Question bank
VMware Certified Advanced Professional - VMware Cloud Foundation Architect
41 VMware Certified Advanced Professional - VMware Cloud Foundation Architect questions with the correct answer and a written explanation, organised across 5 exam domains.
- 41 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Architecture and Design
10 questions in this domain
- Question 1Single Choice
What is the first step in designing a VMware Cloud Foundation (VCF) architecture based on business requirements?
- ARequirement gathering and mappingCorrect answer
- BSelecting the hardware vendors
- CDeploying SDDC Manager
- DConfiguring vSAN storage policies
Why this is the answer
The first step is gathering and mapping business requirements to technical decisions, as documented in the VMware Cloud Foundation Design Guide.
- Question 2Multiple Select
Which of the following are key design constructs for organizing resources in VCF? (Choose two)
- AWorkload DomainCorrect answer
- BAvailability Zone
- CResource PoolCorrect answer
- DvSphere Cluster
Why this is the answer
Workload domains provide policy-driven boundaries; resource pools enable fine-grained resource allocation within clusters. Availability zones and clusters are also used but not as primary organizational constructs for resource isolation.
- Question 3Interactive
Refer to the command output. Which VCF component is being updated first according to the lifecycle sequence shown?
- ASDDC ManagerCorrect answer
- BvCenter Server
- CESXi hosts
- DNSX Manager
Why this is the answer
SDDC Manager is always upgraded first because it orchestrates all subsequent component upgrades.
- Question 4Single Choice
What is the primary role of SDDC Manager in VCF lifecycle management?
- AIt orchestrates upgrades and patches across all workload domainsCorrect answer
- BIt provides storage policies for vSAN
- CIt manages NSX distributed firewall rules
- DIt balances workloads across clusters
Why this is the answer
SDDC Manager is the brain of VCF, responsible for lifecycle operations including patching and upgrades.
- Question 5Multiple Select
Which statements are true about VCF workload domains? (Choose two)
- AEach workload domain can have its own vCenter ServerCorrect answer
- BWorkload domains always stretch across multiple sites
- CManagement and tenant workloads can be placed in the same domain without restrictions
- DA VCF instance supports up to 25 workload domainsCorrect answer
Why this is the answer
Workload domains can have dedicated vCenter Servers; VCF supports up to 25 workload domains per instance. They are not required to be stretched, and management components should be separate from tenant workloads.
- Question 6Interactive
Considering the vSAN topology snippet, which cluster type requires a separate witness appliance?
- AStretched clusterCorrect answer
- BStandard cluster
- CvSAN single-host cluster
- DFederated cluster
Why this is the answer
A vSAN stretched cluster uses a witness appliance in a third location to maintain quorum if one site fails.
- Question 7Single Choice
What is the main purpose of an availability zone in a VCF workload domain?
- AFault isolation across different failure domainsCorrect answer
- BFine-grained resource control for VMs
- CMulti-tenancy through separate vCenter Servers
- DLifecycle management automation
Why this is the answer
Availability zones group clusters to provide fault isolation, ensuring workloads survive failure of a physical infrastructure component.
- Question 8Multiple Select
Which of the following are correct about the upgrade sequence in VCF? (Choose two)
- ASDDC Manager must be upgraded before vCenter ServerCorrect answer
- BESXi hosts can be upgraded before vCenter Server
- CNSX is upgraded after ESXi hostsCorrect answer
- DvSAN on-disk format upgrade happens automatically during ESXi patch
Why this is the answer
The approved sequence is: SDDC Manager first, then vCenter, then ESXi (with vSAN), then NSX. vSAN on-disk format upgrades are separate cluster-level operations.
- Question 9Interactive
Given the configuration snippet, which integration method violates VCF best practices?
- AMounting a datastore directly via vSphere ClientCorrect answer
- BUsing SDDC Manager to add a new storage array
- CRegistering a storage provider in SDDC Manager
- DCreating a storage profile in SDDC Manager
Why this is the answer
In VCF, all storage operations should go through SDDC Manager. Direct mounting via vSphere Client causes drift and can break automated lifecycle management.
- Question 10Single Choice
How many SDDC Manager instances are typically required in a single VCF instance?
- AExactly oneCorrect answer
- BOne per vCenter Server
- COne per workload domain
- DTwo for high availability
Why this is the answer
Each VCF instance has one SDDC Manager that manages all domains within that instance. Multiple instances require separate SDDC Managers.
Deploy and Configure
9 questions in this domain
- Question 11Single Choice
What is the initial step performed by SDDC Manager in the management domain bring-up workflow?
- ADeploy vCenter Server
- BValidate prerequisitesCorrect answer
- CConfigure vSAN storage
- DDeploy NSX Manager appliances
Why this is the answer
The bring-up workflow begins with prerequisite validation including DNS, NTP, and network connectivity.
- Question 12Multiple Select
Which two statements correctly describe characteristics of the management workload domain in VCF?
- ACPU overcommit ratio of 4:1 is recommended for optimal performance
- BNo overcommit on CPU or memory is appliedCorrect answer
- CTypical cluster size ranges from 3 to 4 nodesCorrect answer
- DStorage policy uses RAID-5 to reduce costs
Why this is the answer
Management domains require guaranteed resources with no overcommit and are typically 3-4 nodes for high availability.
- Question 13Interactive
Review the following NSX-T Tier-0 gateway configuration snippet. What high availability mode is defined?
- AActive-Standby
- BActive-ActiveCorrect answer
- CStandalone
- DDynamic Active-Passive
Why this is the answer
The 'ACTIVE_ACTIVE' high availability mode supports stateless routing only.
- Question 14Single Choice
In a vSAN stretched cluster, what is the maximum number of site failures the primary Failures to Tolerate (FTT) setting can protect against?
- A0
- B1Correct answer
- C2
- D3
Why this is the answer
Stretched clusters support only one site failure at the primary level due to two data sites plus witness.
- Question 15Multiple Select
Which two prerequisites are essential for integrating a third-party hardware management system with SDDC Manager?
- AThe hardware management system must be registered as a vCenter extension
- BThe hardware management API must be reachable from the SDDC Manager networkCorrect answer
- COut-of-band management network connectivity is required for server discoveryCorrect answer
- DAll compute nodes must have identical firmware versions at the time of registration
Why this is the answer
SDDC Manager uses the hardware API for discovery and firmware checks; OOB network must be separate from production traffic.
- Question 16Interactive
The SDDC Manager bring-up wizard returns the error shown. What is the likely root cause?
- AIncorrect NTP server configuration
- BMissing DNS A/PTR records for the management vCenter FQDNCorrect answer
- CInvalid ESXi root credentials
- DFirewall blocking port 443 to the vCenter
Why this is the answer
The error explicitly states DNS resolution failure; verifying forward/reverse DNS records is the required step.
- Question 17Single Choice
What is the recommended memory overcommit ratio for a VDI workload domain in VCF?
- A0:1 (no overcommit)
- B1.1:1Correct answer
- C3:1
- D5:1
Why this is the answer
VDI domains use minimal memory overcommit (approximately 1.1:1) to avoid swap storms and ensure desktop responsiveness.
- Question 18Multiple Select
Which two services are supported on an NSX-T Tier-1 gateway?
- ABGP dynamic routing
- BNetwork Address Translation (NAT)Correct answer
- CDHCP server functionalityCorrect answer
- DEqual-Cost Multi-Path (ECMP) load balancing
Why this is the answer
Tier-1 gateways support stateful services like NAT and DHCP; BGP and ECMP are Tier-0 features.
- Question 19Interactive
Examine the vSAN storage policy snippet. What site affinity setting is applied?
- ARequireSiteAffinity
- BPreferSiteAffinityCorrect answer
- CNoAffinity
- DStretchAffinity
Why this is the answer
The 'prefer' site affinity allows vSAN to place primary copies on the preferred site but can use secondary if needed.
Management and Operations
8 questions in this domain
- Question 20Single Choice
Which VCF component acts as the single control plane for all upgrade and patching activities?
- ASDDC ManagerCorrect answer
- BvCenter Server
- CNSX Manager
- DvSphere Replication
Why this is the answer
SDDC Manager is the single control plane that orchestrates all upgrade and patching activities across the VCF stack, eliminating individual component management.
- Question 21Multiple Select
Which two are critical aspects of VCF lifecycle management? (Select two)
- AUpgrade sequence from management domain to workload domainsCorrect answer
- BUsing any version regardless of BOM
- CCertificate rotation is optional
- DPre-upgrade health checks are mandatoryCorrect answer
Why this is the answer
The upgrade must start with the management domain, and pre-upgrade health checks are mandatory to prevent failures during the lifecycle operation.
- Question 22Interactive
Examine the following API call. What does it do? (Single Choice)
- AInitiate an upgrade
- BCheck task statusCorrect answer
- CRotate certificates
- DDelete a workload domain
Why this is the answer
The API call is a GET request to /v1/tasks/{taskId} which retrieves the status of a previously submitted task, such as an upgrade.
- Question 23Single Choice
During a VCF lifecycle upgrade, which component must be upgraded first?
- AESXi hosts
- BvCenter Server
- CSDDC ManagerCorrect answer
- DNSX Manager
Why this is the answer
The SDDC Manager must be upgraded first to avoid API mismatch and ensure it can manage the new component versions.
- Question 24Multiple Select
Which two tools are commonly used to monitor resource utilization in VCF? (Select two)
- AvRealize OperationsCorrect answer
- BvSphere Replication
- CSite Recovery Manager
- DvCenter ServerCorrect answer
Why this is the answer
vRealize Operations provides predictive analytics and vCenter Server offers real-time performance charts for resource utilization monitoring.
- Question 25Interactive
Analyze the alert definition snippet. Which two components are involved? (Multiple Select)
- AvCenterCorrect answer
- BvSANCorrect answer
- CNSX
- DSDDC Manager
Why this is the answer
The alert definition includes symptoms for vCenter (e.g., host connection state) and vSAN (e.g., disk latency), indicating both components are monitored.
- Question 26Single Choice
What is the main function of Site Recovery Manager in a VCF DR strategy?
- AReplicate VMs
- BOrchestrate failoverCorrect answer
- CManage storage
- DProvide backup
Why this is the answer
SRM orchestrates the failover process, including starting VMs, network remapping, and testing, but does not perform replication itself.
- Question 27Multiple Select
Which three are prerequisites for using vSphere Replication with SRM? (Select three)
- AvSphere Replication appliance deployed at both sitesCorrect answer
- BSRM servers registered with vCenterCorrect answer
- CArray-based storage replication
- DNetwork connectivity between sitesCorrect answer
Why this is the answer
vSphere Replication requires VR appliances at both sites, SRM must be registered, and network connectivity is necessary for replication traffic.
Security and Compliance
8 questions in this domain
- Question 28Single Choice
What is the core philosophy of a zero-trust security model as implemented by NSX Distributed Firewall?
- ANever trust, always verify. No entity is trusted by default.Correct answer
- BTrust but verify all network traffic.
- CBlock all inbound traffic and allow all outbound traffic.
- DUse micro-segmentation to isolate workloads only.
Why this is the answer
The zero-trust model operates on \"never trust, always verify\" without implicit trust.
- Question 29Multiple Select
Which two characteristics accurately describe the NSX Distributed Firewall in VCF?
- AIt operates at the hypervisor kernel level.Correct answer
- BIt requires a physical firewall appliance.
- CIt enforces policies at wire speed without hair-pinning.Correct answer
- DIt only filters north-south traffic.
Why this is the answer
DFW is hypervisor-based, operates at kernel level, and enforces east-west traffic.
- Question 30Interactive
Which NSX feature prevents IP/MAC address spoofing in a zero-trust environment?
- ASpoofGuardCorrect answer
- BIdentity Firewall
- CIDS/IPS
- DDistributed Firewall
Why this is the answer
SpoofGuard validates source IP against assigned IP, preventing spoofing.
- Question 31Single Choice
In VCF SDDC Manager, which built-in role can configure identity sources and perform domain join?
- ASUPER_ADMINCorrect answer
- BADMIN
- CUSER
- DAUDITOR
Why this is the answer
Only SUPER_ADMIN has privileges for identity source configuration and domain join.
- Question 32Multiple Select
Which two prerequisites must be met before enabling vSAN encryption in VCF?
- AA key management server (KMS) registered with vCenterCorrect answer
- BAll ESXi hosts must have TPM 2.0 for key cachingCorrect answer
- CvMotion encryption must be enabled
- DThe vSAN cluster must be in a stretched configuration
Why this is the answer
vSAN encryption requires a KMS and TPM for key caching.
- Question 33Interactive
Which tool provides pre-built dashboards and alerts for regulatory compliance in VCF?
- AvRealize Log Insight with compliance packsCorrect answer
- BvCenter Server with default logging
- CNSX Manager audit logs
- DSDDC Manager compliance dashboard
Why this is the answer
Compliance packs in Log Insight provide mapped controls and alerts.
- Question 34Single Choice
When applying a security patch to VCF, what is the correct order of component updates?
- ASDDC Manager, NSX Manager, vCenter, ESXi hostsCorrect answer
- BESXi hosts, vCenter, NSX Manager, SDDC Manager
- CvCenter, SDDC Manager, NSX Manager, ESXi hosts
- DNSX Manager, vCenter, ESXi hosts, SDDC Manager
Why this is the answer
The proper update order begins with SDDC Manager, then NSX, vCenter, and finally ESXi hosts.
- Question 35Multiple Select
Which two components are necessary to configure SAML-based identity federation for vCenter in VCF?
- AImport the IdP's SAML metadata into vCenterCorrect answer
- BEnsure clock skew between VCF components and IdP is within five minutesCorrect answer
- CDeploy a second vCenter for redundancy
- DDisable the built-in SSO domain
Why this is the answer
SAML federation requires metadata import and time synchronization.
Troubleshooting and Optimization
6 questions in this domain
- Question 36Single Choice
What is the most common cause of VCF deployment failure?
- AEnvironmental issues like DNS or NTP misconfigurationCorrect answer
- BA bug in the VCF software code
- CInsufficient CPU resources on the management domain hosts
- DCorruption of the SDDC Manager database
Why this is the answer
Over 70% of VCF deployment failures are due to environmental issues such as time synchronization (NTP) drift, DNS record problems, or incorrect switch MTU settings.
- Question 37Multiple Select
Which tools or commands can be used to verify NSX-T overlay connectivity? (Choose two.)
- Ansxdi-cliCorrect answer
- Bget tunnel commandCorrect answer
- CStandard ping utility
- Desxtop command
Why this is the answer
The nsxdi-cli and the get tunnel command are specifically designed for NSX-T troubleshooting. Standard ping only tests Layer 3 reachability, and esxtop is for performance monitoring.
- Question 38Interactive
An architect needs to collect logs for a problem that spans both the management domain and a VI workload domain. Which Skyline Health Diagnostics scope should be used?
- ASingle host
- BCluster
- CWorkload domain
- DFull VCF instanceCorrect answer
Why this is the answer
The full VCF instance scope collects logs from all domains and is required for cross-domain correlation, as the SDDC Manager coordinates external services.
- Question 39Single Choice
Which DRS rule enforcement level ensures that VMs are always placed on a specific host group?
- AMust run on hosts in groupCorrect answer
- BShould run on hosts in group
- CMust not run on hosts in group
- DVM-to-VM anti-affinity
Why this is the answer
The 'Must run on hosts in group' rule is a mandatory constraint that DRS will never violate, ensuring VMs are always placed on the specified host group.
- Question 40Multiple Select
Which of the following are valid sources of log data for conducting a multi-domain root cause analysis in VCF? (Choose three.)
- ASDDC Manager logsCorrect answer
- BvCenter Server logsCorrect answer
- CESXi hostd logsCorrect answer
- DAria Operations performance charts
Why this is the answer
SDDC Manager logs track lifecycle operations, vCenter logs record events and tasks, and hostd logs provide host-level details. Aria Operations charts are aggregated metrics, not raw log data.
- Question 41Interactive
A workload domain deployment hangs at 80% progress. What is the first diagnostic step an architect should take?
- ACheck the SDDC Manager LCM logsCorrect answer
- BRestart all ESXi hosts in the management domain
- CRe-run the deployment wizard
- DVerify DNS reverse lookup zone entries
Why this is the answer
The first step is to check the LCM logs on SDDC Manager to identify the exact error. Restarting hosts or re-running the wizard without diagnosis can worsen the issue.
Frequently asked questions
Everything about the VMware Certified Advanced Professional - VMware Cloud Foundation Architect question bank and how to use it.