IT Architectures Technologies Standards practice questions

Size virtual machine vCPUs to fit within the core and cache boundaries of a single physical NUMA node.

Keeping each VM's vCPU count within a single physical NUMA node's core and cache boundaries prevents cross-socket memory access, avoiding remote latency penalties. This directly satisfies the stem's requirement for maximum VM density with NUMA efficiency on the 32-core EPYC processors.

Enforce a maximum transmission unit (MTU) of 9000 bytes across all physical switch ports and VMkernel adapters handling NVMe-oF traffic.

NVMe-oF over TCP benefits from jumbo frames because larger MTU reduces per-packet processing overhead and packet count, lowering latency and CPU load on the VMkernel adapters. Configuring 9000 bytes consistently on every physical switch port and VMkernel interface prevents fragmentation, which would otherwise degrade the storage fabric's throughput and consistency.

Set Promiscuous Mode, MAC Address Changes, and Forged Transmits to 'Reject' at the distributed port group security policy level.

Setting all three security policies to Reject at the distributed port group blocks promiscuous mode, MAC address changes, and forged transmits, preventing a compromised guest from capturing traffic belonging to other virtual machines on the same vSphere Distributed Switch.

Configure ESXi power management policy to 'High Performance' and tune BIOS to OS-controlled or static maximum frequency.

High Performance in ESXi pins CPU power states to maximum frequency and disables deep C-states, while BIOS set to OS-controlled or static maximum lets ESXi govern P-states. This pairing removes latency-inducing frequency transitions, meeting strict SLA performance while retaining some energy tuning.

The elected HA Master ESXi host in the cluster.

The HA Master, elected from the cluster's ESXi hosts, coordinates failover decisions and restarts affected VMs after a host power failure. It maintains cluster state and orchestrates the restart priority, satisfying the requirement for a primary HA orchestrator.

Software iSCSI traffic does not require a dedicated VMkernel service checkbox, but requires proper port binding to the iSCSI software adapter.

Software iSCSI relies on port binding, not a VMkernel service checkbox. The iSCSI software adapter binds to a specific VMkernel interface, forcing storage traffic through that vmknic. Enabling the iSCSI service checkbox is unnecessary; correct port binding satisfies the IP-network shared storage requirement in vSphere Foundation 9.0.

Geneve (Generic Network Virtualization Encapsulation)

Geneve is the encapsulation protocol NSX uses for overlay tunnels, carrying the original frame inside a UDP packet with a flexible option header. It defines the encapsulation method the stem asks about for modern data centre designs.

vSphere APIs for Data Protection (VADP) utilizing Changed Block Tracking (CBT).

VADP with Changed Block Tracking reads only modified blocks since the last backup, shifting snapshot processing to the backup server rather than the ESXi host. This delivers efficient, crash-consistent or application-consistent snapshots while avoiding heavy host CPU load, exactly as the stem demands.

At least 4 fault domains (hosts)

RAID-5 erasure coding in vSAN requires a minimum of four fault domains because it stores data plus one parity segment across four hosts. This satisfies the stem's FTT constraint: RAID-5 tolerates one host failure while using 1.33x space overhead, unlike RAID-1 mirroring, which needs only three hosts.

TCP port 902

TCP 902 carries the vpxa agent channel between ESXi hosts and vCenter Server, satisfying the stem's requirement for primary agent communication. vpxa listens on this port to receive management instructions, so blocking it severs host-to-vCenter control traffic even when other services remain reachable.

vSphere Trust Authority (vTA)

Correct. vSphere Trust Authority provides a secure attestation service to ensure keys are only given to attested, trusted ESXi hosts.

Select the appropriate deployment size (such as Small or Medium) matching the host and VM count guidelines in the VMware Configuration Maximums documentation.

Deployment size must match the host and VM counts against VMware Configuration Maximums; the stem's 400 hosts and 4,000 VMs sit within Medium's supported limits. Selecting a size below those guidelines would breach supported maximums.

Percentage of Cluster Resources reserved for CPU and Memory.

Percentage-based admission control expresses failover headroom as a simple CPU and memory percentage of cluster capacity, so the administrator sets one reservation figure per resource rather than calculating per-VM slot sizes, satisfying the requirement to reserve failover resources without complex capacity maths.

Failures to Resist (FTT / RAID level configuration)

Failures to Resist defines how many host, disk or rack failures the object survives, mapping to RAID-1, RAID-5 or RAID-6 erasure coding. It directly satisfies the requirement for a policy rule controlling redundancy and availability of vSAN objects.

Flash Read Cache Reservation

Correct. Read cache reservation guarantees cache space for specific virtual machine disks.

Disk Stripe Width

Disk stripe width is a native vSAN storage policy rule, letting the architect spread each object's data across multiple capacity devices to raise throughput. It satisfies the stem's requirement for enforceable vSAN policy rules, unlike rules belonging to other storage technologies.

Route Based on Originating Virtual Port

Correct. Port-based routing assigns virtual ports to specific physical uplinks.

Route Based on IP Hash

Correct. IP Hash utilizes source and destination IP addresses to determine uplink routing.

Shares

Shares establish relative CPU or memory allocation priority among competing virtual machines within a resource pool or host. They are one of the three configurable per-VM resource parameters, alongside reservation and limit, and only take effect under contention.

Limit

Limit caps the maximum CPU or memory a virtual machine may consume, preventing it from exceeding a defined ceiling even when the host has spare capacity. It is one of the three configurable resource parameters, alongside reservation and shares, directly satisfying the stem's request for valid CPU or memory settings.

Reservation

Reservation guarantees a minimum CPU or memory allocation that the host must make available to the virtual machine, protecting it from contention. It is one of the three configurable resource parameters, alongside limit and shares, directly satisfying the stem's request for valid CPU or memory settings.

Local OS users (local vpxuser / local system accounts)

Local OS users are a native vCenter SSO identity source, authenticating against the vCenter Server Appliance's own operating system accounts. This satisfies the stem's requirement for natively supported identity source types, distinct from directory-backed sources such as Active Directory or LDAP.

Active Directory (Integrated Windows Authentication or Active Directory over LDAP)

Active Directory is natively supported by vCenter SSO in two modes: Integrated Windows Authentication and Active Directory over LDAP. This directly satisfies the stem's requirement for native identity source types, letting vCenter authenticate users against existing AD domain credentials without third-party brokers.

OpenLDAP directory services

OpenLDAP directory services are a natively supported vCenter SSO identity source, binding to generic LDAP directories for user and group authentication. This satisfies the stem's requirement for native identity source types, covering non-Microsoft directory deployments alongside Active Directory and local OS accounts.

Leave virtual machines powered on

Leaving virtual machines powered on is a valid Host Isolation Response, preserving guest availability when the host loses management and storage connectivity but VMs may still be running. It satisfies the configurable isolation-action requirement alongside power-off and shutdown options.

Power off virtual machines

Powering off virtual machines is a valid Host Isolation Response, halting VMs on an isolated host so they release their resources and can be restarted elsewhere. This satisfies the scenario's requirement for configurable isolation actions, alongside leaving VMs powered on or shutting them down.

ESXi base image version

The ESXi base image version is the core component of a vLCM cluster image, defining the exact hypervisor build all hosts must match. vLCM remediates hosts to this declared version, satisfying the requirement that the cluster image manages and validates the base hypervisor consistently across every node.

Vendor Add-on (hardware-specific driver and firmware bundle)

Vendor Add-ons deliver OEM-specific driver and firmware bundles validated against the ESXi base image. Including them in the cluster image lets vLCM check compatibility and remediate hosts, satisfying the requirement to manage hardware-specific components alongside the base image.

Firmware and Driver Add-ons (additional component-level updates)

Firmware and Driver Add-ons are discrete component-level packages layered onto the base image within a vLCM image. vLCM validates their compatibility and remediates hosts accordingly, satisfying the requirement that component-level updates be managed as part of the single cluster image.

Deduplication and Compression

Deduplication and Compression is a native vSAN storage-policy service, configured per-object through the vSAN policy rather than at the datastore level. It satisfies the stem's requirement for advanced data services configurable via storage policies, reducing capacity consumption by eliminating duplicate blocks and compressing remaining data within each disk group.

Encryption (Data-at-Rest Encryption)

Data-at-Rest Encryption is a native vSAN service configured through VM storage policies, satisfying the stem's requirement for policy-driven data services. Enabling it on a vSAN cluster encrypts all objects at rest using AES-256, with keys managed by a KMS, and it operates independently of vSphere VM encryption.

Checksum (automatic integrity checking and self-healing)

Checksums are a native vSAN data service, configured through VM storage policies to detect silent data corruption. This satisfies the stem's requirement for advanced storage policies in vSphere Foundation 9.0, since vSAN automatically recalculates and repairs mismatched blocks across the cluster without external tooling.