Question bank
VCP - VMware vSphere Foundation Administrator
40 VCP - VMware vSphere Foundation Administrator questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
VMware Aria Operations and Automation
8 questions in this domain
- Question 1Single Choice
What is the primary purpose of Aria Operations management packs?
- ACollect data from various sourcesCorrect answer
- BDeploy virtual appliances
- CManage user roles
- DConfigure network settings
Why this is the answer
Management packs act as adapters to pull metrics from vCenter, NSX, storage, etc., enabling unified monitoring and analytics.
- Question 2Multiple Select
Which two elements are required when configuring a vCenter adapter instance in Aria Operations?
- ADisplay nameCorrect answer
- BConnection detailsCorrect answer
- CManagement pack version
- DCollection schedule
Why this is the answer
An adapter instance needs a display name and connection details (hostname, credentials). Version and schedule are not required at instance creation.
- Question 3Interactive
Examine the Cloud Template snippet and identify the resource type of the VM.
- ACloud.MachineCorrect answer
- BCloud.Volume
- CCloud.Network
- DCloud.Template
Why this is the answer
The YAML shows 'type: Cloud.Machine' for the VM resource, which is the native Aria Automation type for virtual machines.
- Question 4Single Choice
What does the Capacity Planning Engine in Aria Operations use to forecast resource usage?
- AHistorical dataCorrect answer
- BReal-time metrics only
- CUser-defined thresholds
- DExternal API inputs
Why this is the answer
The engine uses historical data (minimum 30 days) and applies algorithms to predict future demand and time to full.
- Question 5Multiple Select
Which two are valid collection levels for a vCenter adapter in Aria Operations?
- ALevel 2 (Basic)Correct answer
- BLevel 4 (Full)Correct answer
- CLevel 1 (Minimal)
- DLevel 5 (Extended)
Why this is the answer
Valid levels are 2 (basic metrics) and 4 (full metrics for advanced monitoring and capacity planning). Levels 1 and 5 do not exist.
- Question 6Interactive
Review the alert definition snippet and choose the correct severity for disk usage exceeding 80%.
- ACriticalCorrect answer
- BWarning
- CInfo
- DEmergency
Why this is the answer
The alert definition shows 'severity: critical' for the symptom 'disk.usage.percent > 80', matching standard capacity thresholds.
- Question 7Single Choice
Where in Aria Operations do you configure cost drivers for chargeback?
- AAdministration > Cost SettingsCorrect answer
- BEnvironment Configuration > Groups
- CAlerts > Policy Definitions
- DDashboards > Custom Widgets
Why this is the answer
Cost drivers and pricing plans are configured under Administration > Cost Settings, enabling cost per unit for chargeback.
- Question 8Multiple Select
Which two tasks are part of managing Cloud Templates in Aria Automation?
- APublishing to catalogCorrect answer
- BVersion control integrationCorrect answer
- CConfiguring vCenter adapters
- DSetting up cost drivers
Why this is the answer
Cloud Templates are published to catalogs and integrated with Git for version control. Adapters and cost drivers belong to Aria Operations.
VMware vSAN and NSX Administration
4 questions in this domain
- Question 9Single Choice
What is the minimum number of hosts required for a vSAN all-flash cluster to support erasure coding RAID-5 with 1 failure tolerance?
- A3 hosts
- B4 hostsCorrect answer
- C5 hosts
- D6 hosts
Why this is the answer
RAID-5 erasure coding with FTT=1 requires a minimum of 4 hosts in a vSAN all-flash cluster. This is because erasure coding splits data into 3 data blocks and 1 parity block, requiring at least 4 hosts to store the components.
- Question 10Multiple Select
Which two components can be used as key providers for vSAN encryption?
- AKey Management Server (KMS)Correct answer
- BLocal key providerCorrect answer
- CVMware Identity Manager
- DActive Directory Certificate Services
Why this is the answer
vSAN encryption supports two key provider modes: a Key Management Server (KMS) compliant with KMIP 1.2, and a local key provider (simplified, non-FIPS 140-2 compliant). VMware Identity Manager and AD Certificate Services are not used for vSAN encryption key management.
- Question 11Interactive
An administrator runs the following command on an ESXi host. What is the purpose of this command?
- ACheck the overall vSAN cluster health statusCorrect answer
- BList all virtual machines on the host
- CDisplay the vSAN disk group configuration
- DTest network connectivity between vSAN nodes
Why this is the answer
The command 'esxcli vsan health cluster list' retrieves the vSAN health status for the entire cluster from the perspective of the local host. It is used to quickly assess vSAN health without using the vSphere Client.
- Question 12Single Choice
Where does the NSX Distributed Firewall enforce security policies?
- AAt the vNIC level within the ESXi hypervisor kernelCorrect answer
- BAt the Tier-0 gateway router
- CAt the physical network switch
- DAt the NSX Manager appliance
Why this is the answer
The NSX Distributed Firewall (DFW) is built into the hypervisor kernel and enforces policies at the virtual NIC (vNIC) level. This allows micro-segmentation without hair-pinning traffic to a central appliance, providing wire-speed security.
VMware vSphere Foundation Architectures and Technologies
8 questions in this domain
- Question 13Single Choice
Which component of VMware vSphere Foundation (VVF) provides centralized management of ESXi hosts and virtual machines?
- AvCenter ServerCorrect answer
- BESXi Hypervisor
- CvSAN
- DNSX
Why this is the answer
vCenter Server is the centralized management plane in VVF, providing a single point of control for ESXi hosts, virtual machines, clusters, datastores, and networking. ESXi is the hypervisor, vSAN provides storage, and NSX provides networking.
- Question 14Multiple Select
Which of the following are included in the VMware vSphere Foundation (VVF) bundle? (Select TWO.)
- AvCenter ServerCorrect answer
- BAria Automation
- CvSANCorrect answer
- DSDDC Manager
Why this is the answer
VVF includes vCenter Server, vSAN, Aria Operations for Infrastructure, and Aria Operations for Logs. Aria Automation and SDDC Manager are part of VMware Cloud Foundation (VCF), not VVF.
- Question 15Interactive
An administrator runs the following PowerCLI command to check the vSAN health status. What is the expected output if the vSAN cluster is healthy?
- AHealthStatus: 'Green'Correct answer
- BHealthStatus: 'Red'
- CHealthStatus: 'Yellow'
- DHealthStatus: 'Orange'
Why this is the answer
The Get-VsanClusterHealth cmdlet returns a HealthStatus property. A value of 'Green' indicates that all health checks passed and the cluster is healthy.
- Question 16Single Choice
What is the minimum number of hosts required for a vSAN Express Storage Architecture (ESA) cluster?
- A2 hosts
- B3 hostsCorrect answer
- C4 hosts
- D5 hosts
Why this is the answer
vSAN ESA requires a minimum of 3 hosts. OSA can start with 2 hosts using a witness appliance, but ESA does not support 2-node configurations.
- Question 17Multiple Select
Which two components are part of VMware Cloud Foundation (VCF) but NOT included in VMware vSphere Foundation (VVF)? (Select two.)
- ANSXCorrect answer
- BAria Operations for Logs
- CSDDC ManagerCorrect answer
- DvSAN
Why this is the answer
VCF includes all VVF components plus NSX, Aria Automation, full Aria Operations, and SDDC Manager. Aria Operations for Logs and vSAN are already part of VVF.
- Question 18Interactive
A vSphere admin needs to create a vSAN storage policy with 'Failures to tolerate = 1' using RAID-5 erasure coding. What is the minimum number of hosts required in the cluster?
- A3
- B4Correct answer
- C5
- D6
Why this is the answer
RAID-5 erasure coding with FTT=1 requires a minimum of 4 hosts to avoid a 'No Quorum' condition. The number of data components is 3 (n-1), so at least 4 hosts are needed.
- Question 19Single Choice
In vSphere Distributed Services Engine (DSE), what hardware component is required to offload network and security services?
- AData Processing Unit (DPU)Correct answer
- BPersistent Memory (PMem)
- CGraphics Processing Unit (GPU)
- DNon-Volatile Memory Express (NVMe) drive
Why this is the answer
DSE requires a Data Processing Unit (DPU) or Smart NIC to offload network and security processing from the hypervisor CPU.
- Question 20Multiple Select
Which two statements about vSphere Persistent Memory (PMem) are correct? (Select TWO.)
- APMem can be used as a virtual disk (vPMemDisk) with lower latency than SSD.Correct answer
- BPMem supports vMotion to any host regardless of hardware.
- CPMem can be configured as a memory tier that persists across host reboots.Correct answer
- DPMem requires all hosts in the cluster to have identical PMem configurations.
Why this is the answer
PMem can be used as vPMemDisk (fast persistent storage) or vPMem (memory tier). vMotion requires compatible PMem on the target host. Identical configuration is not required, but recommended for consistency.
VMware vSphere Infrastructure Installation and Configuration
10 questions in this domain
- Question 21Single Choice
During an interactive ESXi installation, at which step is the root password required?
- AAfter disk selection and before EULA acceptance
- BBefore disk selection and after EULA acceptanceCorrect answer
- CAfter the installation completes and first boot
- DDuring the keyboard layout selection
Why this is the answer
In interactive ESXi installation, the root password is prompted after accepting the EULA and before selecting the target disk. The installer asks for root password (with confirmation) prior to disk selection step.
- Question 22Multiple Select
Which of the following are valid methods for deploying an ESXi host? (Choose two)
- AInteractive installation from a CD/DVD ISOCorrect answer
- BStateless deployment using Auto DeployCorrect answer
- CUsing a Windows-based vCenter Server as an installation target
- DBooting from a network share without a kickstart file
Why this is the answer
Valid methods include interactive (ISO) and Auto Deploy (stateless/stateful). Scripted installation also writes to disk, but stateless Auto Deploy is distinct. vCenter is not used to install ESXi directly.
- Question 23Interactive
An administrator needs to list the standard virtual switches on an ESXi host. Which command should be used?
- Aesxcli network vswitch standard listCorrect answer
- Besxcli network vswitch dvs vmware list
- Cesxcli network ip interface list
- Desxcli network vswitch list
Why this is the answer
The correct command is 'esxcli network vswitch standard list'. The other commands list distributed switches, IP interfaces, or a generic list that includes both types.
- Question 24Single Choice
Which deployment architecture is supported for vCenter Server Appliance in vSphere 8?
- AEmbedded Platform Services Controller onlyCorrect answer
- BExternal Platform Services Controller with separate vCenter Server
- CBoth embedded and external Platform Services Controller
- DDistributed deployment with multiple Platform Services Controllers
Why this is the answer
vSphere 8 only supports embedded deployments. The external Platform Services Controller architecture was removed. All services run within a single VCSA.
- Question 25Multiple Select
Which of the following are prerequisites for deploying a VCSA? (Choose two)
- ADNS must have both forward and reverse lookup records for the planned VCSA FQDNCorrect answer
- BThe target ESXi host must have DHCP enabled
- CNTP servers must be reachable from the management networkCorrect answer
- DAn Active Directory domain must be configured before deployment
Why this is the answer
Pre-deployment checks include DNS (forward and reverse) and NTP reachability. DHCP is not recommended; static IP is required. AD configuration is optional and can be done post-deployment.
- Question 26Interactive
An administrator needs to enable jumbo frames (MTU 9000) for vMotion traffic. Which two steps must be performed?
- ASet MTU 9000 on the vSwitch or distributed switchCorrect answer
- BSet MTU 9000 on the physical switch ports
- CSet MTU 9000 on the VMkernel adapter dedicated to vMotionCorrect answer
- DEnable jumbo frames on the VMkernel adapter for management
Why this is the answer
For jumbo frames, MTU must be set on the vSwitch/dvSwitch and on the VMkernel adapter. Physical switch configuration is required but is not an action an ESXi admin performs via vSphere Client.
- Question 27Single Choice
What is the default block size for a VMFS-6 datastore created on a LUN larger than 2 TB?
- A1 MB
- B4 MB
- C8 MBCorrect answer
- D2 MB
Why this is the answer
VMFS-6 defaults to 8 MB block size for LUNs larger than 2 TB to support larger virtual disks. This is a key fact for storage configuration.
- Question 28Multiple Select
Which two prerequisites must be met for an iSCSI software initiator to connect to a target?
- AEnable the iSCSI Software Adapter on the hostCorrect answer
- BConfigure CHAP authentication with a secret of at least 12 characters
- CAdd a dynamic discovery entry with the target IP addressCorrect answer
- DCreate a VMkernel adapter for iSCSI traffic
Why this is the answer
The iSCSI Software Adapter must be enabled and a dynamic discovery target IP added. CHAP is optional but recommended. A VMkernel adapter is needed for connectivity but is not part of the initiator configuration step.
- Question 29Interactive
When configuring vSphere HA, which response is appropriate for a host that loses network heartbeats but continues to access shared storage?
- ALeave powered onCorrect answer
- BPower off
- CShut down
- DRestart VMs
Why this is the answer
If the host is isolated but still has storage access, 'Leave powered on' avoids forcibly shutting down VMs that may be performing critical I/O. Powering off would risk data corruption.
- Question 30Single Choice
Which admission control policy uses a percentage of cluster resources reserved for failover?
- ASlot policy
- BFailover hosts
- CCluster resource percentageCorrect answer
- DHost failure detection
Why this is the answer
Cluster resource percentage is one of three admission control policies. It reserves a percentage of total CPU and memory for failover capacity.
VMware vSphere Operational Management
10 questions in this domain
- Question 31Single Choice
Which tool provides real-time, per-second performance counters for ESXi hosts?
- AvCenter Performance Charts
- BesxtopCorrect answer
- CvscsiStats
- Dresxtop
Why this is the answer
esxtop provides real-time, granular counters at the ESXi host level. vCenter Charts show aggregated historical data. vscsiStats is for virtual SCSI statistics, and resxtop is a remote version of esxtop.
- Question 32Multiple Select
Which two conditions are required for vSphere Trust Authority (vTA) to function on an ESXi host?
- ATPM 2.0 chipCorrect answer
- BUEFI Secure Boot enabledCorrect answer
- CvCenter Server 7.0 or later
- DActive Directory integration
Why this is the answer
vTA requires a discrete or firmware TPM 2.0 and UEFI Secure Boot. While a supported vCenter version is needed, it is not a prerequisite on the host itself. AD integration is unrelated to vTA.
- Question 33Interactive
Refer to the command below. What does the 'c' key do in this utility?
- ADisplays CPU performance countersCorrect answer
- BShows memory usage statistics
- COpens disk latency metrics
- DExits the tool
Why this is the answer
In esxtop, pressing 'c' switches to the CPU screen which shows counters like %RDY, %CSTP, etc. Other keys: 'm' for memory, 'd' for disk, 'n' for network.
- Question 34Single Choice
What is the purpose of the 'Do not propagate to children' flag when assigning a vSphere permission?
- AIt prevents the permission from being inherited by child objects.Correct answer
- BIt blocks the permission from being applied to the current object.
- CIt revokes the permission from the user or group.
- DIt forces the permission to apply to all objects globally.
Why this is the answer
Permission propagation controls whether the permission is inherited by child objects. Unchecking 'Propagate to children' means the permission applies only to the selected object and not to its descendants.
- Question 35Multiple Select
Which two actions can a vSphere alarm perform when triggered?
- ASend an SNMP trapCorrect answer
- BExecute a command on the vCenter ServerCorrect answer
- CReboot the ESXi host
- DDelete the virtual machine
Why this is the answer
Alarms can send SNMP traps and run commands (scripts) on the vCenter Server. They cannot directly reboot hosts or delete VMs as actions.
- Question 36Interactive
Examine the command. What is the purpose of the 'replace' operation in this context?
- AReplaces the vCenter Server machine SSL certificateCorrect answer
- BReplaces the solution user certificates
- CRegenerates the VMCA root certificate
- DDeploys a new vCenter Server
Why this is the answer
The 'certificate-manager replace --machine-ssl' command is used to replace the vCenter Server's machine SSL certificate (used for HTTPS access). Solution user certificates are replaced with '--solution-user'.
- Question 37Single Choice
What is the first step when restoring a vCenter Server from a file-based backup?
- ADeploy a temporary VCSA using the InstallerCorrect answer
- BPower on the old vCenter Server
- CRestore from VAMI web interface
- DAttach the backup disk to a running VM
Why this is the answer
The restore process begins by deploying a temporary VCSA from the Installer ISO. You cannot restore a running vCenter; the appliance must be off. VAMI restore is only for an already deployed appliance.
- Question 38Multiple Select
Which two protocols are supported for vCenter Server file-based backup destinations?
- AFTPCorrect answer
- BSMB/CIFSCorrect answer
- CNFS
- DiSCSI
Why this is the answer
VCSA file-based backup supports FTP, FTPS, HTTPS, SCP, and SMB/CIFS. NFS and iSCSI are not protocols handled by the backup service.
- Question 39Interactive
Given the PowerCLI snippet, what does the '-Stage' parameter control?
- ACopies patches to the host before remediationCorrect answer
- BApplies patches immediately to the host
- CRemoves patches from the host
- DScans for missing patches
Why this is the answer
Staging in VUM or vLCM downloads patches to the ESXi host's bootbank before the maintenance window, reducing remediation time. It does not apply them.
- Question 40Single Choice
What is the primary purpose of the 'No Access' role in vSphere permissions?
- ATo override any inherited permissions and deny accessCorrect answer
- BTo provide read-only access to an object
- CTo allow administrative actions on a VM
- DTo grant permission propagation
Why this is the answer
The 'No Access' role is special; when assigned, it overrides any other permissions from inheritance or direct assignment, completely denying access to the object for that user/group.
Frequently asked questions
Everything about the VCP - VMware vSphere Foundation Administrator question bank and how to use it.