First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.
Continue in the practice tool above to load more questions, 50 at a time.
Question 1NSX Architecture and Components
In a production NSX-T deployment, how many NSX Manager nodes are recommended in a cluster to provide high availability?
- 1
- 2
- 5
- 3 Correct answer.
Explanation
An NSX Manager cluster uses a three-node configuration so that the management plane and central control plane retain quorum if a single node fails. One node is supported only for lab or standalone deployments. Two nodes cannot maintain majority quorum, and five nodes are not a supported cluster size.
Question 2NSX Architecture and Components
Which NSX-T component is responsible for the management plane?
- Tier-0 gateway
- NSX Manager Correct answer.
- Host transport node
- NSX Edge node
Explanation
The NSX Manager cluster hosts the management plane, which stores desired-state configuration and exposes the UI and API. Edge nodes and host transport nodes are data plane elements. Tier-0 gateways are logical routing constructs realized on transport nodes.
Question 3NSX Architecture and Components
What is the primary role of an NSX Edge node in an NSX-T topology?
- Performs Layer 2 bridging for segments
- Stores the desired-state configuration
- Hosts the distributed firewall
- Provides centralized gateway services Correct answer.
Explanation
Edge nodes run centralized services such as tier-0/tier-1 service routers, NAT, and load balancing, giving workloads north-south connectivity. The desired-state configuration lives on the NSX Manager cluster. The distributed firewall runs in the kernel of host transport nodes.
Question 4NSX Architecture and Components
Which transport zone types are available in NSX-T?
- Overlay and underlay
- Edge and host
- Overlay and VLAN Correct answer.
- VLAN and VXLAN
Explanation
NSX-T defines overlay transport zones, which carry GENEVE-encapsulated segments, and VLAN transport zones, which carry VLAN-backed segments and are used for uplinks and Edge connectivity. VXLAN is not an NSX-T transport zone type.
Question 5NSX Architecture and Components
Which encapsulation protocol does NSX-T use for overlay segments?
- GENEVE Correct answer.
- GRE
- STT
- VXLAN
Explanation
NSX-T encapsulates overlay traffic in GENEVE, using UDP destination port 6081 by default. VXLAN was used by earlier NSX versions. GRE and STT are not used for NSX-T overlay segments.
Question 6NSX Architecture and Components
Which NSX-T gateway type provides connectivity between the data center and external networks?
- Tier-0 gateway Correct answer.
- Segment
- Distributed router
- Tier-1 gateway
Explanation
A tier-0 gateway peers with the physical network and provides north-south connectivity for the NSX-T domain. Tier-1 gateways attach to a tier-0 for external reachability. Segments provide Layer 2 connectivity only.
Question 7NSX Architecture and Components
What is an NSX-T transport node?
- A VM that runs the NSX Manager appliance
- A host or edge prepared to participate in the NSX overlay Correct answer.
- A certificate authority used for API authentication
- A logical construct that groups segments by scope
Explanation
A transport node is any host or Edge node that has been prepared with the NSX data plane so it can forward overlay traffic. Host transport nodes run the kernel modules; Edge transport nodes run centralized services. Transport zones, not transport nodes, group nodes by scope.
Question 8NSX Architecture and Components
An administrator needs to define the teaming policy and transport VLAN used by host uplinks. Which NSX-T object is used?
- Segment profile
- Edge cluster
- Uplink profile Correct answer.
- Transport zone
Explanation
An uplink profile defines how host or Edge uplinks are configured, including teaming policy, active/standby links, and the transport VLAN. Transport zones define overlay or VLAN scope, and segment profiles define switching behavior such as MAC learning.
Question 9NSX Architecture and Components
What is the purpose of a TEP address on a host transport node?
- Tunnel endpoint IP for overlay traffic Correct answer.
- VIP address for the NSX Manager cluster
- Management IP used by the NSX Manager
- IP address assigned to a segment port
Explanation
The tunnel endpoint (TEP) address is the source and destination IP used for GENEVE-encapsulated traffic between transport nodes. It is typically on a dedicated VLAN and must be routable across the underlay. It is separate from management and segment port addresses.
Question 10NSX Architecture and Components
What is the minimum recommended MTU on the physical network carrying NSX-T GENEVE overlay traffic?
- 1280
- 1600 Correct answer.
- 1500
- 9000
Explanation
GENEVE adds encapsulation overhead, so the underlay should support at least 1600 bytes to avoid fragmentation of overlay frames. Standard 1500-byte MTU is insufficient. Jumbo frames of 9000 are optional but not the minimum.
Question 11NSX Architecture and Components
How do clients typically access a three-node NSX Manager cluster?
- Through the Edge cluster
- Through the vCenter Server
- Through a single cluster virtual IP address Correct answer.
- Directly to each node's IP in round robin
Explanation
A three-node NSX Manager cluster presents a virtual IP address that clients use for UI and API access, and the VIP follows the elected leader. The individual node IPs are used for cluster operations and troubleshooting. vCenter and Edge clusters do not proxy NSX Manager API calls.
Question 12NSX Architecture and Components
Which action must be completed before hosts can be prepared as transport nodes using vCenter?
- Deploy NSX Intelligence
- Register the compute manager with NSX Manager Correct answer.
- Create an edge cluster
- Configure a tier-0 gateway
Explanation
The compute manager (vCenter Server) must be registered with NSX Manager so that NSX can inventory hosts, clusters, and distributed switches and prepare them. Edge clusters, gateways, and NSX Intelligence are configured later or independently.
Question 13NSX Architecture and Components
What does an NSX-T segment provide?
- Layer 3 routing between tier-0 gateways
- A Layer 2 broadcast domain Correct answer.
- NAT and load balancing services
- A tunnel between two Edge nodes
Explanation
A segment is the NSX-T equivalent of a logical switch and provides a Layer 2 broadcast domain for workloads. Routing is performed by tier-0 and tier-1 gateways. NAT and load balancing are Edge services.
Question 14NSX Architecture and Components
What is an NSX-T edge cluster?
- A set of transport zones that share a common VLAN
- A collection of segments on one host
- A pair of NSX Manager nodes
- A group of Edge nodes for HA of services Correct answer.
Explanation
An edge cluster groups Edge transport nodes so that centralized services such as tier-0 and tier-1 service routers can be configured for high availability. Transport zones define segment scope, not Edge HA. NSX Manager nodes form the management cluster.
Question 15NSX Architecture and Components
A tier-1 gateway must perform NAT for its attached segments. What must the tier-1 gateway have?
- It must be placed in a VLAN transport zone
- It must not have segments attached
- It must have a service router Correct answer.
- It must be configured as distributed-only
Explanation
NAT is a centralized service that runs on the service router of a tier-1 gateway, which is hosted on Edge nodes in an edge cluster. A distributed-only tier-1 has no service router and cannot provide NAT. Transport zone type and attached segments do not determine NAT capability.
Question 16NSX Architecture and Components
In NSX-T, where does the distributed router of a tier-1 gateway run?
- On the tier-0 gateway
- Only on the Edge nodes
- On the NSX Manager cluster
- In each host's kernel Correct answer.
Explanation
The distributed router component of a tier-1 gateway is realized in the kernel of every host transport node that has the segment, providing optimized east-west routing close to the workloads. The service router, which handles centralized services, runs on Edge nodes. Routing is not performed on NSX Manager.
Question 17NSX Architecture and Components
An external automation tool must authenticate to the NSX Manager API using a certificate. Which feature should be configured?
- Segment profile
- Principal identity Correct answer.
- Compute manager registration
- Transport zone
Explanation
A principal identity binds a certificate to an NSX role so non-interactive clients can authenticate to the API without user credentials. Compute manager registration links vCenter to NSX. Transport zones and segment profiles are networking configuration objects.
Question 18NSX Architecture and Components
Which command-line interface is available on NSX Manager and Edge nodes for operational commands such as listing logical switches?
- Bash shell
- PowerCLI
- vSphere CLI
- NSX CLI Correct answer.
Explanation
The NSX CLI provides commands such as get logical-switches for troubleshooting and verification on NSX Manager and Edge nodes. PowerCLI is used for vSphere automation, and vSphere CLI targets ESXi hosts. A general Bash shell is not the supported interface for NSX operational commands.
Question 19NSX Architecture and Components
In NSX-T, which component computes and distributes the overlay forwarding tables to transport nodes?
- The edge cluster
- The central control plane Correct answer.
- The local data plane on each host
- The compute manager
Explanation
The central control plane runs on the NSX Manager cluster and computes the span and forwarding information that it distributes to transport nodes. The local control plane on each transport node programs the data plane. vCenter does not compute overlay forwarding tables.
Question 20NSX Architecture and Components
Which statement best describes the NSX-T Policy API?
- It exposes only imperative per-object CRUD calls
- It uses a declarative, desired-state model Correct answer.
- It removes the need for a control plane
- It is available only on Edge nodes
Explanation
The Policy API lets administrators and automation express the desired end state, and NSX reconciles the underlying configuration to match it. The Manager API is the more imperative, object-by-object interface. The Policy API still relies on the control and data planes to realize configuration.
Question 21NSX Architecture and Components
A segment is created in an overlay transport zone. Which statement is correct?
- The segment must be backed by VLANs
- Only members of that zone can realize it Correct answer.
- Any host in the vCenter inventory can realize it
- The segment cannot be attached to a tier-1
Explanation
A transport zone defines the scope of a segment, so only transport nodes that are members of that zone can realize the segment. Hosts outside the zone cannot participate even if they are in the same vCenter. VLAN-backed segments belong to VLAN transport zones, and overlay segments can attach to tier-1 gateways.
Question 22NSX Architecture and Components
An edge cluster contains two Edge nodes, and a tier-0 gateway uses active-standby high availability. What happens when the active Edge node fails?
- The tier-0 becomes distributed-only
- Traffic is dropped until manual intervention
- All segments in the cluster are deleted
- The standby node takes over Correct answer.
Explanation
With active-standby HA, the standby Edge node is ready to assume the service router role when the active node fails, so centralized services recover automatically. No manual intervention is required, and segments and gateway configuration remain intact.
Question 23NSX Architecture and Components
Which NSX-T feature allows multiple NSX Manager instances across separate sites to be managed together?
- NSX Federation Correct answer.
- NSX Intelligence
- Edge clusters
- Transport zones
Explanation
NSX Federation introduces a global manager that coordinates multiple local managers across sites, enabling consistent policy and cross-site networking. Transport zones and edge clusters operate within a single NSX-T instance. NSX Intelligence provides analytics, not multi-site management.
Question 24NSX Architecture and Components
Which two options describe the data plane a host transport node can use for NSX-T traffic?
- A physical switch or router
- Tier-0 or tier-1 gateway
- N-VDS or a vSphere Distributed Switch Correct answer.
- VXLAN or GRE encapsulation
Explanation
A host transport node can use the NSX-managed N-VDS or, in later releases, a vSphere Distributed Switch with NSX configured on it. Gateways are logical routing constructs, and physical switches are part of the underlay. VXLAN is not the NSX-T overlay encapsulation.
Question 25NSX Architecture and Components
How is the NSX Manager deployed in an NSX-T environment?
- A virtual appliance Correct answer.
- A container on the Edge
- A physical switch
- A kernel module on each host
Explanation
NSX Manager is deployed as a virtual appliance (OVA) on an ESXi host managed by vCenter. Kernel modules are part of host preparation for the data plane, not the manager. Edge nodes are separate appliances that run centralized services.
Question 26NSX Architecture and Components
Which NSX component hosts the management plane, including the user interface and the REST API used for configuration?
- The host transport nodes prepared on each hypervisor
- The edge transport nodes in the edge cluster
- The NSX Manager cluster Correct answer.
- The tier-0 gateway's distributed router instances
Explanation
NSX Manager nodes provide the management plane: they present the UI and REST API and hold the desired-state configuration for the environment. Transport nodes are the consumers of that configuration and are responsible for forwarding traffic rather than for storing or serving policy.
Question 27NSX Architecture and Components
What is the primary role of a transport zone in NSX?
- It scopes which transport nodes can carry a given network's traffic. Correct answer.
- It maps each overlay segment onto a specific VLAN of the underlay.
- It groups edge nodes that supply centralized gateway services.
- It distributes tunnel endpoint addresses to all transport nodes.
Explanation
A transport zone defines the boundaries within which a network is realized, so only transport nodes that are members of that zone can host the corresponding segments. A segment is placed into exactly one transport zone, which is how its reach is determined.
Question 28NSX Architecture and Components
How does a VLAN-backed segment differ from an overlay segment?
- A VLAN segment carries only routed traffic, while an overlay segment carries only switched traffic.
- A VLAN segment is limited to edge nodes, while an overlay segment is limited to host nodes.
- A VLAN segment stretches an underlay VLAN to workloads, while an overlay segment uses GENEVE tunnels. Correct answer.
- A VLAN segment carries traffic through GENEVE tunnels, while an overlay segment uses 802.1Q tags.
Explanation
A VLAN-backed segment extends an existing VLAN from the physical network directly to the workloads, so the underlay VLAN must be provisioned end to end. An overlay segment instead encapsulates workload frames in GENEVE over an L3 underlay, which decouples the logical network from physical VLANs.
Question 29NSX Architecture and Components
What does GENEVE provide in an NSX overlay network?
- It replaces the need for a routing protocol between tier-0 and tier-1 gateways.
- It compresses VM traffic before it is placed on the underlay.
- It encapsulates original frames in UDP, carrying them across an L3 underlay. Correct answer.
- It encrypts all east-west traffic between transport nodes by default.
Explanation
GENEVE is the tunnel format NSX uses to carry overlay frames between tunnel endpoints, wrapping them in UDP so they can traverse a routed underlay. Encryption and routing are provided by other features, not by the encapsulation itself.
Question 30NSX Architecture and Components
An administrator must apply the same host switch and uplink configuration to every host in a vCenter cluster. Which NSX object accomplishes this with the least manual effort?
- An IP pool reserved for the tunnel endpoints of the cluster
- An uplink profile assigned to each host individually
- A transport node profile applied to the cluster Correct answer.
- A segment profile attached to the overlay transport zone
Explanation
A transport node profile bundles the host switch, transport zones and uplink settings and is applied to a compute cluster, so existing and newly added hosts inherit the same configuration. This avoids configuring each transport node by hand.
Question 31NSX Architecture and Components
Which deployment form factors are supported for an NSX Edge node?
- A virtual appliance on an ESXi host or an installation on bare-metal hardware. Correct answer.
- Only an installation directly on bare-metal server hardware.
- Only a virtual appliance running on an ESXi host managed by vCenter.
- A container on an NSX Manager node or a virtual appliance on ESXi.
Explanation
Edge nodes may be deployed as virtual appliances on an ESXi host or installed directly on supported bare-metal servers. The form factor affects throughput and performance for centralized services but not the logical role of the edge node.
Question 32NSX Architecture and Components
Which statement distinguishes an edge transport node from a host transport node?
- An edge transport node runs no host switch or uplink, while a host transport node must always run one.
- An edge transport node hosts centralized services, while a host node provides the per-hypervisor datapath. Correct answer.
- An edge transport node never joins a transport zone, while a host transport node always joins exactly one.
- An edge transport node must be bare metal, while a host transport node must be a virtual machine.
Explanation
Both are transport nodes, but their roles differ: edge transport nodes run service routers and centralized services such as NAT, VPN and gateway firewalling, while host transport nodes run the datapath inside the hypervisor for attached workloads. Each transport node is prepared with a host switch and joins at least one transport zone.
Question 33NSX Architecture and Components
Which statement describes the relationship between a tier-1 and a tier-0 gateway?
- Tier-1 and tier-0 gateways share a single distributed router instance on each host.
- A tier-0 gateway is attached to a tier-1 gateway that supplies it with north-south routing.
- A tier-1 gateway must be attached to a tier-0 gateway to reach networks outside its own segments. Correct answer.
- A tier-1 gateway provides external connectivity on its own once its segments are created.
Explanation
The tier-1 gateway provides routing among its own segments and any services configured on it, but external connectivity is reached through an attachment to a tier-0 gateway. The tier-0 gateway in turn connects to the physical network through its edge nodes.
Question 34NSX Architecture and Components
What is the recommended NSX Manager cluster size for production high availability?
- Three manager nodes forming a single cluster Correct answer.
- Four manager nodes in an active-active load-balanced pool
- Two manager nodes with a shared external database
- One manager node with a standby copy on the same host
Explanation
A production NSX Manager cluster is formed from three nodes, which provides redundancy and quorum while the cluster presents a single access point. Two nodes do not provide a proper quorum and a single node leaves no redundancy.
Question 35NSX Architecture and Components
How is a virtual machine's vNIC attached to an NSX segment?
- Through a tunnel endpoint configured on the VM's guest operating system.
- Through a segment port created on the segment for that vNIC. Correct answer.
- Through an uplink port on the host switch used by the host.
- Through a tier-1 gateway interface dedicated to that VM.
Explanation
Each vNIC connected to a segment is represented by a segment port, which is the attachment point that carries the port's addressing and security settings. Uplinks and tunnel endpoints are used to move traffic between transport nodes, not to attach workloads.
Question 36NSX Architecture and Components
Which statement about host switches and transport zones is correct?
- A transport zone must be associated with every host switch in the NSX domain.
- A transport zone can be associated with only one host switch on a given host, never more.
- A host switch can be associated with several transport zones at once. Correct answer.
- A host switch can belong to only one transport zone for its entire lifetime.
Explanation
A single host switch carries traffic for all the transport zones it is associated with, which is how one host can serve both overlay and VLAN-backed segments. The mapping is flexible in both directions because multiple switches on the same host can also join the same zone.
Question 37NSX Architecture and Components
On an NSX Edge node, which interface connects the gateway's service router to the physical network?
- The tunnel endpoint interface used for GENEVE encapsulation.
- The downlink interface, which faces the overlay segments.
- The uplink interface, which faces the top-of-rack switches. Correct answer.
- The internal loopback interface used for routing adjacencies.
Explanation
Edge node uplinks are the interfaces that face the physical network, typically toward top-of-rack switches, and carry the tier-0 gateway's external connectivity. Downlinks face the overlay and connect the service router to the logical segments.
Question 38NSX Architecture and Components
The NSX Manager cluster becomes unreachable, but all host transport nodes remain up and can reach each other. What is the effect on existing workload traffic?
- All traffic stops because transport nodes cannot forward without the manager.
- Traffic stops until the manager cluster's VIP is re-elected on a host node.
- Existing traffic keeps flowing because forwarding is done by the transport nodes' datapath. Correct answer.
- Only traffic to VLAN-backed segments continues; overlay traffic stops.
Explanation
The management plane distributes configuration but does not sit in the data path, so established forwarding on transport nodes continues while the manager is unreachable. Configuration changes cannot be made during the outage, but the existing datapath keeps forwarding.
Question 39NSX Architecture and Components
A segment is created in an overlay transport zone. A host transport node in the same cluster belongs only to a VLAN transport zone. What is the result?
- The host forwards the segment's traffic through an edge node's tunnel endpoint.
- The host automatically gains membership in the overlay zone when the segment is created.
- The segment is not realized on that host, so VMs there cannot connect to it. Correct answer.
- The segment is realized on the host but converted to a VLAN-backed segment.
Explanation
Transport zone membership determines which transport nodes realize a given segment, so a host that is not in the overlay zone never receives the segment. To place workloads on that segment, the host's switch must be associated with the overlay transport zone.
Question 40NSX Architecture and Components
No routes for a tier-1 gateway's segments appear in the tier-0 gateway's routing table, even though the tier-1 is attached to it. Which setting most directly controls this?
- Advertisement of the tier-1's connected routes to the tier-0 is disabled. Correct answer.
- The tier-1 gateway has no tunnel endpoint address configured.
- The tier-1 gateway's distributed router is not installed on every host.
- The tier-1 gateway has no edge cluster assigned to it.
Explanation
A tier-1 gateway must advertise its connected and static routes to the attached tier-0 gateway before the tier-0 can learn and propagate those subnets. Without that advertisement the tier-1's segments remain unreachable from the tier-0 and from the physical network.
Question 41NSX Installation, Configuration, and Upgrade
Which NSX Manager cluster size is the minimum recommended for production high availability?
- Three nodes Correct answer.
- One node
- Six nodes
- Two nodes
Explanation
An NSX Manager cluster uses an odd number of nodes so that quorum can be maintained, and the standard production deployment is three nodes, which tolerates the loss of a single node. Single-node deployments are supported only for labs and proof-of-concept work. Even-numbered clusters and oversized clusters are not supported designs.
Question 42NSX Installation, Configuration, and Upgrade
What does the VIP configured on an NSX Manager cluster provide?
- A default gateway for the management subnet
- A load balancer for Geneve tunnel traffic
- A shared certificate authority for cluster nodes
- A single address for UI and API access Correct answer.
Explanation
The VIP is a virtual IP shared by the manager cluster so that administrators and API clients always connect to the same address, regardless of which node holds the leader role. Each manager node still has its own management IP for cluster communication and troubleshooting.
Question 43NSX Installation, Configuration, and Upgrade
What is the minimum physical network MTU recommended to carry Geneve-encapsulated traffic in NSX?
- 1500
- 9000
- 1600 Correct answer.
- 1400
Explanation
Geneve encapsulation adds 50 bytes of overhead for the outer IP, UDP, and Geneve headers, so encapsulated frames are larger than the original frames. VMware therefore requires the physical underlay to support an MTU of at least 1600, and recommends 9000 where jumbo frames are available.
Question 44NSX Installation, Configuration, and Upgrade
Which pair lists the transport zone types available in NSX?
- Geneve and VXLAN
- Overlay and VLAN Correct answer.
- Edge and host
- Tier-0 and Tier-1
Explanation
Overlay transport zones carry Geneve-encapsulated segment traffic, while VLAN transport zones carry VLAN-backed traffic and are commonly used for Edge uplinks. A host or Edge node can be a member of more than one transport zone.
Question 45NSX Installation, Configuration, and Upgrade
Which component must be registered as a compute manager in NSX before hosts can be prepared as transport nodes?
- vCenter Server Correct answer.
- A DHCP server
- The NSX Edge cluster
- An external DNS server
Explanation
Host transport node preparation is driven from a registered compute manager such as vCenter Server, which supplies the host inventory and cluster structure. IP services and Edge clusters are separate components and cannot act as compute managers.
Question 46NSX Installation, Configuration, and Upgrade
What is the primary role of an NSX Edge node?
- Encapsulating Geneve traffic for host segments
- Running the distributed firewall and IDS on every host
- Storing the management plane database
- Providing gateway and north-south routing services Correct answer.
Explanation
Edge nodes run centralized services such as Tier-0 and Tier-1 routing, NAT, VPN, and load balancing, and they connect the overlay to the physical network through uplinks. Distributed firewalling runs in the host kernel on transport nodes, not on the Edge.
Question 47NSX Installation, Configuration, and Upgrade
Which protocols can be used as the destination for NSX Manager backups?
- iSCSI and FC
- HTTP and HTTPS
- SMB and NFS
- FTP and SFTP Correct answer.
Explanation
NSX Manager backups are pushed to an external FTP or SFTP server on a schedule that you configure. The backup contains the management plane configuration needed to rebuild the cluster.
Question 48NSX Installation, Configuration, and Upgrade
Which NSX Manager CLI command adds a node to an existing manager cluster?
- cluster add-node
- join Correct answer.
- register-node
- attach manager
Explanation
Running join with the IP address of an existing manager adds the newly deployed node to that cluster. The node must be able to reach the existing manager over the management network.
Question 49NSX Installation, Configuration, and Upgrade
What does an uplink profile define for a transport node?
- The routing protocol used by Tier-0 gateways
- The DNS and NTP settings of the manager
- Teaming policy, transport VLAN, and MTU Correct answer.
- The firewall rules applied to the host
Explanation
An uplink profile defines how a transport node's uplinks are teamed, which VLAN carries the transport (TEP) traffic, and the uplink MTU. It is referenced when configuring an N-VDS, a VDS, or a transport node profile.
Question 50NSX Installation, Configuration, and Upgrade
What is the purpose of a transport node profile?
- To schedule periodic configuration backups of NSX Manager
- To define the routing table used by a Tier-1 gateway
- To assign static IP addresses to overlay segments
- To prepare all hosts in a cluster at once Correct answer.
Explanation
A transport node profile groups the host switch configuration, uplink profile, and transport zones so that every host in a vCenter cluster can be prepared identically in a single operation. It is applied to a cluster, not to an individual host.