Question bank
VCP - VMware Cloud Foundation Administrator
40 VCP - VMware Cloud Foundation Administrator questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Administration and Operations
12 questions in this domain
- Question 1Single Choice
Which VCF tool provides a centralized health dashboard for workload domain components?
- ASDDC ManagerCorrect answer
- BvRealize Operations
- CvRealize Log Insight
- DvCenter Server
Why this is the answer
SDDC Manager provides the centralized health dashboard for workload domain components.
- Question 2Multiple Select
Which of the following are key capabilities of vRealize Operations in VCF? (Choose two.)
- ACapacity forecastingCorrect answer
- BPatch compliance management
- CAnomaly detectionCorrect answer
- DLog aggregation
Why this is the answer
vROps provides capacity forecasting and anomaly detection. Patch compliance is via SDDC Manager, log aggregation via vRLI.
- Question 3Interactive
Which SDDC Manager health check would be triggered by a certificate expiry?
- AConnectivity check
- BService status check
- CCertificate expiry checkCorrect answer
- DDisk space check
Why this is the answer
SDDC Manager runs certificate expiry checks as part of health monitoring.
- Question 4Single Choice
Which VCF tool is used for centralized log correlation and search?
- AvRealize Log InsightCorrect answer
- BSDDC Manager
- CvRealize Operations
- DvCenter Server
Why this is the answer
vRealize Log Insight (vRLI) aggregates logs from all VCF components.
- Question 5Multiple Select
Which two roles in SDDC Manager can create or modify workload domains? (Choose two.)
- ASuper AdminCorrect answer
- BCloud AdminCorrect answer
- CViewer
- DNetwork Admin
Why this is the answer
Super Admin and Cloud Admin can manage workload domains. Viewer is read-only, Network Admin is not a standard SDDC role.
- Question 6Interactive
Which command on SDDC Manager CLI reconciles a restored vCenter Server?
- Aresolve-vcenter.sh
- Bvcf-resolve-vcenter.sh
- C/opt/vmware/vcf/resolve-vcenter.shCorrect answer
- Dresync-vcenter.sh
Why this is the answer
The script /opt/vmware/vcf/resolve-vcenter.sh is used to reconcile vCenter after restore.
- Question 7Single Choice
Which backup method is recommended for vCenter Server in VCF?
- AVAMI backupCorrect answer
- BSDDC Manager snapshot
- CvSphere Data Protection
- DManual file copy
Why this is the answer
Native VAMI backup is recommended for vCenter Server as it includes the database.
- Question 8Multiple Select
Which two components are included in SDDC Manager backup? (Choose two.)
- ASDDC Manager databaseCorrect answer
- BWorkload domain VMs
- CEncrypted passwordsCorrect answer
- DvSAN disk groups
Why this is the answer
SDDC Manager backup includes its database and encrypted passwords, not workload VMs or vSAN disk groups.
- Question 9Interactive
How many hosts are required in a vSAN cluster to use RAID-5 erasure coding?
- A3
- B4Correct answer
- C5
- D6
Why this is the answer
RAID-5 erasure coding with failures to tolerate (FTT)=1 requires a minimum of 4 hosts.
- Question 10Single Choice
Which feature in vSphere is used to balance VM load across hosts in a cluster?
- ADRSCorrect answer
- BHA
- CFT
- DvMotion
Why this is the answer
DRS (Distributed Resource Scheduler) migrates VMs to balance load within a cluster.
- Question 11Multiple Select
Which two actions are possible in an NSX Distributed Firewall rule? (Choose two.)
- AAllowCorrect answer
- BDropCorrect answer
- CForward
- DOverride
Why this is the answer
NSX DFW supports Allow and Drop actions. Forward and Override are not standard.
- Question 12Interactive
Which NSX feature can simulate packet traversal through firewall rules?
- AFlow Explorer
- BTraceflowCorrect answer
- CPacket Capture
- DHealth Check
Why this is the answer
Traceflow simulates packet traversal through NSX firewall rules to verify policy application.
Architecture and Design
8 questions in this domain
- Question 13Single Choice
What is the minimum number of hosts required for the Management Domain in a vSAN-based VCF deployment?
- A2
- B3
- C4Correct answer
- D5
Why this is the answer
The Management Domain must include at least four hosts to provide resilience for management components.
- Question 14Multiple Select
Which of the following are true statements about Workload Domains in VCF? (Choose two)
- AThey can have different vSphere versions assigned.Correct answer
- BThey share the same vCenter Server as the Management Domain.
- CThey are logically isolated pools of compute, storage, and network resources.Correct answer
- DThey can be directly managed by SDDC Manager for VM-level operations.
Why this is the answer
Workload Domains can have independent vSphere versions and are isolated resource pools. They do not share vCenter with the management domain, and SDDC Manager does not manage VMs.
- Question 15Interactive
Examine the following NSX configuration excerpt. What is the primary function of the component being configured?
- ATier-0 gatewayCorrect answer
- BTier-1 gateway
- CDistributed Firewall
- DNSX Manager cluster
Why this is the answer
The configuration creates a Tier-0 gateway with BGP peering to external routers, which handles North-South routing.
- Question 16Single Choice
Which storage option is mandatory for the Management Domain in a VCF 5.x deployment?
- AExternal Fibre Channel SAN
- BNFS v4.1
- CvSANCorrect answer
- DiSCSI with VMFS
Why this is the answer
The Management Domain in VCF 5.x must use vSAN as the storage layer to maintain lifecycle automation and simplicity.
- Question 17Multiple Select
Which of the following are responsibilities of SDDC Manager in VCF? (Choose two)
- AOrchestrating domain-level lifecycle operationsCorrect answer
- BManaging individual virtual machines
- CDeploying the initial VCF stack during bring-upCorrect answer
- DReplacing vCenter for day-to-day cluster management
Why this is the answer
SDDC Manager orchestrates lifecycle and initial deployment, but does not manage VMs or replace vCenter for daily operations.
- Question 18Interactive
Examine the following vSAN storage policy snippet. What does FTT=1 with RAID-1 imply for a VM's storage?
- AOne host failure with full data copyCorrect answer
- BOne disk failure with erasure coding
- CTwo host failures with mirroring
- DNo failures tolerated; only one copy
Why this is the answer
FTT=1 with RAID-1 means one mirror copy; the VM can survive one host failure without data loss.
- Question 19Single Choice
In a VCF architecture, which NSX component is responsible for East-West traffic filtering at the hypervisor level?
- ADistributed FirewallCorrect answer
- BGateway Firewall on Tier-0
- CNSX Advanced Load Balancer
- DTier-1 gateway routing
Why this is the answer
The Distributed Firewall runs in the ESXi kernel and filters East-West traffic at the vNIC level, even between VMs on the same segment.
- Question 20Multiple Select
Which of the following are valid considerations when planning a VDI Workload Domain? (Choose two)
- AUse all-flash storage to handle boot stormsCorrect answer
- BShare the Management Domain's vCenter Server to reduce cost
- CDedicate a separate NSX Tier-1 gateway for network isolationCorrect answer
- DMinimum of two hosts for the vSAN cluster
Why this is the answer
VDI domains benefit from all-flash storage for boot storms and should have a dedicated Tier-1 gateway. They require a separate vCenter and at least three hosts for vSAN.
Automation and Orchestration
6 questions in this domain
- Question 21Single Choice
Which PowerCLI cmdlet is used to establish a connection to the SDDC Manager?
- AConnect-VCFCorrect answer
- BConnect-VIServer
- CConnect-VMHost
- DConnect-VCFServer
Why this is the answer
Connect-VCF is the specific cmdlet from the VMware.VCF module that authenticates to the SDDC Manager REST API.
- Question 22Multiple Select
Which two components must be registered as cloud accounts in vRealize Automation to enable dynamic network provisioning on VCF?
- AvCenter ServerCorrect answer
- BNSX ManagerCorrect answer
- CvRealize Orchestrator
- DvRealize Suite Lifecycle Manager
Why this is the answer
vRA requires both a vCenter cloud account for compute and an NSX cloud account for dynamic network provisioning.
- Question 23Interactive
Review the Terraform provider block below. What is the primary purpose of the 'url' argument?
- AThe API endpoint of SDDC ManagerCorrect answer
- BThe vCenter Server address
- CThe NSX Manager hostname
- DThe Terraform Cloud backend URL
Why this is the answer
The 'url' argument in the VCF provider sets the SDDC Manager's API base URL for all subsequent resource operations.
- Question 24Single Choice
What is the first action taken by SDDC Manager when initiating an automated workload domain scale-out?
- APre-flight validation of host inventory and cluster stateCorrect answer
- BAdding the new host to the vCenter cluster
- CConfiguring NSX overlay on the new host
- DRebalancing VMs via DRS
Why this is the answer
The scaling workflow begins with pre-flight validation to ensure prerequisites such as host availability and image compliance are met.
- Question 25Multiple Select
Which two prerequisites must be verified before establishing an L2VPN cloud connection between on-premises VCF and a cloud SDDC?
- AMTU settings are consistent across the linkCorrect answer
- BNTP is synchronized between both sitesCorrect answer
- CBGP AS numbers are identical
- DvCenter Single Sign-On is federated
Why this is the answer
L2VPN (IPsec) requires consistent MTU to avoid fragmentation and synchronized NTP for IKE negotiation stability.
- Question 26Interactive
Examine the PowerCLI snippet. What does the variable $result contain after executing New-VCFCluster?
- AA task ID for asynchronous trackingCorrect answer
- BThe newly created cluster object
- CA boolean indicating success
- DAn error message if creation failed
Why this is the answer
New-VCFCluster initiates an asynchronous operation and returns a task ID that must be polled for completion.
Installation, Configuration, and Upgrade
10 questions in this domain
- Question 27Single Choice
Which temporary appliance orchestrates the initial bring-up of the VCF management domain?
- ACloud BuilderCorrect answer
- BSDDC Manager
- CvCenter Server
- DNSX Manager
Why this is the answer
The Cloud Builder VM is a temporary appliance used only for the initial bring-up; SDDC Manager is deployed later.
- Question 28Multiple Select
Which two prerequisites are required before adding a workload domain in VCF?
- AHealthy management domainCorrect answer
- BAvailable capacity pool hostsCorrect answer
- CDeployed Horizon Connection Server
- DConfigured external storage array
Why this is the answer
The management domain must be healthy and free hosts must exist in the capacity pool.
- Question 29Interactive
Review the deployment parameter workbook excerpt. Which network parameter is incorrectly specified?
- AOverlapping IP pools for management and vMotionCorrect answer
- BMissing VLAN ID for overlay transport zone
- CIncorrect DNS server IP address
- DMTU mismatch between hosts
Why this is the answer
Overlapping IP pools are a common DPW error; management and vMotion must use distinct pools.
- Question 30Single Choice
What is the default HA admission control setting for the management cluster after deployment?
- ADisabledCorrect answer
- BEnabled with 1 host reservation
- CEnabled with 50% memory
- DEnabled with 25 CPU
Why this is the answer
SDDC Manager enables vSphere HA with admission control disabled by default in the management domain.
- Question 31Multiple Select
Which two tasks are performed by SDDC Manager during lifecycle management?
- ARunning pre-checks before updatesCorrect answer
- BCreating snapshots for rollbackCorrect answer
- CDeploying Cloud Builder VM
- DManually configuring NTP
Why this is the answer
SDDC Manager automatically runs pre-checks and creates snapshots before applying updates.
- Question 32Interactive
A deployment fails with 'DNS resolution failure for vcenter.domain.com'. Which log file should be checked first?
- A/opt/vmware/var/log/cloudbuilder/Correct answer
- B/var/log/vmware/vcf/
- C/var/log/vmware/vcenter-server/
- D/var/log/vmkernel
Why this is the answer
Cloud Builder logs are stored in /opt/vmware/var/log/cloudbuilder/ for pre-validation issues.
- Question 33Single Choice
What is the minimum number of hosts required for a vSAN cluster with RAID-5 erasure coding?
- A4Correct answer
- B3
- C2
- D6
Why this is the answer
RAID-5 erasure coding requires a minimum of 4 hosts per vSAN cluster.
- Question 34Multiple Select
Which two components are included in each VCF workload domain?
- ADedicated vCenter ServerCorrect answer
- BDedicated NSX Manager clusterCorrect answer
- CCloud Builder VM
- DHorizon Connection Server
Why this is the answer
Each workload domain has its own vCenter and NSX Manager; Cloud Builder is only for initial bring-up.
- Question 35Interactive
The command 'chronyc sources -v' fails on an ESXi host. What is the most likely cause?
- AFirewall blocking UDP port 123Correct answer
- BIncorrect DNS server
- CMissing vSAN license
- DCorrupted chrony configuration
Why this is the answer
NTP uses UDP 123; a firewall block prevents chrony from reaching the NTP server.
- Question 36Single Choice
Which storage type is supported for VDI workload domains?
- AvSAN and NFSCorrect answer
- BvSAN only
- CNFS only
- DVMFS only
Why this is the answer
VCF supports both vSAN and NFS storage for VDI workload domains.
Troubleshooting and Disaster Recovery
4 questions in this domain
- Question 37Single Choice
What is the recommended first step when troubleshooting a VCF issue?
- ARestart SDDC Manager
- BCollect evidence via log bundlesCorrect answer
- CReboot all ESXi hosts
- DRe-register NSX-T Manager
Why this is the answer
The troubleshooting triad emphasizes systematic evidence gathering before any remediation.
- Question 38Multiple Select
Which two components are required for a DR solution using vSphere Replication and SRM?
- AvSphere Replication ApplianceCorrect answer
- BSDDC Manager
- CSite Recovery Manager ServerCorrect answer
- DvSAN Witness Host
Why this is the answer
vSphere Replication Appliance handles replication; SRM orchestrates failover.
- Question 39Interactive
After examining the NSX-T edge, an administrator runs the command in the code block. What does this command verify?
- ABGP peer status
- BOverlay segment configurationCorrect answer
- CTransport node health
- DFirewall rules
Why this is the answer
The command 'get logical-switches' lists all logical switches, which define overlay segments.
- Question 40Single Choice
Which VMware tool provides proactive health checks for vSAN clusters?
- AvRealize Log Insight
- BvSAN Skyline HealthCorrect answer
- CSDDC Manager
- DNSX Traceflow
Why this is the answer
vSAN Skyline Health offers proactive diagnostics for vSAN clusters.
Frequently asked questions
Everything about the VCP - VMware Cloud Foundation Administrator question bank and how to use it.