VMware Certified Professional - VMware Cloud Foundation Administrator

Last checked October 22, 2026 against the official VMware by Broadcom exam page.

1. Question 1Operations, Security and Troubleshooting

   Which VCF task keeps certificates valid across the SDDC components?

   1. AUsing self-signed certificates on every component until they expire, with no renewal planned in advance
   2. BTurning off TLS on the management components to avoid the work involved in certificate renewal
   3. CManaging certificates through SDDC Manager, with rotation and renewal tracked for each component
   4. DInstalling a single wildcard certificate by hand on each host and ignoring the vCenter servers entirely
   Show answer and explanationHide answer

   Correct answer: C

   Managing certificates through SDDC Manager, with rotation and renewal tracked per component, keeps them valid. Self-signed certificates left to expire, disabling TLS and ignoring vCenter all weaken or break trust.

2. Question 2VCF Architecture and Bring-up

   Which VCF component is the central point for lifecycle operations, workload domain creation and host inventory?

   1. AThe vSAN witness appliance, which stores the quorum and metadata that the cluster needs for its objects
   2. BA vCenter Server for an individual cluster, which manages only the ESXi hosts that belong to that cluster
   3. CSDDC Manager, which manages workload domains, the host inventory and lifecycle operations for the stack
   4. DAn NSX Edge node, which forwards traffic between virtual networks and the physical network in the rack
   Show answer and explanationHide answer

   Correct answer: C

   SDDC Manager is the central orchestrator for VCF, managing domains, inventory and lifecycle operations. A single cluster's vCenter, a vSAN witness and an NSX Edge each perform a narrower function.

3. Question 3Workload Domains and Lifecycle

   Which type of workload domain uses vSAN for its storage and is created through SDDC Manager on selected commissioned hosts?

   1. AA domain with no storage, using only external NFS datastores that are attached by hand to each host
   2. BA domain that runs only in the public cloud, outside the on-premises rack that SDDC Manager manages
   3. CA domain that uses the management domain's vCenter directly, with no separate inventory of any kind at all
   4. DA vSphere domain with vSAN, created by SDDC Manager from a selected set of commissioned hosts
   Show answer and explanationHide answer

   Correct answer: D

   A vSAN-backed workload domain is created by SDDC Manager from commissioned hosts. NFS-only storage, shared management vCenter and cloud-only domains are not the standard workload domain created this way.

4. Question 4Networking, Storage and Overlay

   Which network pool type carries vSAN storage traffic between hosts in a VCF workload domain?

   1. AThe vMotion pool, used only for moving running virtual machines between hosts in the same cluster
   2. BThe management pool, used only for administrator web access to vCenter and SDDC Manager
   3. CThe vSAN network pool, which provides the VMkernel network that carries vSAN storage traffic between hosts
   4. DThe VM management pool for guest connectivity, which is kept separate from vSAN storage traffic entirely
   Show answer and explanationHide answer

   Correct answer: C

   The vSAN network pool provides the VMkernel network for vSAN storage traffic. vMotion, management and VM pools carry other traffic types.

5. Question 5Operations, Security and Troubleshooting

   Which tool rotates and tracks service credentials for VCF components?

   1. AThe vSphere Client VM console, which shows the guest operating system password for each VM in the cluster
   2. BSDDC Manager password management, which rotates and tracks credentials for the components it manages
   3. CThe Cloud Builder parameter file, which stores the plaintext passwords of every component in the rack
   4. DA sticky note kept on the rack, which records the passwords for the hardware management controllers
   Show answer and explanationHide answer

   Correct answer: B

   SDDC Manager password management rotates and tracks component credentials. Console views, plaintext files and sticky notes do not manage credentials securely.