CertArea
All VMware by Broadcom exams

Free VMware Certified Professional - VMware Cloud Foundation Administrator practice test: 30 questions with answers

30 original questions for VMware Certified Professional - VMware Cloud Foundation Administrator, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
112 questions
Real exam
60 questions, 135 min
Passing score
300

VMware Certified Professional - VMware Cloud Foundation Administrator exam guide: topics, cost and format

All 30 VMware Certified Professional - VMware Cloud Foundation Administrator questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Operations, Security and Troubleshooting (8 questions)

  1. Question 1

    Which VCF task keeps certificates valid across the SDDC components?

    1. AUsing self-signed certificates on every component until they expire, with no renewal planned in advance
    2. BTurning off TLS on the management components to avoid the work involved in certificate renewal
    3. CManaging certificates through SDDC Manager, with rotation and renewal tracked for each component
    4. DInstalling a single wildcard certificate by hand on each host and ignoring the vCenter servers entirely
    Show answer and explanation
    Correct answer: C

    Managing certificates through SDDC Manager, with rotation and renewal tracked per component, keeps them valid. Self-signed certificates left to expire, disabling TLS and ignoring vCenter all weaken or break trust.

  2. Question 2

    Which tool rotates and tracks service credentials for VCF components?

    1. AThe vSphere Client VM console, which shows the guest operating system password for each VM in the cluster
    2. BSDDC Manager password management, which rotates and tracks credentials for the components it manages
    3. CThe Cloud Builder parameter file, which stores the plaintext passwords of every component in the rack
    4. DA sticky note kept on the rack, which records the passwords for the hardware management controllers
    Show answer and explanation
    Correct answer: B

    SDDC Manager password management rotates and tracks component credentials. Console views, plaintext files and sticky notes do not manage credentials securely.

  3. Question 3

    Which tool helps monitor health and capacity across a VCF environment?

    1. AThe Cloud Builder bring-up log, which is written only once during the initial deployment of the environment
    2. BVCF Operations, formerly Aria Operations, which provides metrics, alerts and capacity analysis across the stack
    3. CThe host's serial console, which shows boot messages and nothing about the health of the environment
    4. DThe vCenter recent tasks list, which shows only tasks run on that vCenter in the last hour of activity
    Show answer and explanation
    Correct answer: B

    VCF Operations provides metrics, alerts and capacity analysis across the stack. The bring-up log, recent tasks and serial console are limited in scope or purpose.

  4. Question 4

    A workload domain shows degraded vSAN health after a host failure. What is the most appropriate first step?

    1. APowering off all the virtual machines in the domain before reviewing the vSAN health checks in the client
    2. BDeleting the vSAN datastore and recreating it, which clears any health warnings from the environment at once
    3. CRemoving the failed host from the cluster without first checking whether any data needs to be rebuilt
    4. DReviewing the vSAN health checks and the resync status, to determine whether the data is still protected
    Show answer and explanation
    Correct answer: D

    Reviewing vSAN health and resync status establishes whether data is still protected before any action. Deleting the datastore, removing the host unchecked and powering off all VMs risk data loss or unnecessary outages.

  5. Question 5

    Which backup practice applies to VCF management components?

    1. ABacking up SDDC Manager and vCenter configurations regularly, and testing their restoration on a schedule
    2. BBacking up only the workload virtual machines, since the management components can easily be rebuilt from scratch
    3. CTaking a snapshot of SDDC Manager once and keeping it permanently as the only copy of its configuration
    4. DRelying on the bring-up parameter file as a complete backup of all the runtime changes made since deployment
    Show answer and explanation
    Correct answer: A

    Regular backups of SDDC Manager and vCenter configurations, with tested restores, protect the management plane. Backing up only workloads, a single permanent snapshot and the bring-up file all miss runtime changes.

  6. Question 6

    Which role-based access approach fits VCF operations?

    1. AGiving every administrator the Administrator role on every component, to avoid delays in permissions
    2. BAssigning least-privilege roles per component, with audited access for administrative actions performed
    3. CSharing one root account among the operations team, so that all actions are logged under one name
    4. DDisabling authentication on the management network, so that tools can reach components without credentials
    Show answer and explanation
    Correct answer: B

    Least-privilege roles per component with audited administrative access fit VCF operations. Universal administrator roles, shared root accounts and disabled authentication remove accountability and protection.

  7. Question 7

    Which TWO are good troubleshooting practices for VCF? (Choose two.)

    1. AChanging several settings at once and testing afterwards, so that the team saves time on each change
    2. BCollecting logs from SDDC Manager and the affected components before changing anything in the environment
    3. CRestarting every component in the environment before reading any logs or alerts that have been raised
    4. DIgnoring alerts that are older than a day, because they are unlikely to still be relevant to the current issue
    5. EComparing the current configuration with the last known good state or a recorded baseline for the environment
    Show answer and explanation
    Correct answer: B, E

    Collecting logs before changing anything preserves evidence, and comparing against a known good baseline isolates what changed. Changing many settings at once, restarting blindly and ignoring alerts all obscure the cause.

  8. Question 8

    Which approach ensures that certificates are trusted by the clients and components that use them?

    1. ALeaving every component on its default self-signed certificate, which the browsers always trust by design
    2. BDisabling certificate checks in each client, so that untrusted certificates are accepted by default in use
    3. CUsing the same certificate on every host, with a random name that matches none of the hosts it is deployed to
    4. DInstalling the trusted certificate authority's chain on the clients, with certificate names that match the hosts
    Show answer and explanation
    Correct answer: D

    Installing the trusted CA chain on clients and using names that match the hosts makes certificates trusted. Default self-signed certificates, disabled checks and mismatched shared certificates each break trust.

VCF Architecture and Bring-up (8 questions)

  1. Question 9

    Which VCF component is the central point for lifecycle operations, workload domain creation and host inventory?

    1. AThe vSAN witness appliance, which stores the quorum and metadata that the cluster needs for its objects
    2. BA vCenter Server for an individual cluster, which manages only the ESXi hosts that belong to that cluster
    3. CSDDC Manager, which manages workload domains, the host inventory and lifecycle operations for the stack
    4. DAn NSX Edge node, which forwards traffic between virtual networks and the physical network in the rack
    Show answer and explanation
    Correct answer: C

    SDDC Manager is the central orchestrator for VCF, managing domains, inventory and lifecycle operations. A single cluster's vCenter, a vSAN witness and an NSX Edge each perform a narrower function.

  2. Question 10

    What is the management domain in a VCF deployment?

    1. AThe first domain deployed during bring-up, hosting the components that manage the software-defined data centre
    2. BA workload domain created by a tenant for its own applications, after bring-up has been completed fully
    3. CA network segment used only for vMotion traffic between the hosts that make up a cluster in the rack
    4. DA vSAN datastore used for backups of the virtual machines that run on the hosts of the domain
    Show answer and explanation
    Correct answer: A

    The management domain is the first domain deployed during bring-up and hosts the components that manage the SDDC. Tenant workload domains, vMotion segments and backup datastores are different concepts.

  3. Question 11

    Which tool performs the initial deployment of a VCF management domain from a prepared set of hosts?

    1. AThe vSphere Client, which is used to add a host to an existing cluster in the vCenter inventory
    2. BAria Operations, which is used to collect metrics from the hosts after they have been placed in production
    3. CLifecycle Manager, which applies patches to hosts that are already part of a running workload domain
    4. DCloud Builder, which validates the environment and deploys the management domain from the parameter file
    Show answer and explanation
    Correct answer: D

    Cloud Builder validates the environment and deploys the management domain using the parameter file. The vSphere Client, Aria Operations and Lifecycle Manager operate on hosts after the initial deployment.

  4. Question 12

    Which prerequisite must be in place before bring-up so that management components can resolve names and keep accurate time?

    1. AForward and reverse DNS records, with NTP sources reachable by all of the management components
    2. BA vMotion network with jumbo frames configured on the physical switches of the rack and nothing else
    3. CSufficient storage on a local SD card in each host to hold all of the management virtual machines' disks
    4. DA GPU driver installed on each host in the rack, which the management virtual machines require to start up
    Show answer and explanation
    Correct answer: A

    Forward and reverse DNS records and reachable NTP sources are prerequisites for the management components to resolve each other and keep time. GPU drivers, vMotion jumbo frames and SD card storage are not the basis of bring-up prerequisites.

  5. Question 13

    Which element in SDDC Manager records physical hosts before they are assigned to a workload domain?

    1. AThe vSAN storage policy that is assigned to each virtual machine when it is placed on the host
    2. BThe vCenter alarm definitions for each host, which list the thresholds that trigger the host alerts
    3. CThe NSX segment profile that is applied to the virtual machines that will later run on the hosts
    4. DThe host commissioning inventory, where hosts are validated and commissioned before they are used
    Show answer and explanation
    Correct answer: D

    The host commissioning inventory is where hosts are validated and commissioned before assignment to a domain. Alarm definitions, segment profiles and storage policies apply to running objects, not to pre-assignment host records.

  6. Question 14

    Which TWO are benefits of VCF's bundle-based lifecycle management through SDDC Manager? (Choose two.)

    1. AEach component must be patched by hand on each host, which keeps the changes visible to administrators
    2. BCoordinated, bundle-based updates across the stack, validated for compatibility before they are applied
    3. CLifecycle operations run independently of the bundle compatibility matrix for each of the components involved
    4. DUpdates can be scheduled and tracked centrally, with prechecks run before each upgrade is started
    5. EThe stack cannot be upgraded without first removing all workload domains from the environment entirely
    Show answer and explanation
    Correct answer: B, D

    Coordinated, validated bundles and centrally scheduled updates with prechecks are core benefits of SDDC Manager lifecycle. Manual patching, ignoring the compatibility matrix and removing all domains first are not how VCF lifecycle works.

  7. Question 15

    Which TWO are valid reasons to add a second workload domain to a VCF environment? (Choose two.)

    1. ATo separate workloads that have different lifecycle, security or performance requirements
    2. BTo store the management virtual machines on a workload domain's datastore, to free the management cluster
    3. CTo isolate a set of applications with its own vCenter, NSX and vSAN resources within the environment
    4. DTo replace the need for a management domain in a VCF deployment altogether over the longer term
    5. ETo increase the number of ESXi versions that are allowed to run on the management domain's hosts
    Show answer and explanation
    Correct answer: A, C

    Separating workloads by lifecycle, security or performance needs, and isolating them with their own resources, are valid reasons for a workload domain. Moving management VMs into a workload domain, replacing the management domain and mixing ESXi versions are not valid reasons.

  8. Question 16

    Which component stores the inventory, domains and configuration state that SDDC Manager manages?

    1. AThe NSX Manager routing table, which lists the next hop for each overlay segment in the environment
    2. BThe vSphere host cache on each ESXi host, which stores only the last boot configuration of that host
    3. CThe vSAN object store on each cluster, which holds the data blocks of the virtual machines that run there
    4. DThe SDDC Manager database, which records the inventory, the domains and their configuration state
    Show answer and explanation
    Correct answer: D

    The SDDC Manager database holds the inventory, domains and configuration state that the platform manages. The host cache, vSAN object store and NSX routing table hold other kinds of data.

Workload Domains and Lifecycle (7 questions)

  1. Question 17

    Which type of workload domain uses vSAN for its storage and is created through SDDC Manager on selected commissioned hosts?

    1. AA domain with no storage, using only external NFS datastores that are attached by hand to each host
    2. BA domain that runs only in the public cloud, outside the on-premises rack that SDDC Manager manages
    3. CA domain that uses the management domain's vCenter directly, with no separate inventory of any kind at all
    4. DA vSphere domain with vSAN, created by SDDC Manager from a selected set of commissioned hosts
    Show answer and explanation
    Correct answer: D

    A vSAN-backed workload domain is created by SDDC Manager from commissioned hosts. NFS-only storage, shared management vCenter and cloud-only domains are not the standard workload domain created this way.

  2. Question 18

    Which action adds capacity to an existing workload domain through SDDC Manager?

    1. ACommissioning the new hosts, then adding them to the domain's cluster through SDDC Manager
    2. BEditing the vCenter inventory directly to add a host to the cluster without commissioning it first
    3. CDeleting the domain and recreating it with more hosts, which removes the existing virtual machines first
    4. DIncreasing the vCPU count on each virtual machine in the domain, so that the spare capacity is used
    Show answer and explanation
    Correct answer: A

    Commissioning new hosts and adding them to the domain's cluster through SDDC Manager keeps inventory and validation consistent. Recreating the domain, bypassing commissioning and resizing VMs do not add host capacity correctly.

  3. Question 19

    Why must hosts be commissioned before they are used in VCF?

    1. ASo that SDDC Manager validates and records the host's configuration against the network and storage pools
    2. BSo that they can be used as network switches for the physical rack in the data centre environment
    3. CSo that the host is removed from the inventory of the management cluster for the duration of the project
    4. DSo that their hardware serial numbers are written into the marketing materials prepared for the project
    Show answer and explanation
    Correct answer: A

    Commissioning lets SDDC Manager validate the host's configuration against the network and storage pools and record it in inventory. The other options describe purposes that commissioning does not serve.

  4. Question 20

    Which VCF capability checks compatibility before an update is applied to the environment?

    1. AA manual reading of each release note by the on-call engineer, after the update has already finished
    2. BA precheck of the bundle against the inventory, run before the upgrade is started
    3. CA visual inspection of the rack by the facilities team each time an update is planned in the calendar
    4. DA ping test of the vCenter appliance from a laptop on the management network before the update begins
    Show answer and explanation
    Correct answer: B

    A precheck of the bundle against the inventory validates compatibility before the upgrade runs. Post-update reading, rack inspection and ping tests do not check compatibility beforehand.

  5. Question 21

    Which concept describes a set of compatible component versions released together for VCF updates?

    1. AA snapshot of the virtual machines taken before any change is applied to the environment during an update
    2. BA bundle, which contains the compatible versions of the components used in an update of the stack
    3. CA datastore cluster that groups storage for the management virtual machines by their performance level
    4. DA resource pool that reserves CPU and memory for the virtual machines of a workload domain in advance
    Show answer and explanation
    Correct answer: B

    A bundle contains the compatible component versions released together for an update. Snapshots, datastore clusters and resource pools are different concepts.

  6. Question 22

    What must be true before a workload domain can be removed through SDDC Manager?

    1. AThe domain's hosts must be physically disconnected from the rack before SDDC Manager is contacted at all
    2. BThe domain's vCenter must be deleted by hand first, before SDDC Manager is able to see the domain
    3. CThe domain's workloads must be migrated or powered off, and its resources released back to the pool
    4. DThe management domain must be shut down first, since it hosts the controller that is needed for every domain
    Show answer and explanation
    Correct answer: C

    The workloads must be migrated or powered off and the resources released before SDDC Manager can remove the domain safely. Disconnecting hosts first, deleting vCenter by hand and shutting down the management domain are not the required steps.

  7. Question 23

    Which TWO are benefits of running separate workload domains? (Choose two.)

    1. AEach domain shares a single vCenter with every other domain, so that there is no separation at all
    2. BShared storage policies are forced on all domains, which removes any choice of storage per workload
    3. CIndependent lifecycle and maintenance windows per domain, which limits the impact of change
    4. DMandatory identical hardware in every domain, so that capacity planning is uniform across them all
    5. EFailure isolation between domains, so that a problem in one does not directly disrupt the others
    Show answer and explanation
    Correct answer: C, E

    Independent maintenance windows and failure isolation are the benefits of separate domains. A shared vCenter, forced storage policy and identical hardware remove the separation that domains exist to provide.

Networking, Storage and Overlay (7 questions)

  1. Question 24

    Which network pool type carries vSAN storage traffic between hosts in a VCF workload domain?

    1. AThe vMotion pool, used only for moving running virtual machines between hosts in the same cluster
    2. BThe management pool, used only for administrator web access to vCenter and SDDC Manager
    3. CThe vSAN network pool, which provides the VMkernel network that carries vSAN storage traffic between hosts
    4. DThe VM management pool for guest connectivity, which is kept separate from vSAN storage traffic entirely
    Show answer and explanation
    Correct answer: C

    The vSAN network pool provides the VMkernel network for vSAN storage traffic. vMotion, management and VM pools carry other traffic types.

  2. Question 25

    Which NSX capability provides the overlay networks that VCF workloads commonly use?

    1. ANSX segments on an overlay transport zone, which carry workload traffic between hosts over the overlay
    2. BA physical VLAN trunk configured by hand on each ESXi host's uplink, with no logical segments defined at all
    3. CvSAN storage policies that assign each virtual machine a fault tolerance level and a disk layout
    4. DThe Cloud Builder appliance, which is used for monitoring the health of the overlay tunnels between hosts
    Show answer and explanation
    Correct answer: A

    NSX segments on an overlay transport zone provide the logical networks that carry workload traffic. Manual VLAN trunks lack logical segments, storage policies handle storage, and Cloud Builder is used for deployment.

  3. Question 26

    Which storage policy setting controls how many failures a vSAN object is able to tolerate?

    1. AThe number of vCPUs allocated to the virtual machine's guest operating system in the vSphere client
    2. BThe name of the datastore cluster that the virtual machine was originally placed in during deployment
    3. CThe virtual machine's memory reservation in the resource settings shown in the vSphere client
    4. DThe failures to tolerate (FTT) rule in the vSAN storage policy assigned to the object
    Show answer and explanation
    Correct answer: D

    The failures to tolerate rule in the vSAN storage policy sets how many failures an object tolerates. vCPUs, memory reservations and datastore names do not control fault tolerance.

  4. Question 27

    A new host must use a vMotion VLAN in a workload domain. Which step ensures the host's VMkernel uses the correct network?

    1. ASetting the host's DNS search domain to the vMotion network's name, which assigns it to the VLAN
    2. BAdding the host to the Active Directory group that controls vMotion permissions for the users
    3. CAssigning the host's network to the correct network pool, so that its VMkernel addresses match the design
    4. DDisabling the vMotion network entirely, so that the new host stays isolated during commissioning for safety
    Show answer and explanation
    Correct answer: C

    Assigning the host to the correct network pool makes its VMkernel addresses match the network design for vMotion. DNS search domains do not assign VLANs, directory groups do not configure networks, and disabling vMotion removes the required function.

  5. Question 28

    Which element must be enabled on a cluster before it can use vSAN storage?

    1. AvSphere Replication, which copies virtual machine disks to a secondary site on a regular schedule
    2. BvSAN itself, enabled on the cluster with a disk claim on each host that contributes storage to it
    3. CThe vSphere DRS automation level, which moves virtual machines between hosts when the load changes over time
    4. DvSphere HA admission control, which reserves capacity in the cluster for host failures that might occur
    Show answer and explanation
    Correct answer: B

    vSAN must be enabled on the cluster, with disks claimed on each contributing host. Replication, HA admission control and DRS automation are separate features.

  6. Question 29

    Which statement about VCF overlay networking is correct?

    1. AOverlay networks cannot carry traffic between virtual machines on different hosts in the environment at all
    2. BOverlay networks require a separate physical switch for each segment that the administrator creates in NSX
    3. COverlay segments can span hosts without needing a separate VLAN for each segment on the physical network
    4. DOverlay segments are usable only on the management domain and not on any of the workload domains created
    Show answer and explanation
    Correct answer: C

    Overlay segments span hosts without requiring a physical VLAN per segment, which is the purpose of overlays. The other statements are incorrect about switches, host-to-host traffic and domain usage.

  7. Question 30

    Which TWO are valid storage considerations for a VCF workload domain? (Choose two.)

    1. AUsing vSAN or supported external storage that matches the domain's performance and capacity needs
    2. BPutting the vCenter database on the same unprotected disk as the workload data, to gain speed
    3. CAssuming unlimited capacity, so that capacity planning is not needed for the workload domain at all
    4. DPlanning capacity and fault tolerance against the storage policy and the failure scenarios to be covered
    5. EMixing incompatible disk types in a vSAN cluster without checking the hardware compatibility list first
    Show answer and explanation
    Correct answer: A, D

    Matching storage to performance and capacity needs, and planning capacity and fault tolerance against the policy and failure scenarios, are valid considerations. Unprotected database disks, unlimited capacity assumptions and unchecked mixed disks all create risk.