycles for tenant workloads, satisfying the architect's stated benefit of the DPU architecture rather than merely adding bandwidth.

Correct. NSX DFW provides stateful inspection at the VM vNIC level.

Geneve is the encapsulation protocol used by NSX to carry Layer 2 frames over a Layer 3 underlay, allowing a logical segment to exist across sites without stretching physical VLANs. This directly supports the requirement for Layer 2 adjacency for legacy workloads while preserving IP mobility, because the transport network only needs routable connectivity between tunnel endpoints.

Confidential VMs use AMD SEV-SNP or Intel TDX to encrypt guest memory with keys the hypervisor cannot read, defeating malicious inspection of running VM memory. This hardware-based isolation directly satisfies the requirement that VMs be protected against memory inspection while running.

VM-Host affinity rules bind selected virtual machines to designated host groups, so vSphere HA restarts them on preferred hosts rather than any available host. This directly satisfies the requirement that specific VMs always return to preferred hosts during failover.

TLS 1.2 or later encrypts management traffic to the ESXi host client and vCenter Server, preventing credential and data exposure on the network. This directly satisfies the requirement for encrypted management access and is the supported transport security baseline in vSphere Foundation 9.0, making it a correct element of the documented security standard.

NFS 4.1 is a file-level protocol ESXi mounts as a shared datastore, satisfying the external shared file requirement. Unlike block protocols such as iSCSI or Fibre Channel, it presents a remote file system directly, and version 4.1 adds session trunking and pNFS support.

The vSphere Distributed Switch supports DCB configuration, which lets ESXi participate in PFC and priority-based flow control with the upstream fabric. Combining that with a dedicated VMkernel adapter isolates iSCSI traffic and gives the lossless behavior the design requires, matching the switches that are already configured for PFC and DCB.

MAC Address Changes is one of the three default vSwitch port group security policies, controlling whether the guest may alter the effective MAC address presented to the switch. It sits alongside Promiscuous Mode and Forged Transmits, satisfying the requirement for default port group security settings.

IP Hash load balancing hashes each flow across uplinks, so the physical switch must aggregate those uplinks into a Port Channel (EtherChannel). Without it, the switch treats each link independently and frames arrive misordered, breaking the mandated load distribution.

Disabling both TSM and TSM-SSH services by default removes persistent shell access, satisfying zero-trust least-privilege for ESXi hosts. Temporary activation during troubleshooting limits the attack window, since no standing interactive access exists for lateral movement or credential abuse. This directly enforces the strict posture the architect requires.

vMotion with NVIDIA vGPU requires the destination host to present matching physical GPU models, compatible driver and GRID versions, and free vGPU profile capacity. Otherwise the VM cannot resume, so verifying these satisfies the architectural requirement for a successful migration.

RoCEv2 encapsulates NVMe commands over UDP/IP, so dropped frames trigger retransmissions that cripple RDMA throughput. Priority Flow Control provides per-priority pause frames, while Explicit Congestion Notification marks packets before buffers overflow, together delivering the lossless fabric that RoCEv2 requires for predictable latency and full bandwidth.

vSAN carries heavy distributed storage traffic, so dedicating physical uplinks or applying Network I/O Control shares guarantees bandwidth for vSAN VMkernel adapters. This prevents contention with vMotion, management or VM traffic, satisfying the recommended practice for predictable vSAN performance.

A VDS is configured once at vCenter level and applied uniformly to every member host, eliminating per-host vSwitch drift. This satisfies the stem's consistency requirement, whereas standard vSwitches demand identical manual configuration on each ESXi host.

Synchronising every ESXi host and vCenter appliance to authoritative local NTP servers satisfies the requirement for a consistent, hierarchical time source across the estate. NTP's stratum model lets hosts derive time from trusted internal references rather than drifting independently, keeping vCenter and host clocks aligned for certificate validation, logging and performance metrics.

File-Based Backup from the VCSA Appliance Management UI (port 5480) exports the appliance configuration — including inventory, certificates and settings — to an external location on a schedule. This is the vendor-recommended standard for protecting VCSA configuration independently of the guest OS.

Mirrored M.2 NVMe or SATA SSDs provide hardware RAID 1 redundancy, so a single drive failure does not halt the host. This satisfies the enterprise reliability and supportability constraint, since VMware supports and recommends mirrored boot devices over single disks or USB/SD media for vSphere Foundation 9.0 clusters.

Enhanced Linked Mode requires every vCenter Server appliance to join the same Single Sign-On domain, since cross-instance authentication and role replication flow through that shared SSO identity source. Separate SSO domains cannot form ELM, so this satisfies the stem's architectural requirement.

ESXi trunk ports carry multiple VLAN IDs, so the physical switch ports must be configured as VLAN trunks permitting every VLAN required by the host's port groups. This satisfies the multi-VLAN trunking constraint, ensuring tagged frames for each configured VLAN reach the correct port group.

Interactive installation via physical or virtual media, including ISO mounted through IPMI, iLO or iDRAC, is officially supported. It satisfies the stem by providing a validated deployment path, though it scales poorly since each host requires manual attention.

NFS datastores are fully supported as primary ESXi storage, mounting remote file shares over the network. ESXi presents them as datastores supporting VM files, snapshots and vMotion, satisfying the requirement for a supported primary datastore type in vSphere Foundation.

Fibre Channel is a native block protocol ESXi supports through dedicated FC HBA adapters, presenting LUNs from external enterprise arrays. It satisfies the stem's block storage constraint, unlike file-based NFS or SMB. ESXi 9.0 retains full FC initiator support, including NPIV and multipathing via the Pluggable Storage Architecture.

A custom role carrying only the required VM privileges, assigned at the folder object, grants tenant operators management of those VMs while inherited permissions expose nothing else. This satisfies the stem's requirement to restrict operators to a specific folder without visibility into other clusters.

The NFS client service has a built-in ESXi firewall rule in Security Profiles, letting administrators enable or disable outbound NFS traffic per host. This satisfies the stem's requirement for a network service with a toggleable firewall rule.

vSphere Replication uses the ESXi kernel's built-in changed block tracking to record which disk blocks were written since the last cycle. Only those deltas transfer, satisfying the requirement to track changes efficiently before each replication cycle rather than scanning full disks.

Syslog forwarding streams vCenter Server audit and access events to a remote SIEM collector, satisfying the compliance requirement for centralised auditing of API traffic and administrative sessions. It is the native architectural feature for exporting these logs.

ESA collapses storage into a single tier of NVMe devices, removing the cache-and-capacity disk group split entirely. This satisfies the native NVMe design constraint, since OSA's two-tier caching model was built around segregating flash cache from capacity media, which ESA no longer requires.

The balloon driver (vmmemctl) inflates inside a guest under memory pressure, forcing that guest to page idle memory to its own swap and releasing host physical pages for reallocation to VMs experiencing pressure, reclaiming memory without crashing workloads.

SR-IOV virtual functions bind directly to physical NIC hardware, bypassing the VMkernel's software datapath. This direct binding constrains live vMotion, fault tolerance, and snapshots, which rely on that datapath, so vendor support and feature limitations must be factored into the design.

iSCSI is a standards-based block storage protocol that runs over TCP/IP, so it can use a dedicated storage network. ESXi supports iSCSI with multipathing through the Pluggable Storage Architecture, and it does not require special array features for basic host connectivity. This matches the requirement for block-level storage with multipathing over a dedicated network.

In hybrid mode, VMCA is subordinate to an external enterprise CA: it holds an intermediate signing certificate and issues leaf certificates for ESXi and vCenter. This preserves automated VMCA issuance while chaining trust to the corporate PKI, which is the design purpose the stem asks about.

Disabling the CIM server removes an unauthenticated, legacy WBEM interface that exposes host hardware data. When IPMI, iLO or iDRAC already handle out-of-band monitoring, the CIM service adds attack surface without benefit, satisfying the hardening requirement to restrict CIM access.

A virtual hardware random number generator device exposes the host's hardware entropy source to the guest, satisfying cryptographic workloads that need genuine randomness. Software-only entropy cannot match this, so the vHRNG device is the design requirement.