Question bank
VCAP - VMware Cloud Foundation Automation
40 VCAP - VMware Cloud Foundation Automation questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Automation Security and Compliance
6 questions in this domain
- Question 1Single Choice
Which role type in VCF Automation cannot be modified but provides predefined permissions?
- ACustom role
- BBuilt-in roleCorrect answer
- COrganization Owner
- DProject Administrator
Why this is the answer
Built-in roles have predefined permissions that cannot be modified; custom roles allow granular permission sets.
- Question 2Multiple Select
Which statements about RBAC roles in VCF Automation are true? (Select two)
- AOrganization Owner has full access across all projectsCorrect answer
- BService Administrator can manage only one specific service across all projectsCorrect answer
- CProject Administrator can add vCenter endpoints
- DCustom roles can be edited but built-in roles can also be modified
Why this is the answer
Organization Owner has full access; Service Administrator manages a specific service across all projects. Project administrators cannot add endpoints; built-in roles cannot be modified.
- Question 3Interactive
Review the code block and select the correct outcome for the user.
- AUser has Project Administrator rights in Project ACorrect answer
- BUser is restricted to Organization Viewer in Project A
- CUser has no access to Project A
- DUser has Service Administrator rights in Project A
Why this is the answer
Project roles override organization roles; therefore, the user has full Project Administrator rights in Project A.
- Question 4Single Choice
Which authentication method is recommended for long-running service accounts in VCF Automation?
- AOAuth 2.0 tokens with refresh
- BClient certificate-based authenticationCorrect answer
- CSession cookies
- DUsername and password directly in API calls
Why this is the answer
Certificate-based authentication avoids token expiration and reduces secret rotation overhead for long-running service accounts.
- Question 5Multiple Select
Which log sources must be configured to capture a complete audit trail of automated operations in VCF? (Select two)
- AAria Automation service logsCorrect answer
- BvCenter event streamsCorrect answer
- CSNMP traps from physical switches
- DWindows Event Viewer on management VMs
Why this is the answer
Aria Automation logs and vCenter events are primary sources; SNMP and Windows logs are not part of the VCF automation audit trail.
- Question 6Interactive
Examine the script steps and select the correct order for automated external CA certificate lifecycle using SDDC Manager.
- AGenerate CSR → Submit to CA → Upload signed cert → Deploy → VerifyCorrect answer
- BDeploy → Generate CSR → Submit to CA → Upload signed cert → Verify
- CSubmit to CA → Generate CSR → Upload signed cert → Deploy → Verify
- DGenerate CSR → Upload signed cert → Submit to CA → Deploy → Verify
Why this is the answer
The correct order: CSR generation, submission to CA, upload of signed cert, deployment to component, and verification.
Automation Troubleshooting and Monitoring
8 questions in this domain
- Question 7Single Choice
Which component is used to identify the exact step where an automation task failed in VCF?
- AAudit Log Viewer
- BTask Details paneCorrect answer
- CvRealize Log Insight
- DvCenter alarms
Why this is the answer
The Task Details pane in SDDC Manager shows the failed subtask name and error message, enabling precise identification of the failure point.
- Question 8Multiple Select
Which two are common root causes of automation failures in VCF?
- ANetwork misconfigurationsCorrect answer
- BCertificate expirationCorrect answer
- CHardware incompatibility
- DDNS resolution failures
Why this is the answer
The playbook document lists network misconfigurations and certificate expiration as root causes of automation failures.
- Question 9Interactive
Examine the log snippet. What error pattern does it indicate?
- AProvisioning errorCorrect answer
- BAuthentication failure
- CResource exhaustion
- DNetwork timeout
Why this is the answer
The log shows a 'FailedReservationException', which is a provisioning error related to reservation failures.
- Question 10Single Choice
What HTTP status code signifies an authentication failure in VCF API calls?
- A200
- B401Correct answer
- C403
- D500
Why this is the answer
A 401 Unauthorized status indicates authentication failure, such as an expired or invalid token.
- Question 11Multiple Select
Which two factors can cause a 403 Forbidden error in VCF Automation API?
- AInsufficient role scopeCorrect answer
- BToken scope mismatchCorrect answer
- CIdP unreachable
- DCertificate chain untrusted
Why this is the answer
A 403 error occurs when the token is valid but lacks sufficient permissions due to role scope or token scope mismatch.
- Question 12Interactive
Given the job status snippet, what is the overall job status?
- ASUCCESS
- BFAILEDCorrect answer
- CRUNNING
- DCANCELLED
Why this is the answer
The overall job status is 'FAILED' despite individual task successes, as indicated by the status field in the JSON.
- Question 13Single Choice
What is the first step when triaging a failed automation job in SDDC Manager?
- ACheck vCenter alarms
- BExamine job details via UI or APICorrect answer
- CRun a query in vRealize Log Insight
- DRestart SDDC Manager service
Why this is the answer
The first step is to examine the job details via UI or API to identify the failed task and error code.
- Question 14Multiple Select
Which two attributes should remediation scripts implement to avoid infinite loops?
- AIdempotencyCorrect answer
- BExponential backoffCorrect answer
- CAlways retry immediately
- DLogging only
Why this is the answer
Idempotency ensures the script produces the same result if run multiple times, and exponential backoff prevents rapid retries.
Integration with External Systems and Scripting
8 questions in this domain
- Question 15Single Choice
What is the primary purpose of VMware PowerCLI in VCF automation?
- ATo provide a web-based management interface
- BTo offer cmdlet-driven access to vSphere and related productsCorrect answer
- CTo replace REST API calls for all VCF operations
- DTo manage only NSX-T components
Why this is the answer
PowerCLI provides deep, cmdlet-driven access to vSphere and related VMware products for rapid scripting within Windows environments.
- Question 16Multiple Select
Which of the following are common methods to authenticate against VMware SSO in VCF automation? (Choose two.)
- APowerCLI Connect-VIServer with a passwordCorrect answer
- BPython direct POST to /sdk/login with Basic authCorrect answer
- CUsing local OS account credentials
- DFTP file transfer with embedded token
Why this is the answer
PowerCLI uses Connect-VIServer with credentials; Python can perform a POST to the vCenter SSO endpoint with Basic auth.
- Question 17Interactive
Examine the code block. What is the purpose of the loop in this REST API automation?
- ATo retry authentication
- BTo wait for an asynchronous task to completeCorrect answer
- CTo send multiple API requests in parallel
- DTo handle rate limiting
Why this is the answer
After a 202 Accepted response, the loop polls the task endpoint until status becomes SUCCESSFUL or FAILED.
- Question 18Single Choice
What is the default token lifetime for VCF API bearer tokens?
- A1 hour
- B12 hours
- C24 hoursCorrect answer
- D48 hours
Why this is the answer
The VCF API bearer token has a configurable expiration, defaulting to 24 hours, as stated in the PLAYBOOK_DOCUMENT.
- Question 19Multiple Select
Which of the following are best practices for error handling in VCF automation scripts? (Choose two.)
- AUsing try-catch blocksCorrect answer
- BIgnoring all errors with SilentlyContinue
- CImplementing retry logic with exponential backoffCorrect answer
- DHardcoding error messages in logs
Why this is the answer
Try-catch and retry with exponential backoff are key error handling patterns; ignoring errors is not recommended.
- Question 20Interactive
Analyze the PowerCLI snippet. What is the main idempotency pattern used?
- ARetry on failure
- BState checking before modificationCorrect answer
- CUsing -Force parameter
- DError swallowing
Why this is the answer
The script checks if the host exists using Get-VMHost before calling Add-VMHost, ensuring idempotency.
- Question 21Single Choice
In CI/CD pipeline integration with VCF, what must be done after receiving a 202 Accepted response?
- AProceed immediately with the next stage
- BPoll the task endpoint until completionCorrect answer
- CRetry the same request
- DLog the response and exit
Why this is the answer
A 202 Accepted indicates an asynchronous task; the pipeline must poll the /v1/tasks/{id} endpoint until the task finishes.
- Question 22Multiple Select
Which of the following are prerequisite configurations needed before deploying NSX via VCF API? (Choose two.)
- AA prepared network poolCorrect answer
- BA vSAN cluster already enabled
- CA workload domain specification with nsxSpecCorrect answer
- DAn existing management domain with NSX
Why this is the answer
Network pool creation and a valid domain specification are prerequisites; vSAN is not required for NSX deployment.
VMware Cloud Foundation Automation Architecture
8 questions in this domain
- Question 23Single Choice
Which component is responsible for tenant workload provisioning in VMware Cloud Foundation?
- ASDDC Manager
- BvRealize Automation (Aria Automation)Correct answer
- CSaltStack Config
- DvRealize Orchestrator
Why this is the answer
vRealize Automation handles self-service provisioning of workloads. SDDC Manager manages infrastructure lifecycle, not tenant VMs.
- Question 24Multiple Select
Which two of the following are core components of the VCF automation architecture?
- ASDDC ManagerCorrect answer
- BAnsible
- CvRealize AutomationCorrect answer
- DTerraform
Why this is the answer
SDDC Manager and vRealize Automation are core VCF components. Ansible and Terraform are external integrations.
- Question 25Interactive
Refer to the code block. What authentication method is being used for the API call?
- ABasic Authentication
- BToken-based (Bearer) AuthenticationCorrect answer
- CSession-based Authentication
- DCertificate-based Authentication
Why this is the answer
The 'Authorization: Bearer <token>' header indicates token-based authentication.
- Question 26Single Choice
What is the primary role of SDDC Manager in VCF automation?
- ATenant workload provisioning
- BInfrastructure lifecycle orchestrationCorrect answer
- CConfiguration management of guest OS
- DNetwork security policy enforcement
Why this is the answer
SDDC Manager orchestrates Day-0/1 infrastructure lifecycle, not tenant workloads or guest OS.
- Question 27Multiple Select
Which two are automation constructs provided by vRealize Automation?
- ACloud TemplatesCorrect answer
- BHost Profiles
- CProjectsCorrect answer
- DNSX Transport Zones
Why this is the answer
Cloud Templates (blueprints) and Projects are vRA constructs. Host profiles and NSX transport zones are infrastructure-level.
- Question 28Interactive
Based on the API call below, what does the '202 Accepted' response indicate?
- AThe operation completed successfully
- BThe request is in progress, poll the task endpointCorrect answer
- CAuthentication failed
- DInvalid request format
Why this is the answer
A 202 Accepted means the request is accepted for processing; the caller must poll /tasks for completion.
- Question 29Single Choice
What is the primary function of SaltStack Config in VCF automation?
- AInfrastructure deployment
- BDeclarative configuration management and complianceCorrect answer
- CWorkflow orchestration
- DNetwork provisioning
Why this is the answer
SaltStack Config provides state-based configuration management and compliance scanning for Day-2 operations.
- Question 30Multiple Select
Which two lifecycle phases are managed by SDDC Manager?
- ADay-0 initial deploymentCorrect answer
- BDay-2 configuration drift remediation
- CDay-1 provisioning of workload domainsCorrect answer
- DDay-2 tenant self-service provisioning
Why this is the answer
SDDC Manager handles Day-0/1 (deployment and provisioning). Day-2 config drift is SaltStack; tenant provisioning is vRA.
Workload Domain Lifecycle Automation
10 questions in this domain
- Question 31Single Choice
What is the base URL for all SDDC Manager REST API calls?
- Ahttps://<sddc-manager-fqdn>/v1/Correct answer
- Bhttps://<sddc-manager-fqdn>/api/v1/
- Chttps://<sddc-manager-fqdn>/sddc/v1/
- Dhttps://<sddc-manager-fqdn>/rest/v1/
Why this is the answer
The SDDC Manager API uses base URL https://<sddc-manager-fqdn>/v1/ for all endpoints.
- Question 32Multiple Select
Which two HTTP methods does SDDC Manager API use for creating and updating resources?
- APOSTCorrect answer
- BPUT
- CPATCHCorrect answer
- DDELETE
Why this is the answer
SDDC Manager uses POST for creation and PATCH for partial updates. PUT is not supported for domain modification.
- Question 33Interactive
Based on the API response, what should the automation script do next?
- ARetry the same POST request
- BPoll the task URL from the Location headerCorrect answer
- CCheck the response body for domain ID
- DWait for 60 seconds and then call GET on the domain
Why this is the answer
The 202 response includes a Location header with the task URL. The script must poll that endpoint to monitor progress.
- Question 34Single Choice
What HTTP status code indicates a malformed payload during domain creation?
- A200
- B202
- C400Correct answer
- D500
Why this is the answer
A 400 Bad Request is returned when payload validation fails before any async task is created.
- Question 35Multiple Select
Which two fields are mandatory in a workload domain creation payload?
- AnameCorrect answer
- Bdescription
- CtypeCorrect answer
- DbackupConfig
Why this is the answer
The payload requires name and type fields. Description and backupConfig are optional.
- Question 36Interactive
Why does the automation script refresh the bearer token during long-running operations?
- ATo avoid 401 errors due to token expirationCorrect answer
- BTo increase API call speed
- CTo comply with security policies
- DTo reduce network latency
Why this is the answer
SDDC Manager tokens expire after a default 30 minutes. Long-running domain creation tasks may exceed this, so refreshing prevents 401 Unauthorized.
- Question 37Single Choice
Which endpoint is used to retrieve the status of an asynchronous task?
- AGET /v1/tasks/{taskId}Correct answer
- BGET /v1/workflows/{workflowId}
- CGET /v1/domains/{domainId}
- DGET /v1/clusters/{clusterId}
Why this is the answer
The task status is obtained by sending a GET request to /v1/tasks/{taskId} with the task ID from the Location header.
- Question 38Multiple Select
Which two workload domain types are commonly created using SDDC Manager?
- AVICorrect answer
- BMANAGEMENTCorrect answer
- CEDGE
- DSTORAGE
Why this is the answer
The common domain types are 'VI' for virtual infrastructure and 'MANAGEMENT' for management domain. Edge and storage are not domain types.
- Question 39Interactive
Why would this domain creation payload be rejected?
- Aname
- BtypeCorrect answer
- CsddcId
- DclusterImageId
Why this is the answer
The 'type' field is mandatory. Without it, the API returns 400 Bad Request.
- Question 40Single Choice
What does the Location header contain after a successful POST /v1/domains request?
- AThe newly created domain ID
- BThe task ID URLCorrect answer
- CThe SDDC Manager home page
- DThe NSX Manager endpoint
Why this is the answer
The Location header points to the task resource (e.g., /v1/tasks/{taskId}) to track progress.
Frequently asked questions
Everything about the VCAP - VMware Cloud Foundation Automation question bank and how to use it.