I85PREP
⌘ K
VPOL study materials
VPOL study resources

VPOL practice questions

One question at a time. Build your VPOL understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Technology and Infrastructure

In virtualization, what does a hypervisor do?

  1. It encrypts data at rest on the physical storage array
  2. It creates and runs virtual machines by allocating physical resources to guest operating systems Correct answer.
  3. It routes packets between virtual local area networks
  4. It compiles application source code into native machine instructions

Explanation

A hypervisor is the software layer that abstracts physical CPU, memory, and I/O resources and presents them to guest operating systems as virtual hardware. Type 1 hypervisors run directly on hardware, while Type 2 hypervisors run on a host operating system. Its core purpose is resource partitioning and isolation among virtual machines.

Question 2Technology and Infrastructure

Which cloud service model gives the customer the most control over the operating system and runtime?

  1. Platform as a Service
  2. Software as a Service
  3. Infrastructure as a Service Correct answer.
  4. Function as a Service

Explanation

In Infrastructure as a Service the provider supplies compute, storage, and networking, while the customer manages the operating system, middleware, and applications. PaaS and FaaS abstract the operating system away, and SaaS delivers a finished application. Greater customer management responsibility therefore means greater control.

Question 3Technology and Infrastructure

What is the primary purpose of a VLAN in a switched network?

  1. To convert IPv6 traffic into IPv4 traffic at the gateway
  2. To increase the electrical power available to edge switches
  3. To logically segment broadcast domains on shared physical infrastructure Correct answer.
  4. To provide redundant power supplies for core devices

Explanation

A VLAN groups switch ports into separate logical broadcast domains, so hosts on different VLANs do not receive each other's broadcast traffic even when they share the same physical switch. Traffic between VLANs must be routed. This segmentation improves security and limits broadcast scope.

Question 4Technology and Infrastructure

Which RAID level provides disk mirroring without parity?

  1. RAID 0
  2. RAID 6
  3. RAID 5
  4. RAID 1 Correct answer.

Explanation

RAID 1 writes identical data to two or more disks, so each disk holds a complete mirror of the data. There is no parity calculation, and the array can survive a single disk failure in a two-disk set. RAID 0 stripes without redundancy, and RAID 5 and 6 use distributed parity.

Question 5Technology and Infrastructure

What does the Domain Name System primarily do?

  1. It allocates dynamic IP addresses to clients
  2. It encrypts web traffic between browsers and servers
  3. It assigns MAC addresses to network interface cards
  4. It resolves human-readable host names into IP addresses Correct answer.

Explanation

DNS is a hierarchical, distributed database that maps names such as www.example.com to IP addresses and other records. Resolvers query authoritative servers to obtain these mappings. Address assignment and traffic encryption are handled by other protocols.

Question 6Technology and Infrastructure

Which characteristic distinguishes object storage from block storage?

  1. Object storage requires a directly attached physical disk
  2. Object storage presents a raw device that hosts format with a file system
  3. Object storage can only be accessed over Fibre Channel
  4. Object storage stores data as whole objects with metadata accessed by key Correct answer.

Explanation

Object storage manages data as discrete objects, each with a unique identifier and rich metadata, typically accessed through HTTP APIs. Block storage instead presents raw volumes that a host formats with its own file system. This difference drives the scalability and metadata richness of object stores.

Question 7Technology and Infrastructure

What is the role of a load balancer in an application architecture?

  1. It distributes incoming requests across multiple backend servers Correct answer.
  2. It stores session state permanently for all backend servers
  3. It compiles application code before deployment
  4. It replaces the need for a database tier

Explanation

A load balancer accepts client requests and forwards them to a pool of healthy backend servers according to an algorithm such as round robin or least connections. This improves availability and horizontal scalability. Health checks let it remove failed nodes from rotation.

Question 8Technology and Infrastructure

Which protocol is commonly used to securely administer a remote Linux server over an encrypted channel?

  1. Telnet
  2. FTP
  3. SSH Correct answer.
  4. SNMPv1

Explanation

SSH establishes an encrypted session for remote command execution and file transfer, typically on TCP port 22. It provides authentication and confidentiality that legacy remote shells lack. Telnet and FTP transmit credentials in cleartext.

Question 9Technology and Infrastructure

A company needs a disaster recovery design with a recovery point objective of near zero for a transactional database. Which approach best meets this requirement?

  1. Synchronous replication to a secondary site Correct answer.
  2. Manual export of tables to a spreadsheet each evening
  3. Nightly full backups shipped to offsite tape
  4. Weekly snapshot copies retained on the same array

Explanation

A near-zero RPO means almost no committed data may be lost, which requires continuous replication rather than periodic copies. Synchronous replication acknowledges a write only after the secondary site confirms it, so both sites hold identical data. Backup intervals of hours or days leave a large data-loss window.

Question 10Technology and Infrastructure

An administrator wants traffic for two VLANs to reach a router using a single physical link. Which configuration accomplishes this?

  1. Assign both VLANs to the same untagged access port
  2. Configure a trunk port carrying both VLAN tags to the router Correct answer.
  3. Enable port mirroring on the uplink
  4. Disable spanning tree on the uplink

Explanation

A trunk link carries frames for multiple VLANs by tagging them, typically with 802.1Q, so a router with subinterfaces can route between the VLANs over one cable. Access ports carry a single untagged VLAN. Trunking is the standard way to multiplex VLANs across shared uplinks.

Question 11Technology and Infrastructure

A team deploys an application as containers and needs automatic restart and scaling across a cluster of hosts. Which technology directly addresses this?

  1. A container orchestrator such as Kubernetes Correct answer.
  2. A single virtual machine with a cron job
  3. A hardware load balancer appliance only
  4. A shared network file system

Explanation

A container orchestrator schedules containers onto cluster nodes, restarts failed instances, and scales replicas according to declared desired state. It also handles service discovery and rolling updates. Standalone virtual machines and file systems do not provide this scheduling and self-healing behavior.

Question 12Technology and Infrastructure

What is the main benefit of infrastructure as code in a technology environment?

  1. It makes infrastructure changes repeatable and reviewable through versioned definitions Correct answer.
  2. It removes the requirement for testing environments
  3. It guarantees that applications have no software defects
  4. It eliminates the need for any version control system

Explanation

Infrastructure as code expresses environments in declarative or procedural definition files stored in version control. Changes become reviewable, reproducible, and auditable, reducing configuration drift. It does not remove the need for testing or version control; it depends on them.

Question 13Technology and Infrastructure

A web service must remain available if one availability zone fails. Which deployment pattern supports this?

  1. Deploy instances across at least two availability zones behind a load balancer Correct answer.
  2. Use one large instance instead of several smaller ones
  3. Rely on a single database server in one zone
  4. Deploy all instances in a single availability zone for lowest latency

Explanation

Spreading instances across independent availability zones means a zone failure removes only part of the capacity, and the load balancer routes traffic to the survivors. This is the standard high-availability pattern in cloud regions. Single-zone or single-instance designs share a common failure domain.

Question 14Technology and Infrastructure

Which statement accurately describes the difference between RTO and RPO?

  1. RTO applies only to networks, while RPO applies only to storage
  2. RTO measures acceptable data loss, while RPO measures acceptable downtime
  3. RTO and RPO both measure only backup storage capacity
  4. RTO measures acceptable downtime, while RPO measures acceptable data loss Correct answer.

Explanation

Recovery time objective defines how long a service may remain unavailable after a disruption. Recovery point objective defines how much data, measured in time, may be lost. Together they drive the choice of backup frequency and replication strategy.

Question 15Technology and Infrastructure

A DNS record must point a hostname to another hostname rather than to an IP address. Which record type is appropriate?

  1. PTR
  2. A
  3. CNAME Correct answer.
  4. MX

Explanation

A CNAME record aliases one name to another canonical name, and resolution continues by resolving the target. An A record maps a name directly to an IPv4 address. MX records designate mail servers, and PTR records support reverse lookups.

Question 16Technology and Infrastructure

What is the function of a subnet mask or prefix length?

  1. It encrypts payloads between subnets
  2. It determines the maximum cable length of a segment
  3. It identifies which portion of an IP address represents the network Correct answer.
  4. It specifies the default gateway's MAC address

Explanation

The mask or prefix length defines how many leading bits of an address belong to the network portion, leaving the remainder for host addressing. Devices use it to decide whether a destination is local or must be sent to a gateway. It has no role in encryption or physical cabling.

Question 17Technology and Infrastructure

Which practice most directly reduces the attack surface of internet-facing servers?

  1. Sharing a single administrator password among the team
  2. Disabling unused services and closing unnecessary ports Correct answer.
  3. Running every available service on default ports
  4. Granting all administrators full unrestricted access

Explanation

Each listening service is a potential entry point, so removing unneeded services and closing unused ports shrinks what an attacker can target. Combined with least-privilege access, this limits exposure. Default ports and shared credentials increase risk rather than reduce it.

Question 18Technology and Infrastructure

A monitoring system must detect a server that has stopped responding entirely. Which mechanism is designed for this?

  1. Log aggregation with full-text search
  2. Capacity trend forecasting
  3. Health checks that probe the host at regular intervals Correct answer.
  4. Configuration management drift reports

Explanation

Periodic health checks send probes and expect a timely response, so missed responses indicate an unresponsive host. This enables automated alerting and removal from load-balancer rotation. Log search, drift reports, and forecasting assume the host is still reporting data.

Question 19Technology and Infrastructure

Which factor most increases the blast radius of a failure in a distributed system?

  1. Tight coupling with shared single points of failure Correct answer.
  2. Redundant components in separate failure domains
  3. Strong isolation between components
  4. Regular failure injection testing

Explanation

When components depend on a shared resource with no redundancy, a failure in that resource propagates to every dependent service. Isolation, redundancy, and fault injection testing all reduce blast radius. Tight coupling concentrates risk rather than containing it.

Question 20Technology and Infrastructure

An organization must prove that only authorized changes reach production. Which control best provides this evidence?

  1. Verbal approval during a team meeting
  2. Disabling audit logging to improve performance
  3. Peer review with approval records on every change request Correct answer.
  4. Direct edits to production by any engineer

Explanation

Documented peer review with recorded approvals creates an auditable trail showing who authorized each change and what was reviewed. Meeting-based approvals and unreviewed direct edits leave no reliable evidence. Audit logging is essential to the evidence chain and should not be disabled.

Question 21Technology and Infrastructure

A service must tolerate the loss of an entire region while keeping data durable. Which design element is most critical?

  1. Increasing the size of the primary region's database
  2. Replicating data and compute to an independent region Correct answer.
  3. Relying on a single global administrator account
  4. Storing all backups on the same region's primary array

Explanation

Cross-region replication places copies of data and the ability to run workloads in a separate geographic failure domain. If the primary region becomes unavailable, the secondary can take over with its own durable copy. Same-region backups share the failure domain and cannot survive a regional outage.

Question 22Technology and Infrastructure

A team observes that a stateless web tier scales well, but the database tier becomes the bottleneck under load. Which approach best addresses the bottleneck?

  1. Introduce read replicas and caching for read-heavy queries Correct answer.
  2. Shorten the session timeout on the web tier
  3. Add more web servers to the stateless tier
  4. Increase the number of load balancers

Explanation

When reads dominate, offloading them to replicas and a cache reduces pressure on the primary database. Scaling the already-scalable web tier does not relieve the constrained tier. The bottleneck must be addressed where it occurs.

Question 23Technology and Infrastructure

An engineer must choose between a stateful firewall and a stateless packet filter for a security group protecting cloud instances. Which statement is accurate?

  1. Both types ignore the direction of traffic
  2. A stateful firewall tracks connection state and automatically allows return traffic Correct answer.
  3. A stateless filter tracks connection state and requires no return rules
  4. A stateful firewall cannot inspect TCP flags

Explanation

A stateful firewall records established connections, so replies to permitted outbound flows are allowed without explicit inbound rules. A stateless filter evaluates each packet independently and needs rules for both directions. Stateful inspection also understands TCP flags and session progress.

Question 24Technology and Infrastructure

A backup strategy uses full weekly backups plus daily incrementals, and a failure occurs on day four. What is required to restore?

  1. Only the most recent incremental backup
  2. Only the weekly full backup from the previous month
  3. Any single incremental backup chosen at random
  4. The latest full backup plus each incremental in sequence through day four Correct answer.

Explanation

Incremental backups capture only changes since the last backup of any type, so a restore needs the base full backup followed by every incremental in order. Missing any link in the chain produces an incomplete recovery. Differential backups would instead need only the full plus the latest differential.

Question 25Technology and Infrastructure

An organization wants to enforce least privilege for automated infrastructure pipelines. Which design best achieves this?

  1. Embed long-lived administrator credentials in pipeline scripts
  2. Grant permissions to all users in the organization
  3. Share one powerful service account across all pipelines
  4. Assign each pipeline a scoped role with only the permissions it needs Correct answer.

Explanation

A dedicated role scoped to the minimum permissions for each pipeline limits what a compromised pipeline can do. Short-lived credentials issued to that role further reduce exposure. Long-lived embedded admin credentials and shared accounts maximize the impact of any leak.

Question 26Technology and Infrastructure

Which type of storage presents data to a host as a hierarchy of files and directories managed by an operating system?

  1. File storage Correct answer.
  2. Block storage
  3. Ephemeral instance storage
  4. Object storage

Explanation

File storage exposes a shared filesystem hierarchy in which the operating system and applications open, read, and write named files within directories, with metadata and access permissions managed by the filesystem layer. Block storage instead presents raw fixed-size blocks, and object storage addresses opaque objects through an API using keys rather than a directory tree.

Question 27Technology and Infrastructure

Which statement best describes the purpose of a content delivery network (CDN)?

  1. It load balances requests across application servers in a single data center
  2. It replaces the origin server by storing the authoritative copy of all data
  3. It caches content at edge locations close to users to reduce latency and origin load Correct answer.
  4. It encrypts all traffic between the user and the origin server

Explanation

A CDN distributes copies of cacheable content to edge points of presence geographically near end users, so requests are served with lower latency and the origin server handles fewer requests. It does not replace the authoritative data store, and encryption is provided by TLS rather than by the CDN's caching function.

Question 28Technology and Infrastructure

In a virtual private cloud, what is the primary function of a route table?

  1. It lists which users are permitted to log in to each instance
  2. It stores the TLS certificates used by the load balancer
  3. It records every API call made against the cloud account
  4. It defines which network destination traffic is forwarded to which target Correct answer.

Explanation

A route table contains entries that map destination CIDR ranges to targets such as an internet gateway, a NAT device, or a peering connection, and the most specific matching route determines where a packet is sent. Without a matching route, traffic cannot leave the subnet toward that destination.

Question 29Technology and Infrastructure

Which mechanism allows a private subnet's instances to download software updates from the internet without being directly reachable from the internet?

  1. A NAT gateway placed in a public subnet Correct answer.
  2. An internet gateway attached directly to the private subnet
  3. A public IP address assigned to each private instance
  4. A security group rule allowing inbound traffic from all addresses

Explanation

A NAT gateway performs source network address translation for outbound traffic originating in private subnets, so responses return to the gateway and are forwarded back to the instance. Because the translation is initiated from inside, no inbound path to the private instance is created.

Question 30Technology and Infrastructure

An application writes session state to a local disk on each web server. Users are randomly routed across several servers and frequently lose their sessions. Which change best resolves this while preserving horizontal scalability?

  1. Increase the disk size on every web server
  2. Reduce the number of web servers behind the load balancer
  3. Move session state to a shared external store such as a distributed cache or database Correct answer.
  4. Enable sticky sessions so each user is pinned to one server indefinitely

Explanation

Storing session state in a shared external store decouples it from any individual server, so any server can handle a subsequent request and servers can be added or replaced freely. Sticky sessions merely hide the problem and break when a pinned server fails or is scaled in.

Question 31Technology and Infrastructure

A team needs a managed message queue to decouple a producer from a slow consumer and to absorb bursts of traffic. Which design element is most important for preventing message loss during consumer outages?

  1. Synchronous calls from producer to consumer instead of queuing
  2. In-memory buffering with automatic eviction of old messages
  3. A shorter visibility timeout than the consumer's processing time
  4. Durable message persistence with acknowledgement-based deletion Correct answer.

Explanation

Durable persistence keeps messages on reliable storage until a consumer acknowledges successful processing, so an outage delays delivery rather than destroying data. Acknowledgement-based deletion ensures a message is removed only after it has actually been handled.

Question 32Technology and Infrastructure

An engineer must give an application running on an instance access to a cloud object storage bucket without embedding long-lived credentials in code. Which approach is most appropriate?

  1. Store a static access key in an environment variable on the instance
  2. Attach an instance role so the platform issues short-lived credentials automatically Correct answer.
  3. Commit the credentials to the application's source repository
  4. Create a shared user account whose password is rotated annually

Explanation

An instance role lets the platform deliver temporary credentials to the workload through a metadata service, and those credentials rotate automatically, eliminating secrets in code. Access is then governed by the permissions attached to the role rather than by a stored key.

Question 33Technology and Infrastructure

A company wants a single sign-on experience where users authenticate against an external identity provider and applications receive signed assertions about the user. Which standard is designed for this?

  1. SAML Correct answer.
  2. SNMP
  3. NTP
  4. SMTP

Explanation

SAML is an XML-based federation standard in which an identity provider authenticates the user and issues a signed assertion that a service provider accepts, enabling single sign-on across organizations. The other protocols serve network management, mail transfer, and time synchronization respectively.

Question 34Technology and Infrastructure

A web application must serve traffic over HTTPS with a certificate that browsers trust, and the team wants the certificate renewed without manual intervention. Which combination achieves this?

  1. Plain HTTP with application-level password protection
  2. A self-signed certificate installed manually on each server
  3. A certificate issued by a public certificate authority with automated renewal and deployment Correct answer.
  4. A certificate with a ten-year validity period copied to servers by hand

Explanation

Browsers trust certificates chained to a recognized public certificate authority, and automation that renews and redeploys the certificate before expiry avoids outages caused by expiration. Self-signed certificates trigger browser warnings because no trusted third party vouches for them.

Question 35Technology and Infrastructure

An operations team wants to detect a gradual increase in memory usage on application servers before it causes an outage. Which monitoring approach is most suitable?

  1. Collecting time-series metrics and alerting on sustained trends or thresholds Correct answer.
  2. Reviewing server logs only after a crash has occurred
  3. Relying on users to report slowdowns through support tickets
  4. Running a synthetic login test once per quarter

Explanation

Time-series metrics capture resource usage continuously, allowing trend analysis and threshold or rate-based alerts that fire while the problem is developing. Reactive signals such as tickets or post-crash logs arrive after users are already affected.

Question 36Technology and Infrastructure

A team wants to run a database that requires low-latency access to storage and consistent IOPS for a transactional workload. Which storage characteristic matters most in this selection?

  1. Compression ratio of archived log files
  2. Provisioned IOPS and consistent latency on block volumes Correct answer.
  3. Unlimited directory depth in a shared file system
  4. Eventual consistency of object keys across regions

Explanation

Transactional databases depend on predictable input/output operations per second and low, stable latency, which provisioned block volumes are designed to deliver. Object key consistency, directory depth, and archive compression do not govern the runtime I/O behavior a database needs.

Question 37Technology and Infrastructure

An architect is designing a multi-tier application and must decide where to terminate TLS. Which consideration most strongly favors terminating TLS at the load balancer rather than at each backend server?

  1. Centralized certificate management and offloading cryptographic work from backends Correct answer.
  2. Guaranteeing that backend responses cannot be modified in transit
  3. Eliminating the need for any encryption on the internal network
  4. Removing the requirement for authentication between tiers

Explanation

Terminating TLS at the load balancer concentrates certificate issuance, renewal, and cipher policy in one place and frees backend servers from handshake processing. It does not, by itself, secure traffic between the balancer and the backends, which may still warrant encryption.

Question 38Technology and Infrastructure

A company runs workloads in two regions and wants reads to be served locally in each region while tolerating the loss of one region. Which data design element is most critical?

  1. Asynchronous cross-region replication with a defined failover promotion procedure Correct answer.
  2. Manual copying of database files by operators during an incident
  3. A single-region primary with all reads routed across the public internet
  4. Nightly full backups stored only in the primary region

Explanation

Cross-region replication keeps a second copy of the data current enough to serve reads locally and to be promoted if the primary region is lost, and a documented promotion procedure makes that failover reliable. Backups confined to the primary region disappear with it.

Question 39Technology and Infrastructure

A pipeline deploys infrastructure changes automatically. An auditor asks how the organization can show that a change was reviewed and that the deployed state matches the approved source. Which pair of controls best satisfies this?

  1. Weekly verbal sign-off from the team lead plus manual console edits
  2. A shared administrator account used by all engineers plus screenshots of the console
  3. Disabling version control for speed and relying on change advisory meetings
  4. Mandatory peer approval on merge requests plus drift detection comparing live state to the declared configuration Correct answer.

Explanation

Peer approval recorded on the merge request creates durable evidence that a change was reviewed before deployment, while drift detection continuously compares actual infrastructure against the declared configuration to reveal unauthorized or accidental divergence. Together they tie production state back to an approved source of truth.

Question 40Technology and Infrastructure

A service experiences cascading failures when one downstream dependency becomes slow rather than unavailable. Which resilience pattern most directly prevents the caller from exhausting its own resources while waiting?

  1. Unlimited retries with no backoff between attempts
  2. A timeout combined with a circuit breaker that fails fast after repeated errors Correct answer.
  3. Removing health checks so slow instances remain in rotation
  4. Increasing the connection pool size without bound

Explanation

Timeouts bound how long a caller waits, and a circuit breaker stops sending requests to a failing dependency after a threshold, returning errors quickly so the caller's threads and connections are not consumed. Together they contain the slowdown instead of letting it propagate.

Question 41Architecture and Design

In a virtualized data center, which layer abstracts physical hardware so multiple virtual machines can share the same physical host?

  1. The storage area network
  2. The hypervisor Correct answer.
  3. The virtual switch
  4. The guest operating system

Explanation

A hypervisor is the software layer that runs directly on or above the host hardware and allocates CPU, memory, and I/O to guest virtual machines. It enforces isolation between guests and schedules their access to shared physical resources. The other components consume virtualized resources rather than create them.

Question 42Architecture and Design

An administrator needs a Type 1 hypervisor deployment. Which characteristic distinguishes it from a Type 2 hypervisor?

  1. It runs directly on the host hardware without an intervening general-purpose OS Correct answer.
  2. It requires a desktop operating system to host the virtualization software
  3. It depends on paravirtualized drivers for every guest
  4. It can only virtualize network functions, not compute

Explanation

Type 1 hypervisors, sometimes called bare-metal hypervisors, install directly on the server hardware and manage guest VMs without a host operating system underneath. Type 2 hypervisors run as applications on top of a conventional OS. This architectural placement is the defining difference between the two categories.

Question 43Architecture and Design

A design team wants VMs on the same host to communicate without traffic leaving the physical server. Which virtual networking construct should they use?

  1. A routed uplink to the core switch
  2. A virtual switch with an internal-only port group Correct answer.
  3. A WAN optimization appliance
  4. A dedicated physical NIC per VM

Explanation

A virtual switch provides Layer 2 connectivity between virtual NICs, and an internal-only port group keeps that traffic local to the host. Because frames never traverse a physical uplink, the traffic stays inside the hypervisor. External routing and physical adapters are unnecessary for host-local VM-to-VM communication.

Question 44Architecture and Design

Which storage design presents a single logical volume to multiple hosts while allowing concurrent read and write access managed by a cluster-aware file system?

  1. A locally attached JBOD
  2. A read-only ISO repository
  3. A raw device mapping used by one VM
  4. A shared clustered volume Correct answer.

Explanation

A shared clustered volume is formatted with a cluster-aware file system or fronted by a lock manager so several hosts can safely read and write the same logical unit. The coordination layer prevents conflicting writes that would corrupt data. Single-host and read-only designs do not provide concurrent multi-host write access.

Question 45Architecture and Design

What is the primary purpose of a resource pool in a virtual infrastructure?

  1. To isolate management traffic onto a separate VLAN
  2. To convert thick-provisioned disks into thin-provisioned disks
  3. To replicate VM disks to a secondary site
  4. To aggregate compute capacity and apply hierarchical allocation limits to groups of VMs Correct answer.

Explanation

A resource pool groups the CPU and memory of its parent host or cluster and distributes that capacity among member VMs according to shares, reservations, and limits. Nested pools let administrators build a hierarchy of entitlements. Storage replication and network segmentation are unrelated functions.

Question 46Architecture and Design

Which characteristic is a defining benefit of a distributed virtual switch compared with standard virtual switches configured per host?

  1. Elimination of the need for physical uplinks
  2. Removal of VLAN tagging from the network design
  3. Automatic encryption of all guest traffic
  4. A consistent configuration managed centrally across many hosts Correct answer.

Explanation

A distributed virtual switch centralizes port group and policy configuration so that settings apply uniformly across all member hosts. This reduces configuration drift and simplifies change management in large clusters. It does not remove physical uplinks, encrypt traffic by itself, or eliminate VLANs.

Question 47Architecture and Design

In a highly available cluster, what does an admission control policy do?

  1. Reserves capacity so remaining hosts can restart VMs if a host fails Correct answer.
  2. Encrypts inter-host heartbeat traffic
  3. Assigns MAC addresses to virtual NICs
  4. Balances storage I/O across datastores

Explanation

Admission control calculates whether the cluster retains enough unreserved CPU and memory to restart VMs from a failed host. It blocks power-on operations that would violate that reserved capacity. Encryption, storage balancing, and MAC assignment are separate mechanisms.

Question 48Architecture and Design

Why is it important to size the management network separately from the virtual machine data network in a design?

  1. To allow VMs to use jumbo frames while management uses standard frames
  2. To reduce the number of physical NICs required on each host
  3. To prevent VM workloads from consuming the bandwidth and availability needed for control-plane operations Correct answer.
  4. To eliminate the need for a distributed switch

Explanation

Management traffic carries control-plane operations such as host communication, orchestration, and monitoring. Separating it from guest data traffic protects those operations from workload congestion and faults. The separation is a resilience and performance decision, not a way to reduce NIC count.

Question 49Architecture and Design

A VM is configured with a 60 GB virtual disk on a datastore with 100 GB free. The guest writes 40 GB of data. How much space does a thin-provisioned disk consume on the datastore, assuming no snapshots?

  1. About 60 GB
  2. About 100 GB
  3. About 40 GB Correct answer.
  4. About 20 GB

Explanation

Thin provisioning allocates datastore blocks only as the guest writes data, so a 60 GB disk holding 40 GB of data consumes roughly 40 GB. The remaining capacity is reserved logically but not physically allocated. Thick provisioning would instead commit the full 60 GB up front.

Question 50Architecture and Design

A design requires that a VM continue running on a surviving host if its current host loses power, without manual intervention. Which capability must be configured?

  1. Network I/O control on the uplink port group
  2. Storage I/O control on the datastore
  3. Cluster high availability with host monitoring enabled Correct answer.
  4. Distributed resource scheduling in manual mode

Explanation

Cluster high availability monitors hosts and restarts affected VMs on surviving hosts when a failure is detected. Enabling host monitoring activates the heartbeat mechanism that triggers the restart. DRS and I/O control features optimize placement or throughput but do not restart VMs after host loss.