I85PREP
⌘ K
VCP-VVF Admin (2V0-16.25) study materials
VCP-VVF Admin (2V0-16.25) study resources

VCP-VVF Admin (2V0-16.25) practice questions

One question at a time. Build your VCP-VVF Admin (2V0-16.25) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1vSphere and ESXi Host Configuration and Maintenance

Which item is a software package that vSphere Lifecycle Manager can add to an ESXi host image?

  1. A VMFS datastore
  2. A VIB Correct answer.
  3. An OVF template
  4. A distributed port group

Explanation

A VIB (vSphere Installation Bundle) is the packaging format for ESXi software such as drivers and components. An image consists of the base ESXi image plus any additional VIBs and firmware add-ons. The other items are virtual machine or infrastructure objects, not host software packages.

Question 2vSphere and ESXi Host Configuration and Maintenance

Which protocol keeps an ESXi host's clock synchronized with an external time source?

  1. SNMP
  2. LDAP
  3. SMB
  4. NTP Correct answer.

Explanation

ESXi uses NTP to synchronize its clock with one or more time servers. Accurate time is required for logging, certificates, and Kerberos-based authentication. The other protocols provide monitoring, directory services, or file sharing.

Question 3vSphere and ESXi Host Configuration and Maintenance

When lockdown mode is enabled on an ESXi host, which access path remains available by default?

  1. Direct SSH access as the root user
  2. Direct API calls to the host's web services
  3. The vSphere Client connected through vCenter Correct answer.
  4. Direct HTTPS access to the host client

Explanation

Lockdown mode forces management traffic through vCenter and blocks direct host access methods such as SSH, the host client, and direct API calls. Users on the exception list can be granted direct access. Managing the host through vCenter remains the supported path.

Question 4vSphere and ESXi Host Configuration and Maintenance

In a cluster with fully automated DRS, what happens to powered-on virtual machines when their host enters maintenance mode?

  1. They are migrated with vMotion Correct answer.
  2. They stay running on the host
  3. They are suspended to disk
  4. They are powered off immediately

Explanation

With fully automated DRS, vCenter migrates the powered-on virtual machines to other hosts so the host can be evacuated. If a virtual machine cannot be migrated, the host waits in the entering-maintenance-mode state. Powering off or suspending virtual machines is not the automatic behavior.

Question 5vSphere and ESXi Host Configuration and Maintenance

Which service must be enabled in the DCUI before an administrator can log in at the local console and type commands?

  1. The CIM server
  2. SNMP
  3. ESXi Shell Correct answer.
  4. vSphere Auto Deploy

Explanation

The ESXi Shell is the local command-line environment and is disabled by default. It is enabled from the Troubleshooting Options menu in the DCUI or from the host's settings in vCenter. The other services provide monitoring, hardware management, or provisioning functions.

Question 6vSphere and ESXi Host Configuration and Maintenance

Which file system does ESXi use to format a shared block-storage datastore that multiple hosts access at the same time?

  1. VMFS Correct answer.
  2. NFS
  3. ext4
  4. XFS

Explanation

VMFS is a clustered file system designed for concurrent access by multiple ESXi hosts to the same block LUN. NFS datastores are mounted over the network instead of being formatted on a LUN. ext4 and XFS are Linux file systems that ESXi does not use for datastores.

Question 7vSphere and ESXi Host Configuration and Maintenance

What is the primary purpose of a vSphere Host Profile?

  1. To assign CPU and memory shares to virtual machines
  2. To distribute virtual switch traffic across uplinks
  3. To keep ESXi host configuration consistent Correct answer.
  4. To back up virtual machine disks to a remote site

Explanation

A host profile captures the configuration of a reference host and can be applied to other hosts to keep settings consistent. Compliance checks show where hosts deviate from the profile. Disk backup, resource allocation, and uplink load balancing are handled by other features.

Question 8vSphere and ESXi Host Configuration and Maintenance

Which component authenticates users who sign in to the vSphere Client?

  1. vCenter Single Sign-On Correct answer.
  2. The ESXi firewall
  3. vSphere Auto Deploy
  4. vSphere Lifecycle Manager

Explanation

vCenter Single Sign-On is the authentication service that validates credentials and issues tokens for the vSphere Client and other vSphere services. It supports identity sources such as Active Directory and local accounts. The other components handle provisioning, host lifecycle, or traffic filtering.

Question 9vSphere and ESXi Host Configuration and Maintenance

A cluster is managed by a single vSphere Lifecycle Manager image. What does that image define?

  1. The storage policy that is applied to the cluster datastores
  2. The ESXi base version with its components and add-ons Correct answer.
  3. The virtual machine hardware version that the cluster supports
  4. Only the patch baseline that vLCM applies during remediation

Explanation

An image is a complete desired-state definition made up of the base ESXi version, additional components, and optional firmware add-ons. Remediation brings every host in the cluster to that exact state. Baselines belong to the older baseline-based management model.

Question 10vSphere and ESXi Host Configuration and Maintenance

Which condition must a cluster meet before it can be managed by a vSphere Lifecycle Manager image instead of baselines?

  1. Every host must run ESXi 7.0 or later Correct answer.
  2. The cluster must use a vSphere Distributed Switch
  3. The cluster must run DRS in fully automated mode
  4. The cluster must contain at least three hosts

Explanation

Image-based management requires all hosts in the cluster to run ESXi 7.0 or later, and the cluster must not be associated with baselines. Network design, DRS automation level, and cluster size do not affect the decision.

Question 11vSphere and ESXi Host Configuration and Maintenance

An administrator enables vMotion on a VMkernel adapter. Which requirement applies to that adapter?

  1. The adapter must have jumbo frames enabled
  2. The adapter must be attached to a vSphere Standard Switch
  3. The adapter must use the Provisioning TCP/IP stack
  4. The adapter must be reachable by every participating host Correct answer.

Explanation

vMotion traffic flows between the source and destination VMkernel adapters, so the addresses must be reachable across the network in use. The adapter can sit on a standard or distributed switch, and jumbo frames are optional. A dedicated vMotion TCP/IP stack is a design choice, not a requirement.

Question 12vSphere and ESXi Host Configuration and Maintenance

Which practice is required when configuring iSCSI port binding on an ESXi host?

  1. Placing the bound VMkernel adapters on the same subnet Correct answer.
  2. Binding VMkernel adapters that reside on different subnets
  3. Enabling jumbo frames on every physical uplink
  4. Using a single VMkernel adapter for all storage paths

Explanation

Port binding requires the bound VMkernel adapters to be on the same subnet so that each adapter presents a separate path to the array. Each bound adapter is paired with one active uplink, and multiple adapters provide multipathing. Jumbo frames are a performance option, not a binding requirement.

Question 13vSphere and ESXi Host Configuration and Maintenance

An ESXi host has no persistent scratch partition configured. Where are its log files stored?

  1. On the boot device as a locked system file
  2. In a ramdisk that is lost on reboot Correct answer.
  3. On the VMFS datastore holding the virtual machines
  4. In the vCenter database

Explanation

When no persistent scratch location exists, ESXi writes logs to a ramdisk that is erased at reboot. To preserve logs, an administrator configures a scratch directory on a local or shared datastore. Creating one also reduces writes to SD or USB boot media.

Question 14vSphere and ESXi Host Configuration and Maintenance

Which advanced setting sends an ESXi host's log messages to a remote syslog server?

  1. Syslog.global.defaultRotate
  2. Syslog.global.logDir
  3. Syslog.global.logLevel
  4. Syslog.global.logHost Correct answer.

Explanation

Syslog.global.logHost specifies the remote syslog server, including protocol and port. Syslog.global.logDir sets the local persistent directory for logs. The other settings control rotation and verbosity rather than forwarding.

Question 15vSphere and ESXi Host Configuration and Maintenance

Which statement about ESXi firewall rule sets is correct?

  1. They can be changed only while the host is in maintenance mode
  2. They can be restricted to specific IP addresses and subnets Correct answer.
  3. They apply only to traffic that enters through a distributed switch
  4. They are configured globally on vCenter and inherited by hosts

Explanation

Each ESXi host has its own firewall, and a rule set can be limited to allowed IP addresses or subnets in addition to being enabled or disabled. Rules can be modified at any time without maintenance mode. The firewall filters host traffic regardless of which virtual switch is used.

Question 16vSphere and ESXi Host Configuration and Maintenance

How does a vSphere Distributed Switch appear on each member host?

  1. As an additional physical switch
  2. As a port group on a standard switch
  3. As a hidden proxy switch Correct answer.
  4. As a VMkernel adapter

Explanation

Each host that joins a distributed switch gets a hidden proxy switch that mirrors the distributed switch configuration locally. VMkernel adapters and physical uplinks connect to that proxy switch. The distributed switch itself is a vCenter-managed object and creates no physical hardware.

Question 17vSphere and ESXi Host Configuration and Maintenance

Which feature does NFS 4.1 add that NFS 3 does not provide on ESXi?

  1. Support for datastores larger than 2 TB
  2. Kerberos-based authentication Correct answer.
  3. Mounting a datastore on multiple hosts
  4. Thin-provisioned virtual disks

Explanation

NFS 4.1 introduces Kerberos authentication and session trunking for multipathing. Large datastore support, multi-host mounts, and thin provisioning are already available with NFS 3. Choosing NFS 4.1 is mainly about security and multipathing.

Question 18vSphere and ESXi Host Configuration and Maintenance

Which port does an ESXi host use to reach an external NTP server?

  1. UDP 161
  2. TCP 123
  3. TCP 427
  4. UDP 123 Correct answer.

Explanation

NTP uses UDP port 123 for time synchronization traffic. Blocking this port prevents the host from syncing with external servers. UDP 161 is used by SNMP and TCP 427 by SLP.

Question 19vSphere and ESXi Host Configuration and Maintenance

An administrator installs a certificate issued by the company's internal CA on an ESXi host. Which certificate mode is this?

  1. Auto Deploy mode
  2. VMCA-signed mode
  3. Custom certificate mode Correct answer.
  4. Thumbprint mode

Explanation

In custom certificate mode the host uses a certificate signed by an external CA rather than by VMCA. VMCA-signed mode means the host certificate is issued by the VMware Certificate Authority. Thumbprint mode is a legacy option that is no longer available.

Question 20vSphere and ESXi Host Configuration and Maintenance

Which statement about backing up an ESXi host configuration is correct?

  1. It can be taken only while the host is in maintenance mode
  2. It includes the virtual disks stored on local datastores
  3. It captures host settings but not virtual machine files Correct answer.
  4. It is stored in the vCenter database by default

Explanation

A host configuration backup saves settings such as networking, storage, and security configuration so the host can be rebuilt. It does not contain virtual machine data, which must be protected separately. The backup can be taken while the host is running and is written to a location you specify.

Question 21vSphere and ESXi Host Configuration and Maintenance

A cluster image includes a firmware add-on supplied by the hardware vendor. What is required for that firmware to be updated during remediation?

  1. DRS must be fully automated
  2. A registered hardware support manager Correct answer.
  3. The cluster must use baselines
  4. Each host must boot from a USB device

Explanation

Firmware add-ons are applied through a hardware support manager, a vendor plugin registered with vCenter. Without it, vLCM can install software components but cannot update firmware. The boot device and DRS automation level do not affect this capability.

Question 22vSphere and ESXi Host Configuration and Maintenance

An environment includes vCenter and several ESXi hosts that must all be upgraded. Which upgrade order does VMware recommend?

  1. Upgrade the virtual machine hardware version first
  2. Upgrade the ESXi hosts first, then vCenter
  3. Upgrade vCenter first, then the ESXi hosts Correct answer.
  4. Upgrade vCenter and the hosts simultaneously

Explanation

vCenter should be upgraded before the hosts it manages so that it can support the newer host versions. Hosts are then upgraded, and virtual machine hardware and VMware Tools are updated afterwards. Upgrading hosts first risks managing them from an older vCenter.

Question 23vSphere and ESXi Host Configuration and Maintenance

Which statement about Quick Boot on an ESXi host is correct?

  1. It skips firmware and hardware initialization on reboot Correct answer.
  2. It reboots the host without entering maintenance mode
  3. It requires the host to boot from a SAN LUN
  4. It restores the last configuration backup after reboot

Explanation

Quick Boot reduces reboot time by skipping the firmware and hardware initialization that a normal POST performs. It depends on hardware support and does not replace maintenance mode, which is still required before remediation. It has no relationship to boot device type or configuration restore.

Question 24vSphere and ESXi Host Configuration and Maintenance

A host's swap file location is set to a shared datastore. What does this setting control?

  1. How much memory each virtual machine may swap
  2. Where swap files go for VMs that use the host default Correct answer.
  3. Whether virtual machines can be migrated with vMotion
  4. Which datastore holds the virtual machine configuration files

Explanation

The host-level swap file location is the default used by virtual machines that keep their own swap file setting at the host default. A virtual machine can override the location with its own setting. The choice of datastore for swap files does not affect memory overcommit or vMotion eligibility.

Question 25vSphere and ESXi Host Configuration and Maintenance

A host boots with vSphere Auto Deploy. Where does its configuration come from at boot time?

  1. A configuration backup stored on the local disk
  2. The alarm definitions stored in the vCenter database
  3. A vendor-supplied USB configuration drive
  4. A host profile applied at boot by Auto Deploy Correct answer.

Explanation

Auto Deploy hosts are stateless: at boot the image is streamed to the host and a host profile is applied to configure it. Nothing is persisted on local media, so a reboot re-applies the image and profile. Configuration backups and alarm definitions play no role in this process.

Question 26vSphere and ESXi Host Configuration and Maintenance

An administrator needs an ESXi host to lock a user account after three consecutive failed login attempts. Which advanced host setting controls this threshold?

  1. Security.PasswordQualityControl
  2. Security.AccountUnlockTime
  3. Security.AccountLockFailures Correct answer.
  4. UserVars.ESXiShellInteractiveTimeOut

Explanation

ESXi enforces account lockout through advanced host settings: Security.AccountLockFailures defines how many consecutive failed login attempts trigger a lockout, while Security.AccountUnlockTime defines how many seconds the account stays locked. Setting the failure count to 3 therefore produces the desired behavior, and the change is applied per host rather than through vCenter Single Sign-On.

Question 27vCenter Server and Identity Management

Which Single Sign-On domain name is created by default when you deploy a new vCenter Server appliance?

  1. system.local
  2. vsphere.local Correct answer.
  3. localos
  4. example.com

Explanation

The deployment wizard creates an SSO domain named vsphere.local unless a different name is supplied. The default administrative account in that domain is [email protected].

Question 28vCenter Server and Identity Management

By default, which port does the vCenter Server Management Interface (VAMI) listen on?

  1. 5480 Correct answer.
  2. 8443
  3. 9443
  4. 443

Explanation

The appliance management interface is published over HTTPS on port 5480. Port 443 serves the vSphere Client and other HTTPS services.

Question 29vCenter Server and Identity Management

In the vCenter Server permission model, which item is a named collection of privileges that can be assigned to a user or group?

  1. Identity source
  2. Tag
  3. Role Correct answer.
  4. Permission

Explanation

A role is a named set of privileges such as Read Only or Administrator. A permission is the pairing of a role with a user or group on a specific inventory object.

Question 30vCenter Server and Identity Management

Which identity source is present by default on a new vCenter Server and cannot be removed?

  1. Active Directory over IWA
  2. localos Correct answer.
  3. OpenLDAP
  4. Active Directory over LDAP

Explanation

The localos identity source represents accounts defined in the appliance operating system and always exists. Directory-based sources are optional additions that an administrator can remove again.

Question 31vCenter Server and Identity Management

For two vCenter Server instances to participate in Enhanced Linked Mode, which requirement must be met?

  1. They must be members of the same SSO domain Correct answer.
  2. They must be deployed in different SSO sites
  3. They must be managed by the same external Platform Services Controller
  4. They must use the same vCenter license key

Explanation

Enhanced Linked Mode requires both vCenter Server instances to be joined to the same SSO domain, which allows one vSphere Client session to see both inventories. SSO services are embedded in the appliance, so no separate PSC is involved.

Question 32vCenter Server and Identity Management

In a vCenter HA cluster, which node provides quorum and sits outside the active/passive replication pair?

  1. Witness node Correct answer.
  2. Management node
  3. Active node
  4. Passive node

Explanation

A vCenter HA cluster consists of an active node, a passive node, and a witness node. The witness supplies quorum and breaks ties during a failover.

Question 33vCenter Server and Identity Management

By default, which component issues certificates for vCenter Server and ESXi hosts in a vSphere environment?

  1. VMware Certificate Authority Correct answer.
  2. The ESXi host certificate store
  3. Microsoft Certificate Authority
  4. OpenSSL self-signed certificates

Explanation

VMCA runs as part of the vCenter Server appliance and acts as the default root certificate authority. Certificates can later be replaced with third-party CA-signed certificates if required.

Question 34vCenter Server and Identity Management

Which destination type is supported for a native vCenter Server file-based backup?

  1. Fibre Channel target
  2. iSCSI LUN
  3. Object storage bucket
  4. SFTP server Correct answer.

Explanation

File-based backup from the management interface supports FTP, FTPS, SFTP, HTTP, HTTPS, NFS, and SMB destinations. Block-level storage protocols are not backup destinations.

Question 35vCenter Server and Identity Management

An administrator assigns a role to a user on a data center object and enables Propagate to children. What is the result?

  1. The permission applies only to the data center object itself
  2. The permission is copied to every data center in the inventory
  3. The permission is inherited by child objects beneath the data center Correct answer.
  4. The permission is converted into a global permission

Explanation

Propagation pushes a permission down the inventory hierarchy from the object where it is defined. Child objects inherit it unless a child has an explicit permission that overrides the inherited one.

Question 36vCenter Server and Identity Management

A global permission is granted to an Active Directory group on the root folder. What is the outcome for members of that group?

  1. They gain access only to objects created after the permission was assigned
  2. They must additionally be granted a role on each data center
  3. They can access all inventory objects with the privileges of the assigned role Correct answer.
  4. They can log in but see no inventory objects

Explanation

A global permission is a permission placed on the root folder of the inventory. Because every object descends from the root folder, the role applies across the whole inventory.

Question 37vCenter Server and Identity Management

Which identity source type requires the vCenter Server appliance to be joined to an Active Directory domain?

  1. Active Directory over LDAP
  2. localos
  3. Active Directory over Integrated Windows Authentication Correct answer.
  4. OpenLDAP

Explanation

AD over IWA joins the appliance to the domain, so vCenter authenticates using its machine account and no bind-user password is stored. AD over LDAP instead relies on a bind account's credentials.

Question 38vCenter Server and Identity Management

A user has the Read-Only role on a folder and the No Access role on one virtual machine inside that folder. What can the user do with that virtual machine?

  1. View it only after the folder permission is re-propagated
  2. View it with read-only privileges inherited from the folder
  3. Nothing, because the virtual machine is hidden from the user Correct answer.
  4. Power it on but not reconfigure it

Explanation

A No Access assignment on a lower-level object overrides permissions inherited from a parent. The object and everything below it therefore disappear from that user's view.

Question 39vCenter Server and Identity Management

When adding an Active Directory over LDAP identity source, which information is required in addition to the domain name?

  1. The thumbprints of the ESXi hosts in the cluster
  2. A VMCA-signed certificate for every domain controller
  3. A user DN and password used to bind to the directory Correct answer.
  4. The SSO site name of each domain controller

Explanation

AD over LDAP authenticates to the directory with the credentials of a bind user, so a user DN and password are mandatory. The base DN for users and groups is normally supplied as well.

Question 40vCenter Server and Identity Management

Which vCenter HA configuration requires a dedicated network for replication traffic?

  1. Basic mode
  2. Advanced mode Correct answer.
  3. Witness-only mode
  4. Manual mode

Explanation

In advanced mode the HA network is separated from the management network so replication traffic uses its own subnet. Basic mode carries HA traffic on the management network.

Question 41vCenter Server and Identity Management

Before restoring a vCenter Server from a file-based backup, which condition must be satisfied?

  1. The target must use a larger deployment size than the original
  2. The target must have a different SSO domain name
  3. The new appliance must use the same FQDN and build as the backup Correct answer.
  4. The backup must be restored to the original ESXi host

Explanation

A restore requires an appliance of the same version and build with the same FQDN and IP address as the backed-up instance. The deployment size may stay the same, and the target host or cluster can differ.

Question 42vCenter Server and Identity Management

Which account is the built-in Single Sign-On administrator for a newly deployed vCenter Server?

  1. root@localos
  2. [email protected]
  3. [email protected] Correct answer.
  4. [email protected]

Explanation

The first SSO domain created at deployment contains an administrator account named [email protected]. It holds the SSO administrator role and is used for initial configuration.

Question 43vCenter Server and Identity Management

An administrator tries to delete a custom role but the delete option is unavailable. What is the most likely cause?

  1. The role is currently assigned through an existing permission Correct answer.
  2. The role name contains a reserved prefix
  3. The role contains more than ten privileges
  4. The role was created by a solution user

Explanation

A role that is in use by an existing permission cannot be deleted until those permissions are removed or reassigned. Built-in roles are likewise protected from deletion.

Question 44vCenter Server and Identity Management

Which change to an existing vCenter Server requires a new deployment rather than an in-place edit?

  1. Increasing the appliance CPU count
  2. Changing the Single Sign-On domain Correct answer.
  3. Adding an additional identity source
  4. Replacing the assigned vCenter Server license

Explanation

The SSO domain is fixed at deployment time, so the only supported way to change it is to deploy a new vCenter Server and move the inventory. CPU, identity sources, and licensing can all be changed afterwards.

Question 45vCenter Server and Identity Management

What does an SSO site define within a vCenter Single Sign-On domain?

  1. The replication topology among the SSO services of the domain Correct answer.
  2. The password policy applied to directory accounts
  3. The identity sources available to users
  4. The license entitlement shared by linked vCenters

Explanation

An SSO site groups SSO services that replicate directory data closely and defines how sites relate for failover. Each SSO domain has at least one site, named default-first-site at deployment.

Question 46vCenter Server and Identity Management

A user belongs to two groups: Group A holds Read-Only on a cluster and Group B holds Virtual Machine Administrator on the same cluster. What are the user's effective privileges?

  1. No privileges, because conflicting assignments cancel each other
  2. The combined privileges granted by both roles Correct answer.
  3. Only the privileges of Group B, because it is the more powerful role
  4. Only the privileges of Group A, because it was assigned first

Explanation

Permissions in vCenter are additive, so a user receives the union of privileges granted through all group memberships and direct assignments. Only an explicit No Access assignment removes access at that object or below it.

Question 47vCenter Server and Identity Management

Which vCenter Server certificate mode issues a machine SSL certificate from VMCA while making VMCA subordinate to a third-party root CA?

  1. Hybrid mode Correct answer.
  2. Custom mode
  3. Thumbprint mode
  4. VMCA mode

Explanation

In hybrid mode the machine SSL certificate is issued by VMCA, but the VMCA root is chained beneath an enterprise root CA so clients already trust the chain. Custom mode instead installs third-party-signed certificates directly.

Question 48vCenter Server and Identity Management

Which command-line utility on the vCenter Server appliance is used to reset a forgotten SSO administrator password?

  1. vecs-cli
  2. service-control
  3. sso-config.sh
  4. vdcadmintool Correct answer.

Explanation

vdcadmintool, located in /usr/lib/vmware-vmdir/bin, offers an account password-reset option. It resets the credential in the VMware Directory Service where SSO account data is stored.

Question 49vCenter Server and Identity Management

Which vCenter Server appliance deployment size is rated for up to 100 hosts and 1,000 virtual machines?

  1. Small Correct answer.
  2. Medium
  3. Large
  4. Tiny

Explanation

vCenter sizing scales from Tiny, rated for roughly 10 hosts and 100 virtual machines, through Small at 100 hosts and 1,000 virtual machines, up to X-Large. The chosen size also fixes the CPU, memory, and storage allocated to the appliance.

Question 50vCenter Server and Identity Management

Which SSO component stores domain data such as users, groups, and passwords and replicates it among SSO services?

  1. The vSphere Client
  2. The VMware Directory Service Correct answer.
  3. The vCenter inventory service
  4. The ESXi host agent

Explanation

VMware Directory Service (vmdir) is an LDAP-based directory holding SSO domain data and replicating it between SSO services. It also stores the vsphere.local administrator account and solution users.