VMware VCP-VVF: vSphere Foundation Administrator Study Guide
The VMware VCP-VVF (VMware vSphere Foundation Administrator) certification validates your ability to deploy, configure, and operate a VMware vSphere Foundation environment, spanning ESXi and vCenter Server, VM and resource management, networking, storage including vSAN, and lifecycle, monitoring, and troubleshooting. It is the current successor to the retired VCP-DCV. It is aimed at administrators and engineers who manage production vSphere infrastructure and want to prove core competency across the modern subscription-based VVF stack.
Reviewed Jul 2026.
Domain 1: VMware vSphere Foundation architecture and licensing
- VVF and VCF are sold as subscriptions rather than perpetual licenses, and VVF is the foundational offering that VCF extends for hybrid extensions such as VMware Cloud on AWS.
- VVF licensing uses a per-core model that requires a minimum of 16 core licenses per physical CPU, and any CPU with more physical cores than that minimum must be licensed for its full actual core count.
- To compute total core licenses, license each CPU at whichever is greater between its actual physical core count and the 16-core minimum, then sum across sockets (for example, a 12-core CPU plus a 20-core CPU equals 16 plus 20, or 36 core licenses).
- VVF bundles the Enterprise Plus feature set, vCenter Server, vSAN capacity, and Aria Operations for Logs, but does not include NSX or Aria Automation.
- VVF includes an entitlement of 0.25 TiB of vSAN capacity per licensed core, and this bundled amount is a floor that additional vSAN capacity can be purchased on top of.
- A subscription license is valid only for its purchased term; if it is not renewed before expiration, the affected assets lose valid license status and behave like an unlicensed or expired-evaluation asset.
- When a license expires or a host is unlicensed, most configuration and provisioning operations become blocked, matching the restrictions seen on an unlicensed asset.
- License overage is largely visibility-based: exceeding purchased capacity is still allowed but is surfaced as a warning in the Licenses view rather than being hard-blocked.
- Enabling premium features on an insufficient license fails; for example, DRS controls are unavailable and enabling DRS on an unlicensed cluster produces a licensing error.
- License keys are added and managed under Administration, then Licensing, then Licenses in the vSphere Client.
- Auto Deploy provides stateless, network-boot provisioning by streaming an ESXi image over the network at boot, and it is part of the Enterprise Plus feature set that VVF includes.
- vMotion and Storage vMotion are included in VVF's licensed feature set, though Storage vMotion is available at lower tiers as well.
- Because VVF does not include NSX, vSphere with Tanzu on VVF relies on standard vSphere networking plus a separate load balancer for Kubernetes service load balancing, and separating management from workload networks isolates management services from unpredictable workload demand.
- A practical adoption path is to start with VVF for straightforward virtualization needs and layer on VCF entitlements later if NSX or full SDDC capabilities become necessary.
Domain 2: vCenter Server and ESXi installation and configuration
- A permission is the pairing of a user or group with a role on a specific inventory object, and enabling Propagate to children extends that permission down the hierarchy to descendant objects such as hosts, resource pools, and VMs.
- A permission assigned directly to a user on an object overrides any permission that user inherits through a group on that same object.
- The Read-only role lets a user view an object's state and configuration without changing anything or running tasks.
- Global Permissions are managed in the Administration area at a level above any individual vCenter's inventory, applying across the entire SSO domain.
- Enhanced Linked Mode is enabled by joining vCenter instances to the same SSO domain, is underpinned by vmdir multi-master replication, and supports linking up to 15 vCenter Server instances.
- Repointing a vCenter to a different SSO domain does not carry over local permissions, so they must be recreated afterward.
- vCenter supports additional and external authentication methods, including RSA SecurID and identity-provider federation, where permissions still map from IdP groups or claims.
- The default root password expiration on the vCenter Server Appliance is a 90-day maximum age, configurable from the VAMI Administration tab.
- vCenter services are managed with the service-control command run from the Bash shell, using options such as --status --all, --stop --all, and --start --all.
- The appliance Bash shell is reached via SSH or the VM console after Bash access is enabled, not through the vSphere Client or VAMI directly.
- Support bundles collect logs and diagnostic data for troubleshooting, whereas file-based backups capture the database, inventory, and configuration needed to actually restore vCenter.
- Restoring from a file-based backup requires deploying a new appliance and selecting the Restore workflow in the installer.
- vCenter Server High Availability (VCHA) requires at least a vCenter Server Standard license and is not available on lower editions.
- Host profiles are created by extracting a reference host's configuration into a reusable profile object that can be applied to other hosts for consistency and compliance.
- ESXi certificate management mode is governed by the vpxd.certmgmt.mode advanced setting, and ESXi hosts are upgraded via interactive or scripted installer methods or vLCM image remediation rather than VCHA or cmsso-util.
- ESXi uses two boot banks so that during a patch or upgrade the new image is written to the inactive bank while the previous known-good image stays intact, allowing rollback if the new image fails to boot.
Domain 3: Virtual machine and resource management (DRS, HA, vMotion)
- DRS handles initial VM placement and ongoing load balancing across a cluster using vMotion, and starting in vSphere 7.0 it evaluates balance using each VM's individual DRS score (VM happiness) rather than a cluster-wide standard-deviation metric.
- In Partially Automated DRS mode, DRS applies initial placement automatically but requires administrator approval for migrations, including host evacuations for maintenance mode.
- Priority 1 DRS recommendations are always applied or displayed regardless of the migration threshold setting.
- The default resource share ratio for Low, Normal, and High is 1:2:4, so High receives exactly twice the shares of Normal.
- vSphere HA elects a master host, and subordinate hosts send network heartbeats to the master over the management network, while datastore heartbeats help distinguish an isolated host from a failed one.
- VM Component Protection with a Conservative APD policy only powers off affected VMs when HA is confident they can be restarted successfully on another host.
- Dedicated failover hosts are excluded from normal DRS load balancing and placement so their capacity stays reserved to absorb VMs that HA restarts after a host failure.
- EVC masks CPU feature differences to establish a consistent baseline across hosts, guaranteeing vMotion compatibility within a cluster.
- vMotion is blocked when a VM has a CD/DVD drive connected to media unreachable from the destination host, such as an ISO on local storage; disconnecting or relocating the media allows the migration.
- Attached USB devices can still permit vMotion when the device's vMotion support option is enabled.
- Encrypted vMotion offers three per-VM settings (Disabled, Opportunistic, and Required), defaults to Opportunistic, and encrypts migration traffic with 256-bit AES-GCM.
- Storage vMotion supports migrating virtual machines that have snapshots, moving VM files between datastores while the VM stays powered on.
- Fault Tolerance requires a snapshot-free VM and vMotion-compatible hosts, keeping the primary and secondary VMs running on separate hosts.
- VMXNET3 is a paravirtualized adapter that supports jumbo frames and multiqueue features such as Receive Side Scaling, generally outperforming the emulated E1000E adapter with lower CPU overhead.
- Raw Device Mappings use a mapping file and require block-storage LUNs; virtual compatibility mode behaves like a virtual disk and supports snapshots, while physical mode does not.
- VM compatibility (virtual hardware version) defines the minimum ESXi version required to run the VM, and the three provisioning formats are Thin, Thick Lazy Zeroed, and Thick Eager Zeroed; content libraries store deployable content such as OVF/OVA and VM templates, ISO images, and scripts.
Domain 4: Networking (standard and distributed switches, VMkernel)
- Route based on originating virtual port ID is the default teaming policy on both standard and distributed switches, mapping each vNIC to an uplink by its port ID with a mapping that stays consistent unless a failover occurs.
- In a teaming failover order, Standby adapters carry no traffic during normal operation and activate automatically only after every Active uplink has failed.
- IP hash teaming requires switch-side EtherChannel configuration, unlike originating virtual port ID or explicit failover order policies.
- A new vSphere Standard Switch defaults to 128 virtual ports for connecting VMkernel adapters and VM network adapters.
- Uplink adapters are the physical NICs (vmnics) that connect a switch to the physical network, and using three or more uplinks avoids ambiguity when a beacon-probing failover misses a beacon.
- Network I/O Control (NIOC) allocates and prioritizes bandwidth across traffic types, with real system traffic types including vMotion, vSAN, and Management; a Limit is an always-enforced absolute bandwidth ceiling.
- The Provisioning TCP/IP stack carries Network File Copy traffic for cold migration, VM cloning, and snapshot-related copies, but live vMotion of a powered-on VM uses the separate vMotion traffic type instead.
- vSphere Replication NFC traffic is a target-side VMkernel service used to directly receive replicated data.
- For iSCSI port binding, each bound VMkernel adapter must map to exactly one active physical NIC with others marked unused, and must share Layer 2 adjacency with the target; port binding should be avoided for routed iSCSI targets, where normal IP routing is used instead.
- The command esxcli network ip route ipv4 add configures a default route or gateway for a specific TCP/IP stack.
- Per-port policy override lets individual ports have fine-grained settings, and security, traffic shaping, and teaming/failover policies can each be overridden per port group.
- Private VLAN secondary port types are promiscuous, community, and isolated.
- Forged Transmits controls whether outbound frames with a source MAC address that does not match the adapter are allowed to pass.
- LLDP discovery is supported only on distributed switches, NetFlow exports flow records to an external collector, and a vDS version upgrade cannot be reversed.
Domain 5: Storage (datastores, vSAN, storage policies)
- Unmounting a VMFS datastore is a non-destructive, reversible action that removes it from a host's active view while leaving on-disk data intact, whereas deleting a datastore destroys the VMFS partition and all its data.
- Deleting a shared VMFS datastore destroys the VMFS partition on the LUN itself, so every host that shares that LUN loses the datastore and its data simultaneously.
- A single VMFS-6 extent can be up to 64 TB, and larger datastores are built by spanning multiple extents; VMFS-6 UNMAP space reclamation runs asynchronously in the background and is configurable per datastore.
- vSAN Storage Policy Based Management (SPBM) drives object placement, with valid rules including Failures to tolerate and IOPS limit for object; noncompliance can result from host failures or maintenance and from policy edits that exceed available resources.
- The vSAN Express Storage Architecture (ESA) uses a single per-host storage pool built from NVMe devices with no disk groups and no separate cache tier, relying on a log-structured file system that performs compression and checksums inline on sequential writes.
- vSAN OSA RAID-6 erasure coding requires a minimum of 6 hosts.
- vSAN applies data reduction before encryption, allowing deduplication and compression, RAID/erasure coding, and encryption to be used together.
- vSAN self-heals detected corruption, validating checksums both during I/O and via background scrubbing.
- Witness Traffic Separation (WTS) lets witness traffic use its own VMkernel interface, separate from the main vSAN data network, which is useful in 2-node and stretched-cluster topologies.
- The vSphere Native Key Provider is built into vCenter and removes the need for an external KMS to enable encryption.
- In storage policy rules, common rules group encryption and tag-based rules separately from vSAN and VVols data-service rules; system capabilities are provided by the array or VASA provider, while tags are assigned manually by administrators.
- VVols relies on SPBM so that policies drive per-VM and per-VMDK capability enforcement on the array through the VASA provider.
- Round Robin path selection cycles I/O across all active paths for automatic load balancing, with a default path-switching threshold of 1000 I/Os per path.
- iSCSI supports static discovery to manually add a known target without a SendTargets query, dependent hardware iSCSI adapters offload iSCSI processing but still rely on VMkernel network configuration, and NFS 3 lacks Kerberos support and uses a single connection per datastore; Storage DRS supports VMDK anti-affinity, VM anti-affinity, and a default intra-VM VMDK affinity rule.
Domain 6: Monitoring, lifecycle management, and troubleshooting
- Seeing ballooning and hypervisor swapping occur together indicates the host is actively reclaiming memory under real memory contention.
- Active memory estimates a VM's working-set usage, while Consumed memory is the actual host memory granted to the VM.
- Aria Operations aggregates underlying metrics into three headline badges: Health for current state and faults, Risk for projected future capacity or configuration problems, and Efficiency for optimization and reclaimable resources.
- esxtop and resxtop, along with Aria Operations, are used to detect and analyze resource contention, with %RDY and %CSTP being the primary esxtop CPU counters for spotting CPU scheduling contention.
- VM Component Protection (VMCP), configured in a cluster's Failures and Responses settings, provides separate configurable automated responses to Permanent Device Loss (PDL) and All Paths Down (APD) conditions.
- An orphaned VM means vCenter's inventory record no longer matches what the host reports, so the fix is to remove the stale record and re-register the VM from its files if they still exist on disk.
- An early CPU-compatibility failure during vMotion points to a CPU feature-set mismatch, which enabling EVC at an appropriate baseline is meant to mask.
- vSAN datastore accessibility depends on healthy cluster membership and vSAN network connectivity, not merely on the datastore being visible in inventory.
- Replacing a failed vSAN disk requires evacuating it, removing it from its disk group, physically replacing it, and re-adding it.
- In vSphere Lifecycle Manager (vLCM), an image is composed of individually selectable components, a vendor Hardware Support Manager supplies the firmware and drivers add-on, and an Unknown host status means vLCM has not yet evaluated the host.
- A per-VM VMware Tools upgrade policy can automate Tools upgrades at the next power cycle.
- The remote syslog destination is set with esxcli system syslog config set --loghost, and the hostd.log file records the host management daemon's own activity and errors.
- Frequent causes of a stuck HA configuration include missing heartbeat-datastore access and blocked management-network ports, and vmkping -d -s 8972 tests jumbo-frame connectivity end to end.
- The vSphere Client Summary tab consolidates health, power state, guest OS, and basic resource usage at a glance; vCenter ships with a library of default alarms for hosts, VMs, datastores, and other objects; and the Past Day performance interval defaults to 5-minute rollup samples.
VMware VCP-VVF exam tips
- Practice the per-core license math: license each CPU at the greater of its actual cores or the 16-core minimum, then sum across sockets, and remember VVF includes 0.25 TiB of vSAN capacity per licensed core.
- Know exactly what VVF includes versus VCF: VVF bundles Enterprise Plus, vSAN, vCenter, and Aria Operations for Logs but not NSX or Aria Automation, which affects Tanzu load balancing and hybrid-cloud scenarios.
- Memorize default values, since the exam tests them often: 128 standard-switch ports, 90-day root password age, 1:2:4 share ratio, Round Robin's 1000-I/O threshold, and Opportunistic Encrypted vMotion.
- For vMotion and DRS questions, focus on blockers and modes: unreachable CD/DVD or device media blocks migration, Partially Automated still needs approval for migrations, and EVC masks CPU differences.
- Distinguish backup from diagnostics and recovery actions: file-based backup plus a fresh appliance restore recovers vCenter, support bundles are only for troubleshooting, and unmount is reversible while delete destroys data on the shared LUN.
Study guide FAQ
How is VCP-VVF different from the retired VCP-DCV?
VCP-VVF is the current successor to VCP-DCV and validates the same core vSphere administration skills across ESXi, vCenter, VMs, networking, storage, and lifecycle, but framed around the subscription-based VMware vSphere Foundation stack rather than the older perpetual data center virtualization licensing.
Do I need to know NSX for this exam?
No. VVF does not include NSX, so the exam focuses on standard and distributed vSphere switch networking. You should understand that Kubernetes service load balancing on Tanzu with VVF relies on vSphere networking plus a separate load balancer rather than integrated NSX networking.
How much does licensing and vSAN capacity math matter?
Quite a bit. Expect questions that require computing core-license totals using the 16-core-per-CPU minimum and actual-core rule, and that test the bundled 0.25 TiB of vSAN capacity per licensed core, plus how expiration and overage are handled.
Should I focus on OSA or ESA for vSAN storage questions?
Know both. ESA uses a single per-host NVMe storage pool with no disk groups or separate cache tier and inline data services, while OSA uses disk groups with cache and capacity tiers. Be ready to compare their architectures and recall requirements such as RAID-6 needing at least 6 hosts.