VMware VCAP-VCF: Cloud Foundation Architect (3V0-12.26) Practice Exam

What the VMware VCAP-VCF exam covers

• 1 IT Architectures, Technologies, Standards155 questions
• 2 VMware Products and Solutions95 questions
• 3 Requirements, Conceptual, Logical and Physical Design133 questions
• 3 Design for AMPRS157 questions
• 3 Identity, Consumption and Monitoring Design94 questions

Free VMware VCAP-VCF practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 634-question bank.

1. Question 11 IT Architectures, Technologies, StandardsSelect all that apply

   A regional bank's board approves a move to VMware Cloud Foundation 9.0, and the architect is sorting workshop statements into business and technical requirements. Which TWO statements are business requirements? (Choose TWO)

   • AReduce time to market for new digital banking servicesCorrect
   • BMeet the financial regulator's rules in every country servedCorrect
   • CApply NSX distributed firewall rules in every workload domain
   • DStretch the management domain cluster across two zones
   ✓ Correct answer: A, B

   A business requirement states what the organization needs in business terms and is owned by stakeholders such as the board or the compliance office. Shorter time to market and regulatory compliance are outcomes the bank wants, independent of any product. Each is later translated into technical requirements, for example a provisioning time target or segmentation and audit properties, that VCF 9.0 design decisions then satisfy.

   Why the other options are wrong

   • CApplying NSX distributed firewall rules is a technical choice about how segmentation is implemented, not an outcome stated in business terms.
   • DStretching the management domain cluster across two zones is a technical decision that could satisfy an availability need; it is not itself a business need.
2. Question 21 IT Architectures, Technologies, Standards

   A contract fixes the go-live date, and the customer's operations lead holds only vSphere skills with no NSX training. Which mitigation for the skills gap is most defensible given the fixed date?

   • ARecord the gap as a customer-owned risk and provide no interim help
   • BRun NSX with default policies only so less training is needed
   • CGate go-live on the lead finishing NSX certification, moving the date
   • DEngage partner services for knowledge transfer while training runsCorrect
   ✓ Correct answer: D

   The fixed date is a constraint, so the mitigation must work within it. A partner or professional services team running operations with knowledge transfer covers the gap immediately while formal training proceeds. The architect can also reduce the NSX skill needed day to day, for example by consuming networking through VPCs in vCenter, which the 9.0 design describes as simple consumption for non-network specialists.

   Why the other options are wrong

   • ARecording the gap as a customer-owned risk with no interim help leaves the platform run by an untrained team, a risk accepted but not mitigated.
   • BRunning NSX with default policies only gives up segmentation the design may need, weakening security to hide a skills gap.
   • CGating go-live on certification moves a contractually fixed date, which the constraint does not allow.
3. Question 31 IT Architectures, Technologies, Standards

   A bank decides to deploy VCF Operations in the High Availability model in the default management cluster. Which implication does the VCF 9.0 design record for this decision?

   • AA witness node in a third site, within 30 ms of the cluster
   • BA minimum of four ESX hosts, since anti-affinity separates the nodesCorrect
   • CNo certificate changes at all, since one node FQDN covers the whole cluster
   • DA second VCF instance, since the nodes must sit in different availability zones
   ✓ Correct answer: B

   The High Availability model runs three analytics nodes, primary, replica and data, with DRS anti-affinity so no two share a host, and the design lists the implication of a minimum of four ESX hosts. It also needs certificates whose SAN covers every node and the load balancer, and the collector must be expanded to a collector group manually.

   Why the other options are wrong

   • AA witness node in a third location belongs to the Continuous Availability model, where it needs 30 ms or less to the cluster nodes.
   • CThe certificate SAN must list every node FQDN and the load balancer FQDN, so certificates do change.
   • DA second VCF instance in another availability zone is a requirement of the Continuous Availability model, not of High Availability.
4. Question 42 VMware Products and Solutions

   A university's IT department will offer self-service infrastructure to twelve academic departments as VCF Automation tenants. Isolation needs are modest and the priority is low cost through pooled capacity. Which tenancy deployment model fits?

   • AA dedicated VCF instance per school under central VCF Automation
   • BA shared workload domain that hosts multiple organizationsCorrect
   • CA dedicated VCF fleet with its own VCF Automation per school
   • DA dedicated workload domain for each school under central management
   ✓ Correct answer: B

   The 9.0 tenancy guidance says multi-tenancy suits cost-effective, shared cloud services, while single tenancy suits strong isolation, compliance or performance guarantees. A shared workload domain for multiple organizations lets the twelve departments share capacity, with organization boundaries in VCF Automation providing a secure boundary between them. The implication is that departments share infrastructure and must be governed with quotas.

   Why the other options are wrong

   • AA dedicated instance per organization adds a management domain per department, raising cost well beyond the goal.
   • CA dedicated fleet per tenant is the strongest isolation model and the most expensive, beyond modest isolation needs.
   • DA dedicated workload domain per organization adds hardware per department, which works against shared capacity.
5. Question 53 Requirements, Conceptual, Logical and Physical Design

   To save time, a team proposes going straight from gathered requirements to the physical design and skipping the conceptual model. What is the most significant risk of this approach?

   • AVendor support will refuse to support an environment built that way
   • BThe customer pays less because fewer design hours are billed
   • CDecisions are made without an agreed view of entities and relationsCorrect
   • DThe VCF Installer will stop and reject a deployment with no design file
   ✓ Correct answer: C

   Without a conceptual model, stakeholders never agree the major entities and how they relate, such as sites, tenants and capabilities. Physical choices then rest on unvalidated interpretations of the requirements, and mismatches surface late, when hardware is bought and rework is expensive.

   Why the other options are wrong

   • ASupport entitlement does not depend on which design documents were produced, so vendor support is not the risk; design quality is.
   • BPaying for fewer design hours is a cost effect rather than a design risk, and later rework usually costs more than was saved.
   • DThe VCF Installer takes a deployment specification through its UI or as JSON, not a conceptual design file.
6. Question 63 Requirements, Conceptual, Logical and Physical Design

   An architect inherits a proposed cluster where half the hosts have four NICs for NSX and half have two, with one transport node profile expecting four active uplinks. Which physical design decision should the architect make?

   • AKeep the mix; NSX puts the two-NIC hosts in another transport zone
   • BKeep the mix; the two-NIC hosts simply receive half as many TEPs
   • CKeep the mix; NSX builds a second uplink profile for two-NIC hosts
   • DStandardize the NIC count or split the hosts into uniform clustersCorrect
   ✓ Correct answer: D

   A transport node profile applies one uplink profile to every host in the cluster. Hosts without the four physical NICs it expects cannot be prepared consistently, so preparation fails or leaves them inconsistent. The 9.0 ESX design also recommends uniform hosts in the default management cluster. The implication is either NIC purchases for the two-NIC hosts or a second cluster with its own profile, which the design must size.

   Why the other options are wrong

   • ATransport zone membership comes from the profile, not from a host's NIC count, so no automatic split occurs.
   • BHosts missing the expected NICs are not prepared with fewer TEPs; the configuration fails or is inconsistent.
   • CNSX does not generate a second uplink profile for hosts that differ; one profile applies to the whole cluster.
7. Question 73 Requirements, Conceptual, Logical and Physical DesignSelect all that apply

   A service provider chooses the Dedicated vSphere Cluster for NSX Edge Nodes distributed switch model so that its Edge nodes get the most throughput. Which TWO physical design statements follow from that model? (Choose TWO)

   • AEdge nodes are held to one NIC so the others serve VMs
   • BOnly bare-metal Edges fit, as Edge VMs cannot use the NICs
   • CNetwork I/O Control stays on to protect Edge node traffic
   • DThe Edge nodes use all of that cluster's physical NICsCorrect
   • ENetwork I/O Control is turned off by hand on both switchesCorrect
   ✓ Correct answer: D, E

   The 9.0 distributed switch models describe a Dedicated vSphere Cluster for NSX Edge Nodes in which the Edge nodes use all of the cluster's NICs, and Network I/O Control on both distributed switches must be disabled manually after deployment for best performance. The implication is a post-deployment task in the runbook and a cluster whose hosts serve only Edge nodes.

   Why the other options are wrong

   • AIn this model the Edge nodes use all of the cluster's NICs, so they are not held to a single NIC.
   • BThe model is described for Edge nodes running in a dedicated vSphere cluster, so Edge VMs use the NICs.
   • CThe model's guidance is to disable Network I/O Control on both switches after deployment for best performance.
8. Question 83 Design for AMPRS

   A management domain vCenter becomes unbootable halfway through a patch. A file-based backup taken just before the patch exists, and so does an image-level backup from the night before. Which recovery approach should the runbook prefer?

   • AReapply the patch to the broken appliance and retry until it boots
   • BRestore the image backup, as file backups cannot hold inventory
   • CRebuild vCenter from scratch, as no backup survives a failed upgrade
   • DDeploy a new vCenter from the installer and restore the file backupCorrect
   ✓ Correct answer: D

   In 9.0 the management domain vCenter restore deploys a new vCenter appliance from the vCenter ISO installer onto a healthy management host and performs a file-based restore, after which the SSH keys stored in SDDC Manager are refreshed. The pre-patch file-based backup yields a clean appliance at the pre-patch state, without the corrupted disk. vCenter also supports image-based backup, so the nightly image stays a fallback. The implication is rehearsing the two-stage restore and the SDDC Manager key refresh.

   Why the other options are wrong

   • ARepeating a failed patch on a corrupted appliance adds risk without a known-good state to return to.
   • BFile-based backup restores vCenter configuration and inventory; it is the documented restore path in 9.0.
   • CBoth backups remain usable after a failed patch, so no rebuild is needed; the file-based restore exists for exactly this case.
9. Question 93 Design for AMPRS

   A bank uses NSX Federation and adopts the design recommendation to manage certificate lifecycle with VCF Operations, replacing VMCA-signed certificates with ones from its internal CA using SHA-2. Which implication must the certificate operations plan include?

   • AVCF Operations also rotates the Active Directory domain certificates
   • BESX host certificates can no longer be regenerated after renaming
   • CThe internal CA must issue SHA-1 certificates for older components
   • DNSX Global Manager certificates must still be handled manuallyCorrect
   ✓ Correct answer: D

   The 9.0 certificate design recommends replacing default VMCA certificates on management components with internal CA certificates (VCF-SEC-RCMD-CERT-001), using SHA-2 or higher (-002), and managing the certificate lifecycle with VCF Operations (-003). The documented implication of -003 is that NSX Global Manager certificates are managed manually, so the plan should give them their own renewal calendar and owner. The implication of -001 is a longer preparation time for generating CSRs and issuing certificates.

   Why the other options are wrong

   • AVCF Operations manages certificates of VCF components; directory and identity provider certificates stay with their owners.
   • BThe design requires regenerating each host certificate after assigning its FQDN, so regeneration remains part of the process.
   • CThe design recommendation is SHA-2 or higher for certificates; SHA-1 is not a fallback for any component.
10. Question 103 Identity, Consumption and Monitoring Design

    A service provider's NOC learned about an expired certificate and a time-sync fault only after both caused outages. It wants proactive views of certificate status, time sync, DNS resolution and vCenter service state across its VCF instances inside VCF Operations. Which capability should the monitoring design use?

    • AVCF Health within VCF Operations diagnosticsCorrect
    • BLog Assist bundles from VCF Operations
    • CCompliance benchmarks scored against CIS rules
    • DDrift templates set for each vCenter and cluster
    ✓ Correct answer: A

    VCF Health, part of VCF Operations diagnostics, monitors the VCF stack through a Component View and a VCF View that drills from a management domain down to a single ESX host. Its screens target the areas that generate support requests, including Certificates Health, NTP and DNS Health, vCenter Health with the state of critical vCenter services, VM operations, vMotion and snapshots. That gives the NOC the proactive views it lacked. The implication is that VCF Health shows only active inventory objects, so decommissioned items drop out of its history.

    Why the other options are wrong

    • BLog Assist generates log bundles with diagnostic findings for Broadcom support cases; it reacts to a problem rather than watching for one.
    • CCompliance benchmarks score configuration against hardening standards; they do not track certificate expiry or NTP health.
    • DConfiguration drift compares vCenter and cluster settings to a desired state; it does not report certificate or DNS health.

Who this VMware VCAP-VCF practice exam is for

This practice set is for anyone preparing for the VMware VCAP-VCF: Cloud Foundation Architect (3V0-12.26) exam at the foundational level - from first-time candidates building a foundation to experienced VMware practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this VMware VCAP-VCF practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real VMware VCAP-VCF exam.

Related VMware resources

• VMware VCAP-VCF study guideKey concepts
• VMware practice examsAll VMware
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• VMware VCP-NV 2024 practice examRelated
• VMware VCP-VCF Administrator (2V0-17.25) practice examRelated
• VMware VCP-VCF practice examRelated

VMware VCAP-VCF practice exam FAQ