Question bank
VCAP - VMware Cloud Foundation Networking
40 VCAP - VMware Cloud Foundation Networking questions with the correct answer and a written explanation, organised across 4 exam domains.
- 40 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Architecture and Design
12 questions in this domain
- Question 1Single Choice
What is the primary role of a Tier-0 gateway in VMware Cloud Foundation networking?
- AProvide east-west routing for workload segments
- BAct as the edge router for north-south traffic to the physical networkCorrect answer
- CEncapsulate Geneve overlay traffic between hosts
- DManage DHCP and IP address pools for tenant segments
Why this is the answer
The Tier-0 gateway connects the VCF environment to the physical network, handling north-south routing via BGP/OSPF.
- Question 2Multiple Select
Which two statements about overlay segments in NSX-T are correct? (Choose two.)
- AThey use Geneve encapsulationCorrect answer
- BThey require a unique VLAN ID on the wire
- CThey support overlapping IP addresses for different tenantsCorrect answer
- DThey are limited to the VLAN capacity of physical switches
Why this is the answer
Overlay segments use Geneve encapsulation and allow IP overlap; they do not have an associated VLAN ID on the wire.
- Question 3Interactive
Review the code snippet. What is the purpose of the BFD configuration in this BGP setup?
- AIt allows faster convergence by detecting link failures in sub-secondsCorrect answer
- BIt encrypts BGP session traffic for security
- CIt reduces BGP keepalive interval to 1 second
- DIt enables load balancing between multiple BGP peers
Why this is the answer
BFD provides sub-second detection of link failures, enabling rapid BGP convergence in an active-active Tier-0 design.
- Question 4Single Choice
What is the default DFW rule in a newly deployed NSX environment?
- AAllow all traffic except management
- BDeny all traffic including system traffic
- CAllow all traffic by default
- DDeny all except DHCP, DNS, and some system trafficCorrect answer
Why this is the answer
The default DFW rule is to deny all traffic except for essential services like DHCP and DNS.
- Question 5Multiple Select
Which two components are part of the NSX-T micro-segmentation framework? (Choose two.)
- ADistributed Firewall (DFW)Correct answer
- BVLAN ACLs on physical switches
- CNSX Groups with dynamic membershipCorrect answer
- DTier-0 gateway load balancing
Why this is the answer
Micro-segmentation uses DFW rules applied to dynamic NSX Groups; VLAN ACLs are not part of NSX.
- Question 6Interactive
Refer to the code snippet. Which NSX group method is being used to define the web tier?
- AIP set membership based on static IP ranges
- BvCenter object tag-based dynamic membershipCorrect answer
- CManual VM membership by vCenter UUID
- DActive Directory user group membership
Why this is the answer
The snippet shows a tag-based membership using a vCenter tag, making the group dynamic.
- Question 7Single Choice
What is the minimum MTU requirement for the physical underlay to support Geneve overlay traffic?
- A1500 bytes
- B1600 bytesCorrect answer
- C1700 bytes
- D9000 bytes
Why this is the answer
Geneve adds 50 bytes overhead, so the underlay must support at least 1600 bytes MTU to avoid fragmentation.
- Question 8Multiple Select
Which two statements are true about Tier-1 gateways in VCF? (Choose two.)
- AThey provide default gateway for workload segmentsCorrect answer
- BThey are used for north-south BGP peering with physical routers
- CThey host services like NAT, load balancer, and VPNCorrect answer
- DThey require a direct physical uplink to ToR switches
Why this is the answer
Tier-1 gateways serve as tenant gateways for east-west routing and host services; BGP peering is done at Tier-0.
- Question 9Interactive
Examine the code snippet. What is the purpose of the 'active-active' setting in this Tier-0 configuration?
- AIt enables ECMP across multiple Edge nodes for higher throughputCorrect answer
- BIt provides stateful failover for NAT sessions
- CIt synchronizes configuration across all Edge VMs
- DIt activates BFD on all uplink interfaces
Why this is the answer
Active-active mode allows multiple Tier-0 instances to forward traffic simultaneously using ECMP.
- Question 10Single Choice
What type of encapsulation is used by NSX-T overlay segments?
- AVXLAN
- BGeneveCorrect answer
- CGRE
- DSTT
Why this is the answer
NSX-T uses Geneve encapsulation for overlay segments, providing flexibility and scalability.
- Question 11Multiple Select
Which two design considerations are important for multi-tenant micro-segmentation? (Choose two.)
- AUse VLAN segments to isolate tenants at Layer 2
- BAssign each tenant a dedicated Tier-1 gatewayCorrect answer
- CDefine NSX Groups using tenant-specific tagsCorrect answer
- DConfigure a single Tier-0 for all tenants without route filtering
Why this is the answer
Each tenant should have its own Tier-1 gateway and use tag-based groups for DFW policies; VLANs alone do not provide micro-segmentation.
- Question 12Interactive
Refer to the code snippet. What does this configuration enforce at the virtual NIC level?
- AAllows all traffic from web to app tierCorrect answer
- BBlocks all traffic from web to app tier
- CLogs all traffic between web and app tiers
- DRedirects traffic to a third-party firewall
Why this is the answer
The rule permits traffic from the web group to the app group, implementing micro-segmentation.
Automation and Programmability
8 questions in this domain
- Question 13Single Choice
Which cmdlet must be used to authenticate to NSX Manager in PowerCLI?
- AConnect-VIServer
- BConnect-NsxtServerCorrect answer
- CConnect-VMHost
- DConnect-NetworkController
Why this is the answer
Connect-NsxtServer is the correct cmdlet for authenticating to NSX Manager in PowerCLI. Connect-VIServer is for vCenter, not NSX Manager.
- Question 14Multiple Select
Which two NSX Policy API HTTP methods are idempotent? (Choose two.)
- APOST
- BPATCHCorrect answer
- CPUTCorrect answer
- DDELETE
Why this is the answer
PATCH and PUT are idempotent when used for upsert or replace operations in the Policy API. POST is not idempotent because it may create duplicate resources. DELETE can be idempotent but is less commonly used for policy updates.
- Question 15Interactive
Examine the following PowerCLI script snippet. What is the purpose of the -VlanId parameter?
- AIt defines the VLAN ID for a VLAN-backed segment.Correct answer
- BIt specifies the overlay transport zone ID.
- CIt sets the Tier-1 gateway connectivity path.
- DIt assigns the segment to a management network.
Why this is the answer
The -VlanId parameter is used when creating a VLAN-backed segment in NSX. Overlay segments do not require a VLAN ID. The other options are incorrect because -VlanId is specific to VLAN backing.
- Question 16Single Choice
Which automation tool uses a declarative model where the desired end state of network resources is defined in configuration files?
- APowerCLI
- BAnsible
- CTerraformCorrect answer
- DvRealize Orchestrator
Why this is the answer
Terraform is declarative: you define the desired state and it automates the steps. PowerCLI and vRO are imperative/procedural. Ansible is procedural by default, though some modules may be declarative.
- Question 17Multiple Select
Which two Terraform providers are used to manage VCF networking resources? (Choose two.)
- Avmware/vcfCorrect answer
- Bvmware/nsxtCorrect answer
- Chashicorp/aws
- Dvmware/vsphere
Why this is the answer
The vmware/vcf provider manages VCF-level constructs like network pools, while the vmware/nsxt provider manages NSX-T objects such as segments and gateways. vsphere provider is for vCenter, not VCF networking.
- Question 18Interactive
Analyze the following Ansible task snippet. What does the 'state: present' parameter achieve in this module?
- AIt ensures the NSX-T segment exists as declared.Correct answer
- BIt removes the segment if it already exists.
- CIt forces a recreation of the segment.
- DIt pauses the playbook until the segment is present.
Why this is the answer
The 'state: present' parameter ensures that the resource (here an nsxt_policy_segment) exists with the specified configuration. It does not force recreation; it is idempotent. 'state: absent' would remove it.
- Question 19Single Choice
Which NSX-T API base path is used for declarative policy management?
- A/api/v1
- B/policy/api/v1/infraCorrect answer
- C/manager/api/v1
- D/sddc-manager/api/v1
Why this is the answer
The NSX Policy API uses /policy/api/v1/infra as the base path. The /api/v1 path is for the older Manager API. SDDC Manager API is separate.
- Question 20Multiple Select
Which two are benefits of implementing network policy as code with version control? (Choose two.)
- AEnables rollback to previous policy states.Correct answer
- BEliminates the need for API authentication.
- CProvides a historical audit trail of changes.Correct answer
- DAutomatically applies policies to all environments.
Why this is the answer
Version control allows historical tracking and rollback to previous commits. It does not eliminate authentication; credentials are still required. Automatic application requires CI/CD pipelines, not just version control.
Implementation and Configuration
10 questions in this domain
- Question 21Single Choice
How many NSX-T Manager nodes does VMware Cloud Foundation deploy by default in the management domain?
- AOne
- BTwo
- CThreeCorrect answer
- DFour
Why this is the answer
VCF always deploys a three-node NSX-T Manager cluster for high availability in the management domain.
- Question 22Multiple Select
Which of the following statements about Transport Zones in a VCF environment are correct? (Choose two.)
- AOverlay Transport Zones are automatically created for each workload domain by SDDC Manager.Correct answer
- BVLAN Transport Zones are automatically created by SDDC Manager for every workload domain.
- CA Transport Zone defines the scope of network connectivity and can be of type Overlay or VLAN.Correct answer
- DTransport Zones are only required for management domain networking, not for workload domains.
Why this is the answer
Overlay TZs are auto-created; VLAN TZs require manual creation. TZs define connectivity scope and can be Overlay or VLAN.
- Question 23Interactive
Given the NSX-T uplink profile snippet below, what teaming policy is being used?
- AFAILOVER_ORDER (Active/Standby)
- BLOADBALANCE_SRCID (Active/Active)Correct answer
- CLOADBALANCE_SRCMAC
- DLOADBALANCE_IP_HASH
Why this is the answer
The snippet shows 'teaming_policy' set to 'LOADBALANCE_SRCID', which is Active/Active using source ID.
- Question 24Single Choice
How are Distributed Firewall (DFW) rules evaluated in NSX-T?
- ABottom-up, with last rule taking precedence
- BTop-down, and the first matching rule is appliedCorrect answer
- CRandom order based on rule priority
- DAlphabetical order of rule names
Why this is the answer
DFW rules are evaluated from top to bottom; the first rule that matches the traffic is applied.
- Question 25Multiple Select
Which of the following are true regarding IDS/IPS in NSX-T for VCF? (Choose two.)
- AIDS/IPS requires an Advanced Threat Prevention license.Correct answer
- BIDS/IPS can be applied to both DFW and Gateway Firewall rules.Correct answer
- CIDS/IPS is always active by default on all NSX-T deployments.
- DIDS/IPS does not consume any resources on Edge nodes.
Why this is the answer
IDS/IPS requires a specific license and can be attached to rules. It consumes Edge CPU/memory and is not default.
- Question 26Interactive
The DFW rule below shows a 'status' of 'pending'. What action is required for it to become effective?
- AReboot the ESXi hosts in the cluster
- BPublish the DFW policyCorrect answer
- CRestart the NSX Manager service
- DReapply the transport node profile
Why this is the answer
DFW changes must be explicitly published (applied) to take effect. Status 'pending' indicates unpublished rules.
- Question 27Single Choice
What is the minimum number of NSX Edge nodes required for high availability in a cluster?
- AOne
- BTwoCorrect answer
- CThree
- DFour
Why this is the answer
A minimum of two Edge nodes is required for high availability, allowing one to take over if the other fails.
- Question 28Multiple Select
Which of the following correctly differentiate L2VPN from IPSec VPN in NSX-T? (Choose two.)
- AL2VPN extends Layer 2 segments, while IPSec VPN operates at Layer 3.Correct answer
- BIPSec VPN preserves MAC addresses across sites, while L2VPN does not.
- CL2VPN is used for workload migration with IP preservation.Correct answer
- DIPSec VPN can only be used for site-to-site connections, not remote access.
Why this is the answer
L2VPN extends L2, preserving MACs; IPSec is L3. L2VPN enables IP retention during migration. IPSec supports both site-to-site and remote access.
- Question 29Interactive
The IPSec VPN configuration below is missing which critical parameter?
- AIKE version
- BPre-shared key (PSK)Correct answer
- CLocal endpoint IP
- DDead Peer Detection (DPD)
Why this is the answer
A pre-shared key is mandatory for IPSec authentication. The snippet shows local/remote IPs and IKE but no PSK.
- Question 30Single Choice
In NIOC v2, which setting provides a minimum guaranteed bandwidth for a traffic class?
- AShares
- BReservationCorrect answer
- CLimit
- DTraffic Shaping
Why this is the answer
Reservation in NIOC v2 sets a minimum guaranteed bandwidth (in Mbps) for a traffic class.
Operations and Troubleshooting
10 questions in this domain
- Question 31Single Choice
Which VMware tool performs deep packet inspection and flow analytics for network performance monitoring in VCF?
- AvRealize Network InsightCorrect answer
- BvCenter Server
- CNSX-T Manager dashboards
- DSDDC Manager
Why this is the answer
vRealize Network Insight (vRNI) provides deep packet inspection, flow analytics, and cross-domain correlation for network performance monitoring.
- Question 32Multiple Select
Which metrics can you monitor using NSX-T dashboards? (Select two.)
- ATunnel statusCorrect answer
- BRound-trip time between VMs
- CLogical port statisticsCorrect answer
- DvSAN datastore throughput
Why this is the answer
NSX-T dashboards show tunnel status and logical port statistics; RTT and vSAN throughput are not native NSX-T dashboard metrics.
- Question 33Interactive
Based on the Traceflow output, which component dropped the packet?
- ADistributed Firewall (DFW)Correct answer
- BTier-1 Gateway
- CLogical Switch
- DTier-0 Gateway
Why this is the answer
The Traceflow output shows a rule ID matched on the DFW with action 'DROP', indicating the Distributed Firewall dropped the packet.
- Question 34Single Choice
What is the first step in troubleshooting north-south connectivity loss from a workload domain to an external network?
- AVerify BGP peering between Tier-0 and physical spine switchesCorrect answer
- BCheck NSX-T Distributed Firewall rules
- CRun a packet capture on the source VM
- DReview vCenter performance charts
Why this is the answer
The first step is to verify BGP peering because Tier-0 gateways exchange routes with the physical fabric for external connectivity.
- Question 35Multiple Select
Which two tools are used together to identify a network bottleneck in VCF?
- AvCenter performance chartsCorrect answer
- BNSX Traceflow
- Cesxtop networking viewCorrect answer
- DSDDC Manager health dashboards
Why this is the answer
vCenter performance charts provide average metrics, while esxtop gives per-second granularity needed to spot micro-burst bottlenecks.
- Question 36Interactive
Review the vCenter performance chart. What does a sudden rise in network utilization coinciding with increased vSAN latency indicate?
- ANetwork bottleneck affecting storage trafficCorrect answer
- BStorage disk failure
- CCPU overcommitment
- DMemory ballooning
Why this is the answer
A simultaneous rise in network utilization and vSAN latency indicates that network congestion is starving vSAN traffic, not a storage or compute issue.
- Question 37Single Choice
Which component must be upgraded first in an NSX-T lifecycle upgrade?
- ANSX Manager clusterCorrect answer
- BNSX Edge nodes
- CHost transport nodes
- DvCenter Server
Why this is the answer
The NSX Manager cluster must be upgraded first because newer Edge and host modules require a compatible manager version.
- Question 38Multiple Select
Which two pieces of information are essential for restoring an NSX Manager from backup? (Select two.)
- ABackup file from the same NSX versionCorrect answer
- BThe backup passphraseCorrect answer
- CvCenter Server credentials
- DSDDC Manager connectivity
Why this is the answer
The backup file must be from the same version, and the passphrase (set when backup was created) is required to decrypt the file.
- Question 39Interactive
Examine the flow log entry. Which action was taken by the Distributed Firewall?
- AAllowCorrect answer
- BDeny (drop)
- CReject
- DReset
Why this is the answer
The flow log shows action 'ALLOW' for the session, confirming that the Distributed Firewall permitted the traffic.
- Question 40Single Choice
What is the purpose of Network I/O Control (NIOC) in VCF?
- ATo allocate bandwidth shares for different traffic typesCorrect answer
- BTo monitor physical switch health
- CTo encrypt VM traffic
- DTo automate certificate renewal
Why this is the answer
NIOC on the VDS divides host pNIC bandwidth into shares for traffic types like management, vMotion, vSAN, and VM traffic.
Frequently asked questions
Everything about the VCAP - VMware Cloud Foundation Networking question bank and how to use it.