VCP-NV study plan

Map each NSX component (NSX Manager, NSX Edge nodes, host transport nodes, segments, gateways) to its plane of operation and state what breaks when each is unavailable

Diagram the east-west packet walk between two VMs on different overlay segments, labeling encap, decap, and the transport node hops

Deploy a lab NSX Manager and register a compute cluster as a transport node with an uplink profile and overlay transport zone

Create one VLAN-backed and one overlay-backed segment, attach VMs to each, and verify connectivity

Configure a Tier-0 gateway and at least two Tier-1 gateways, using both connected and transit links, to build a multi-tier routing topology

Implement ECMP on the Tier-0 across two edge nodes and predict which path a given flow will take

Configure BGP peering to a simulated upstream router and add route redistribution between BGP and connected/static routes

Trace a north-south flow from an overlay VM out through Tier-1 to Tier-0 to the uplink, identifying where SNAT and routing decisions occur

Evaluate host and Edge node prerequisites (versions, MTU, DNS, NTP, compute/cluster requirements) and document a compliant build checklist

Perform transport node preparation on a new host and explain what each installed component enables

Sequence an upgrade path for NSX Manager, Edge nodes, and host transport nodes, stating the required order and how to verify readiness at each step

Configure NSX Manager backup to an external target and demonstrate a restore into a lab

Compare supported Edge deployment forms and select the correct one for a stated throughput and HA requirement

Order the Distributed Firewall rule sections and predict which rule wins for a given 5-tuple and context profile

Author a layered DFW policy set (infrastructure, environment, application) using groups and security tags instead of raw IP addresses

Configure a tag-driven dynamic group and verify that group membership updates automatically when a VM tag changes

Publish a DFW policy and verify enforcement using Live Traffic Analysis and the rule hit counters

Apply an Identity Firewall rule based on an Active Directory user or group and test it with a user login

Attach an IDS/IPS profile to both a DFW rule and a gateway firewall rule, then generate signature-based detections with a test attack

Configure Malware Prevention on a DFW rule and interpret the resulting event in the security UI

Distinguish Distributed Firewall, Gateway Firewall, and NSX Intelligence capabilities and choose the right control point for a stated requirement

Inspect a flow-based recommendation in NSX Intelligence and convert it into a draft DFW rule

Configure syslog export, SNMP traps, and an alarm notification so that a triggered condition reaches an external collector

Run Traceflow between two VMs and interpret each observation point to localize a simulated drop

Perform a packet capture on a transport node and correlate it with a Traceflow result for the same flow

Configure port mirroring to send a VM's traffic to an analysis tool and verify captured frames

Enable IPFIX on a segment or gateway and explain which fields the exported flow records contain

Diagnose a broken tunnel between transport nodes by checking transport zone membership, uplink configuration, and MTU

Interpret NSX Manager and Edge node log locations and identify the correct log to consult for a given failure class

Re-explain each of Domains 1 through 4 in a five-minute verbal summary without notes, flagging any topic that requires a second pass

Rebuild the weakest lab scenario from an earlier week from scratch, without referring to prior notes

Complete two timed, self-authored 60-question mock exams weighted to the official domain percentages and review every missed item to root cause

Close every remaining item on the week-7 weak-area list with a lab or written explanation

Summarize the operational limits, defaults, and ordering rules that commonly appear as distractors (upgrade order, rule evaluation order, HA modes)

Restate the full packet path for east-west, north-south, and firewall-inspected traffic in one continuous narrative