Question bank
VCAP - VMware Cloud Foundation Operations
40 VCAP - VMware Cloud Foundation Operations questions with the correct answer and a written explanation, organised across 5 exam domains.
- 40 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Automation and Lifecycle Management
6 questions in this domain
- Question 1Single Choice
What authentication method is required for SDDC Manager API calls?
- ASession cookies
- BBearer tokenCorrect answer
- CBasic authentication
- DOAuth 2.0
Why this is the answer
SDDC Manager API authentication uses a bearer token obtained from the /v1/tokens endpoint.
- Question 2Multiple Select
Which two prerequisites must be satisfied before deploying a workload domain with the VCF API?
- AManagement domain is operationalCorrect answer
- BHosts are in AVAILABLE stateCorrect answer
- CSDDC Manager is rebooted
- DNSX Manager license key is not required
Why this is the answer
The management domain must be functional and hosts must be in AVAILABLE state before domain deployment.
- Question 3Interactive
Based on the provided PowerCLI snippet, what does the Get-VCFCertificate cmdlet accomplish?
- ATo generate a new certificate signing request
- BTo retrieve all certificates for a given domain typeCorrect answer
- CTo replace expired certificates
- DTo validate certificate chain
Why this is the answer
Get-VCFCertificate retrieves certificate information for the specified domain type from SDDC Manager.
- Question 4Single Choice
Why is Terraform preferred over Ansible for provisioning VCF resources?
- AProcedural execution
- BStateful declarative managementCorrect answer
- CBetter configuration management
- DSimpler syntax
Why this is the answer
Terraform is stateful and declarative, making it ideal for provisioning and lifecycle management of VCF resources.
- Question 5Multiple Select
Identify two checks performed by SDDC Manager before scaling out a cluster.
- ADisk space availabilityCorrect answer
- BNetwork connectivityCorrect answer
- CDRS rule configuration
- DvSAN deduplication status
Why this is the answer
Pre-checks include verifying disk space and network connectivity to ensure the host can be added.
- Question 6Interactive
What effect does setting blocking to true have on this vRA event subscription?
- AThe workflow runs after provisioning completes
- BThe workflow prevents provisioning until it finishesCorrect answer
- CThe workflow can be cancelled
- DThe workflow runs asynchronously
Why this is the answer
A blocking subscription halts the provisioning process until the referenced workflow completes successfully.
Networking and Security
8 questions in this domain
- Question 7Single Choice
What is the primary encapsulation protocol used by NSX-T Data Center for overlay segments?
- AVXLAN
- BGeneveCorrect answer
- CSTT
- DNVGRE
Why this is the answer
Geneve is the encapsulation protocol used for overlay segments in NSX-T, providing flexibility and scalability.
- Question 8Multiple Select
Which two components are part of the NSX-T logical routing architecture? (Choose two)
- ATier-0 GatewayCorrect answer
- BTier-1 GatewayCorrect answer
- CDistributed Firewall
- DTransport Zone
Why this is the answer
Tier-0 and Tier-1 gateways provide north-south and east-west routing respectively in NSX-T.
- Question 9Interactive
Review the output of the NSX CLI command. What is the operational state of the logical router?
- AActiveCorrect answer
- BStandby
- CDisabled
- DUnknown
Why this is the answer
The output shows 'State: Active', indicating the logical router is currently operational.
- Question 10Single Choice
Where is the Distributed Firewall (DFW) enforced in NSX-T?
- AAt the virtual switch
- BAt the vNIC of the virtual machineCorrect answer
- CAt the Tier-1 gateway
- DAt the physical switch
Why this is the answer
The DFW enforces security at the vNIC level within the ESXi hypervisor kernel for east-west traffic.
- Question 11Multiple Select
Which two methods can be used to define security group membership dynamically in NSX-T? (Choose two)
- AStatic IP sets
- BDynamic tagsCorrect answer
- CMAC addresses
- DVM namesCorrect answer
Why this is the answer
Dynamic membership uses tags or VM names to include VMs automatically, enabling scalable grouping.
- Question 12Interactive
Refer to the Traceflow output. What does an 'Allow' action indicate?
- AEast-west traffic is permittedCorrect answer
- BThe gateway firewall allowed the traffic
- CA routing issue exists
- DThe packet was dropped
Why this is the answer
Traceflow showing 'Action: Allow' means the Distributed Firewall permitted the packet at that hop.
- Question 13Single Choice
Which NSX-T gateway is typically used to terminate IPsec VPN sessions?
- ATier-1 Gateway
- BTier-0 GatewayCorrect answer
- CDistributed Firewall
- DTransport Node
Why this is the answer
Tier-0 gateways connect to the physical network and are used for terminating IPsec VPNs.
- Question 14Multiple Select
Which two dynamic routing protocols are supported on NSX-T Tier-0 gateways? (Choose two)
- ABGPCorrect answer
- BOSPFCorrect answer
- CRIP
- DEIGRP
Why this is the answer
BGP and OSPF are dynamic routing protocols supported on NSX-T Tier-0 gateways.
SDDC Operations and Management
12 questions in this domain
- Question 15Single Choice
What action does SDDC Manager carry out prior to staging an upgrade bundle?
- APrerequisites checkCorrect answer
- BPerformance tuning
- CCapacity planning
- DBackup verification
Why this is the answer
SDDC Manager runs pre-checks including disk space, DNS, and DRS before staging bundles.
- Question 16Multiple Select
Which two tools are used for capacity planning in VCF according to the playbook?
- AvRealize OperationsCorrect answer
- BSDDC ManagerCorrect answer
- CvCenter Server
- DVMware Update Manager
Why this is the answer
vROps predicts trending; SDDC Manager provides initial sizing data. vCenter only shows real-time stats.
- Question 17Interactive
Examine the command below. What is its purpose?
- ARestore SDDC Manager from backupCorrect answer
- BTake a snapshot of vCenter
- CUpgrade NSX Manager
- DBack up vCenter database
Why this is the answer
The command 'vcf-backup-restore --restore' performs SDDC Manager restoration.
- Question 18Single Choice
Which component must be restored first after a disaster in VCF?
- ASDDC ManagerCorrect answer
- BWorkload domain vCenter
- CNSX Manager
- DvSAN datastore
Why this is the answer
SDDC Manager must be restored first to re-establish management plane and inventory.
- Question 19Multiple Select
Which two are required to create a proactive alert from Log Insight to vROps?
- ALog Insight Management Pack for vROpsCorrect answer
- BCustom log query in Log InsightCorrect answer
- CvCenter syslog configuration
- DSNMP trap receiver in vROps
Why this is the answer
The management pack and a custom alert-in-log query enable the integration.
- Question 20Interactive
Read the SNIPPET. What is the purpose of the 'scoped' attribute?
- ARestricts NSX role to a specific tenant organizationCorrect answer
- BEnables global admin privileges
- CDefines the NSX Manager cluster size
- DSets the firewall rule priority
Why this is the answer
The 'scoped' attribute ties an NSX role to a specific tenant organization for RBAC.
- Question 21Single Choice
What is the correct order for upgrading components in a VCF management domain?
- ASDDC Manager first, then vCenter, ESXi, NSXCorrect answer
- BvCenter first, then ESXi, NSX, SDDC Manager
- CNSX first, then vCenter, ESXi, SDDC Manager
- DESXi first, then vCenter, NSX, SDDC Manager
Why this is the answer
SDDC Manager must be upgraded before domain components; then vCenter, ESXi, and NSX.
- Question 22Multiple Select
Which two metrics indicate CPU contention in a VCF cluster?
- ACPU ready time > 5%Correct answer
- BMemory swap rate > 0 KB/s
- CHigh vSAN latency
- DElevated co-stop time
Why this is the answer
CPU ready time over 5% and co-stop time indicate vCPU scheduling contention.
- Question 23Interactive
Examine this vLCM image. What does it define?
- AESXi base image and add-onsCorrect answer
- BvCenter version and build
- CNSX edge cluster topology
- DvSAN disk group configuration
Why this is the answer
The image includes a base ESXi version with firmware and driver add-ons for vLCM.
- Question 24Single Choice
When is vSAN on-disk format upgrade irreversible?
- AOn-disk format upgradeCorrect answer
- BESXi host reboot
- CvCenter snapshot
- DNSX upgrade pre-check
Why this is the answer
vSAN ODF upgrade is a one-time, irreversible operation that requires maintenance windows.
- Question 25Multiple Select
Which two backup destinations are supported for SDDC Manager backup?
- ASMB/CIFS shareCorrect answer
- BNFS shareCorrect answer
- CLocal disk
- DvSAN datastore
Why this is the answer
SDDC Manager backups must be stored on external SMB/CIFS or NFS shares.
- Question 26Interactive
Read the permission snippet. What role is being assigned?
- ATenant NSX Admin with scoped accessCorrect answer
- BSuper Admin with global access
- CvCenter Read-Only role
- DvSAN Storage Administrator
Why this is the answer
The role is scoped to an organization (tenant) and includes FW edit privileges.
Software-Defined Data Center (SDDC) Design and Deploy
8 questions in this domain
- Question 27Single Choice
What is the primary purpose of requirement categorization in SDDC design?
- AFunctional vs. Non-functionalCorrect answer
- BHardware vs. Software
- CAvailability vs. Performance
- DLogical vs. Physical
Why this is the answer
It separates what the SDDC must do from performance characteristics, guiding component mapping.
- Question 28Multiple Select
Which components are part of a VI workload domain? (Select two)
- AvCenter ServerCorrect answer
- BNSX ManagerCorrect answer
- CvRealize Operations
- DvSAN without policy
Why this is the answer
VI workload domains have their own vCenter and NSX Manager; vRealize Operations is in management domain.
- Question 29Interactive
What does the 'managementPool' parameter define in the deployment manifest?
- ADefines VLAN for management trafficCorrect answer
- BDefines VLAN for workload traffic
- CDefines storage network
- DDefines vMotion network
Why this is the answer
The management pool provides network parameters for the management cluster during initial bring-up.
- Question 30Single Choice
What is the recommended minimum MTU for an NSX stretched cluster?
- A1500
- B1600Correct answer
- C9000
- D1400
Why this is the answer
NSX stretched clusters require MTU of at least 1600 bytes to accommodate Geneve headers.
- Question 31Multiple Select
Which two are vSAN storage policy capabilities? (Select two)
- AFailures to Tolerate (FTT)Correct answer
- BStripe WidthCorrect answer
- CEncryption
- DIOPS Limit
Why this is the answer
FTT and Stripe Width are core vSAN policy rules; encryption is a separate service.
- Question 32Interactive
What does the API call GET /v1/workflows?status=FAILED return?
- AList of failed workflowsCorrect answer
- BList of all workflows
- CWorkflow ID
- DError logs
Why this is the answer
It filters workflows with status FAILED, helping identify deployment issues.
- Question 33Single Choice
What is the maximum latency allowed for vSAN synchronous replication?
- A1 msCorrect answer
- B5 ms
- C10 ms
- D0.5 ms
Why this is the answer
vSAN synchronous replication requires less than 1 ms RTT to avoid performance issues.
- Question 34Multiple Select
Which two are workload domain types in VCF? (Select two)
- AManagement DomainCorrect answer
- BVirtual Infrastructure DomainCorrect answer
- CNSX Domain
- DStorage Domain
Why this is the answer
VCF has Management and VI workload domains; NSX is a component, not a domain type.
Storage and Data Protection
6 questions in this domain
- Question 35Single Choice
What does the 'Number of Failures to Tolerate' (PFTT) attribute in a vSAN storage policy define?
- AThe maximum number of concurrent host, disk, or network failures the object can survive while remaining accessible.Correct answer
- BThe percentage of flash cache capacity reserved for the VMDK.
- CThe number of disk groups across which each replica is striped.
- DThe percentage of the virtual disk size that is thick-provisioned.
Why this is the answer
PFTT defines how many concurrent failures the object can tolerate. Other options describe cache reservation, stripe width, or object space reservation.
- Question 36Multiple Select
Which two Failure Tolerance Methods (FTM) are supported by vSAN for creating storage policies?
- ARAID-1 (Mirroring)Correct answer
- BRAID-5 (Erasure Coding 3+1)Correct answer
- CRAID-0 (Striping)
- DRAID-10 (Stripe of Mirrors)
Why this is the answer
vSAN supports RAID-1 (mirroring) and RAID-5/6 erasure coding. RAID-0 and RAID-10 are not native FTM options.
- Question 37Interactive
Examine the output from the vSAN health service: 'Object: db-vm.vmdk, Policy: FTT=1, Stripe Width=4, Compliance: Non-Compliant'. What is the most likely cause of non-compliance?
- AThe cluster has fewer than 4 disk groups, making stripe width unsatisfiable.Correct answer
- BThe cluster has fewer than 4 hosts to satisfy FTT=1.
- CObject Space Reservation is set too high.
- DCache Reservation is not set for the VM.
Why this is the answer
Stripe width cannot exceed the number of disk groups in the cluster. Insufficient disk groups cause non-compliance.
- Question 38Single Choice
What is the primary purpose of vSAN HCI Mesh?
- ATo enable cross-cluster storage consumption by mounting remote vSAN datastores.Correct answer
- BTo provide synchronous replication between two sites for disaster recovery.
- CTo encrypt data at rest using a Key Management Server.
- DTo guarantee I/O performance with Quality of Service policies.
Why this is the answer
HCI Mesh allows a vSAN cluster to access another cluster's datastore as a remote datastore, enabling capacity federation.
- Question 39Multiple Select
Which two components are required to configure a vSAN stretched cluster?
- AA witness host in a third locationCorrect answer
- BLow-latency network links (<5 ms RTT) between sitesCorrect answer
- CA dedicated Key Management Server for encryption
- DIdentical storage capacity in both sites
Why this is the answer
A stretched cluster requires a witness for quorum and low-latency links for synchronous replication. KMS and identical capacities are not mandatory.
- Question 40Interactive
Review the following excerpt from a vCenter alert: 'vSAN encryption is enabled. Deduplication and compression are enabled. Performance degradation is observed.' What is the most likely cause of the degradation?
- AEncryption occurs before deduplication, rendering deduplication ineffective and increasing CPU overhead.Correct answer
- BDeduplication compresses the encryption keys, causing data corruption.
- CThe witness host cannot process encrypted data, causing split-brain.
- DThe KMS server becomes overloaded, leading to authentication failures.
Why this is the answer
vSAN encrypts data before dedup/compression, making dedup ineffective and adding CPU overhead. Performance degrades as a result.
Frequently asked questions
Everything about the VCAP - VMware Cloud Foundation Operations question bank and how to use it.