VMware VCP-VCF: Cloud Foundation Architect Practice Exam

What the VMware VCP-VCF exam covers

• VCF design principles and requirements gathering111 questions
• Consolidated vs standard topology and multi-domain design170 questions
• NSX overlay and network design within VCF153 questions
• vSAN design (ESA vs OSA, availability zones)128 questions
• Availability, recovery, and security design162 questions
• Lifecycle, monitoring, and capacity design126 questions

Free VMware VCP-VCF sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 850.

1. Question 1VCF design principles and requirements gathering

   During requirements gathering, an architect writes: "It is assumed that the customer will provide DNS and NTP services prior to VCF bring-up." What type of documentation element is this?

   • AAn assumptionCorrect
   • BA constraint
   • CA risk
   • DA design implication
   ✓ Correct answer: A

   An assumption is a statement the architect believes to be true for planning purposes but has not yet had formally confirmed by the customer. Stating that DNS and NTP services will be provided prior to bring-up, without confirmation, is a classic assumption that should be validated before the design proceeds to implementation.

   Why the other options are wrong

   • BA constraint is a confirmed, fixed limitation, whereas this statement is an unconfirmed belief about what will be provided.
   • CA risk describes an uncertain event with potential negative impact; while an incorrect assumption could later become a risk, as stated this is an assumption, not a risk.
   • DA design implication is a consequence of a design decision, not a belief about external dependencies.
2. Question 2VCF design principles and requirements gatheringSelect all that apply

   Which of the following are core responsibilities of SDDC Manager in a VCF 5.x environment? (Select all that apply.)

   • ACommissioning and decommissioning ESXi hostsCorrect
   • BPatching guest operating systems inside tenant VMs
   • CCreating, expanding, and deleting workload domainsCorrect
   • DDownloading and applying update/upgrade bundlesCorrect
   ✓ Correct answer: A, C, D

   SDDC Manager's scope covers host lifecycle (commission/decommission), workload domain lifecycle operations, and applying BOM-aligned update/upgrade bundles to the infrastructure and management components.

   Why the other options are wrong

   • BIn-guest patching belongs to the tenant's own tooling; SDDC Manager manages the infrastructure beneath the VMs.
3. Question 3Consolidated vs standard topology and multi-domain design

   A customer wants to deploy the management domain with the bare minimum of four hosts and the smallest possible Aria Suite footprint to save cost, with no plan to reassess sizing later. What risk should the architect highlight?

   • AThe four-host, smallest Aria Suite footprint is below the minimum VCF bill of materials and Cloud Builder will block validation
   • BAs workload domains and Aria Suite usage grow, the undersized management domain may exhaust its compute, memory, or storage headroom and require a disruptive later expansionCorrect
   • CUndersizing the management domain only affects Aria Operations analytics data retention and never impacts vCenter Server or NSX Manager performance
   • DThe main risk is that a four-host management domain cannot tolerate a single host failure while remaining within vSAN FTT=1 policy
   ✓ Correct answer: B

   Sizing the management domain at the bare minimum without accounting for growth can lead to resource contention as more VI workload domains and Aria Suite capacity are added later. Because expanding after the fact can be more disruptive, architects should build in appropriate headroom during initial sizing based on the customer's growth plans.

   Why the other options are wrong

   • AA four-host management domain with a minimal Aria footprint is a supported, valid configuration that passes bring-up validation.
   • CContention in an undersized management domain affects all its VMs, including vCenter and NSX Manager, not just Aria retention.
   • DA four-host cluster does tolerate one host failure under FTT=1; the highlighted risk is lack of growth headroom, not immediate resilience.
4. Question 4Consolidated vs standard topology and multi-domain design

   An architect is finalizing a design for a workload domain that must support future expansion to twice its initial host count without redesigning the network or storage architecture. Which planning consideration is most critical to validate during the initial design phase?

   • AThat EVC is left disabled from day one so that adding future hosts of any CPU generation is simpler and unconstrained
   • BThat the initial cluster is deployed at the maximum supported host count immediately, regardless of current workload demand
   • CThat vSphere HA remains disabled until the expansion phase to avoid restart events during the interim period
   • DThat the initial IP addressing, VLAN/overlay segment sizing, and vSAN datastore design have sufficient headroom to accommodate the doubled host countCorrect
   ✓ Correct answer: D

   To expand smoothly to double the host count later without redesigning networking or storage, the architect must ensure the initial IP address ranges, VLAN or overlay segment sizes, and vSAN datastore capacity planning already account for that future scale, avoiding the need to re-architect addressing schemes or storage layout later.

   Why the other options are wrong

   • ADisabling EVC would later block adding newer CPU generations without disruption, which is the opposite of accommodating expansion.
   • BDeploying at maximum host count on day one wastes capital and does not address the network or storage headroom needed for growth.
   • CDisabling vSphere HA removes restart protection during normal operations and does nothing to enable future expansion.
5. Question 5NSX overlay and network design within VCF

   In the NSX Distributed Firewall, which category of rules is evaluated with the highest precedence, ahead of Infrastructure, Environment, and Application rules?

   • AEnvironment
   • BApplication
   • CInfrastructure
   • DEmergencyCorrect
   ✓ Correct answer: D

   The Distributed Firewall organizes rules into categories that are evaluated in a fixed order: Emergency, Infrastructure, Environment, and Application. Emergency rules are evaluated first so that urgent, temporary restrictions, such as blocking a compromised workload, take precedence over all other configured policy.

   Why the other options are wrong

   • AEnvironment category rules are evaluated after Infrastructure but before Application, not ahead of Emergency.
   • BApplication category rules are evaluated last among these four categories, not first.
   • CInfrastructure category rules are evaluated after Emergency, not before it.
6. Question 6NSX overlay and network design within VCF

   During a VCF network design workshop, the customer's network team asks for the minimum MTU that must be configured on every physical switch port and uplink that carries NSX overlay traffic. What value should the architect specify as the hard minimum requirement?

   • A9000 bytes
   • B1600 bytesCorrect
   • C1500 bytes
   • D8900 bytes
   ✓ Correct answer: B

   NSX overlay traffic is Geneve encapsulated, which adds overhead to the original frame. VMware requires that every switch and uplink carrying overlay traffic support at least a 1600 byte MTU so encapsulated frames are not dropped or fragmented.

   Why the other options are wrong

   • A9000 bytes (jumbo frames) is the recommended value for optimal performance, but it is not the mandatory minimum.
   • C1500 bytes is the standard Ethernet MTU and does not leave enough headroom for Geneve encapsulation overhead.
   • D8900 bytes is not a documented NSX MTU requirement.
7. Question 7vSAN design (ESA vs OSA, availability zones)

   A 4-node all-flash vSAN OSA cluster will use RAID-5 erasure coding for FTT=1 to store 60 TB usable. What is the minimum raw capacity required to store this data, before accounting for slack space?

   • A90 TB
   • B80 TBCorrect
   • C120 TB
   • D60 TB
   ✓ Correct answer: B

   RAID-5 erasure coding in a 3+1 configuration for FTT=1 has a capacity overhead multiplier of approximately 1.33x, so 60 TB x 1.33 equals approximately 80 TB of raw capacity.

   Why the other options are wrong

   • AThis is closer to a 1.5x multiplier, characteristic of RAID-6 overhead, not RAID-5.
   • CThis corresponds to a 2x multiplier, characteristic of RAID-1 mirroring, not RAID-5 erasure coding.
   • DThis ignores the parity overhead entirely.
8. Question 8Availability, recovery, and security designSelect all that apply

   Which two justifications support designing a VCF cluster with N+1 host redundancy rather than exactly the minimum capacity needed to run current workloads? (Select two.)

   • AIt guarantees protection against the loss of an entire availability zone, which only a stretched cluster topology provides
   • BIt allows the cluster to tolerate a single host failure and still restart affected VMs without breaching admission controlCorrect
   • CIt allows one host to be placed into maintenance mode (for patching or hardware service) while retaining protection against an additional, unrelated host failureCorrect
   • DIt removes the need for vSphere HA admission control, since spare capacity is already reserved by the extra host
   ✓ Correct answer: B, C

   N+1 capacity ensures that after a single host failure, the remaining hosts have enough resources to run all VMs within admission control limits, and it also gives operators room to place a host into maintenance mode for patching or hardware service while still being protected against an unrelated additional host failure during that window.

   Why the other options are wrong

   • AProtection against losing an availability zone comes from a stretched topology, not from an extra host in one site.
   • DAdmission control is what reserves the capacity; an extra host does not make it unnecessary.
9. Question 9Availability, recovery, and security design

   In a multi-rack VCF pod design, how should top-of-rack switching be architected to avoid a rack-level single point of failure while maintaining uplink connectivity to the spine?

   • AEach rack should have its own pair of redundant top-of-rack switches, each uplinked to the spine/core layerCorrect
   • BOnly the rack containing the management domain needs redundant top-of-rack switches
   • CTop-of-rack switches are unnecessary if hosts connect directly to the spine
   • DAll racks should share a single pair of top-of-rack switches located in one rack
   ✓ Correct answer: A

   Giving each rack its own redundant pair of top-of-rack switches, each with uplinks to the spine or core layer, ensures that a switch or uplink failure in one rack does not affect hosts in other racks, and that no single rack's networking is a dependency for hosts physically located elsewhere.

   Why the other options are wrong

   • BAll racks running production hosts, including workload domain racks, benefit from redundant top-of-rack switching, not just the management domain rack.
   • CTop-of-rack switches are a standard part of leaf-spine designs; direct host-to-spine connections are not the typical or recommended VCF physical network topology.
   • DSharing one pair of top-of-rack switches across multiple racks reintroduces a single point of failure for every rack and adds unnecessary cabling distance and complexity.
10. Question 10Lifecycle, monitoring, and capacity design

    Before applying a VCF upgrade bundle to a workload domain, an architect wants to reduce the risk of a failed upgrade mid-way through the process. Which capability of SDDC Manager should be used first?

    • AManually snapshot every virtual machine in the workload domain first so they can be reverted if the bundle fails midway
    • BDelete unused and superseded bundles from the SDDC Manager repository to reclaim depot disk space before applying the new bundle
    • CDisable DRS on all clusters in the domain first so hosts are not rebalanced while the upgrade bundle runs
    • DRun the SDDC Manager upgrade precheck to validate component health, compatibility, and resource readiness before starting the bundleCorrect
    ✓ Correct answer: D

    SDDC Manager provides an upgrade precheck that evaluates the health of the domain's components, resource availability, and compatibility before an upgrade bundle is applied, surfacing issues the architect can remediate ahead of time. Running this precheck lowers the chance of a mid-upgrade failure.

    Why the other options are wrong

    • ASnapshotting every VM is impractical, consumes capacity, and does not validate upgrade readiness the way the precheck does.
    • BFreeing repository space may be housekeeping but does not assess component health or upgrade compatibility.
    • CDisabling DRS removes load balancing during remediation and does not surface pre-upgrade readiness issues.

Who this VMware VCP-VCF practice exam is for

This practice set is for anyone preparing for the VMware VCP-VCF: Cloud Foundation Architect exam at the foundational level - from first-time candidates building a foundation to experienced VMware practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this VMware VCP-VCF practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real VMware VCP-VCF exam.

Related VMware resources

• VMware VCP-VCF study guideKey concepts
• VMware practice examsAll VMware
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• VMware VCP-VVF practice examRelated
• VMware VCAP-VCF practice examRelated
• VMware VCP-VCF Administrator (2V0-17.25) practice examRelated

VMware VCP-VCF practice exam FAQ