Free VMware vSphere Foundation 9.0 Administrator Practice Questions

To ensure that only specific users can manage VMs in a specific VMware vCenter folder, the following three steps are required:

Create a new role in vCenter with VM management permissions(Answer B):You must define a custom role tailored to managing VMs, which includes permissions such as powering on/off VMs, editing VM settings, and accessing consoles. This role must include the appropriate privileges under the “Virtual machine” category in vCenter permissions.

Apply the role to the specific vCenter folder(Answer C):The custom role needs to be applied directly to the target vCenter folder. This enables scope-based access control, where permissions are applied only to VMs within that folder.

Assign the new role to the appropriate users/groups(Answer A):After creating the role and applying it to the folder, the role must be associated with the correct users or groups. This step uses the vCenter Server's identity source integration to assign roles.

Why the other options are incorrect:

D.  

Add the identity source to vCenter:This is a prerequisite step for any role assignment but is not directly required in this specific scenario if the identity source is already configured.

E.  

Create a datastore cluster:This is unrelated to managing VM access. Datastore clusters pertain to storage management and are not involved in user permissions or role assignments.

VCF Operations requires that custom SSL certificates meet these requirements:

Certificates and private key must be inPEM format. (A)

Theserver certificate must be listed firstin the file. (D)

The file must include theserver certificate, private key, and full certificate chain(issuing/intermediate/root CA). (E)

Why others are wrong:

B.  

Server certificate last→ Incorrect, it must be first.

C.  

Cannot use SAN extension→ Incorrect, SAN is supported and recommended.

F.  

PFX format→ Not supported for VCF Operations.

To enableenhanced capabilities of Storage Operations for vSAN 9.0 in VCF Operations(Diagnostic Troubleshooting, Benchmarking, and Optimizing), administrators must complete several prerequisites that ensure vSAN health, performance, and permissions are properly set up.

Enable and start the vSAN Performance service in the target vCenter (B):

The vSAN Performance Service must be enabled for cluster-level monitoring.

This provides the telemetry data needed for diagnostic and benchmarking capabilities in VCF Operations.

Without enabling this service, no performance metrics can be collected.

Configure a vSAN account for the vCenter Integration Instance (C):

A dedicated vSAN service account must be configured so that VCF Operations can communicate with vCenter for vSAN data collection.

This ensures secure and role-specific access for monitoring operations.

Assign the credentials configured in the vCenter Integration instance to have access to vSAN objects (E):

The credentials used in the vCenter integration must have the required privileges to access vSAN objects (such as datastore, cluster objects, and health checks).

This ensures that VCF Operations can run diagnostics, benchmarking, and optimization functions without permission errors.

Why the other options are incorrect:

A.  

No configuration required, Run New Diagnostics is enabled automatically:❌Incorrect. Configuration is required before these advanced features can be enabled.

D.  

Assign the VCF Operations Service Account administrative rights to vSAN Objects:❌Too broad and not a best practice. Instead, specific rights via the vCenter integration account (option E) are recommended.

F.  

Open port 5989 on each VCF Operations node on which the vSAN adapter exists:❌Not required for enabling vSAN advanced diagnostics in VCF 9.0. vSAN operations rely on vCenter connectivity, not direct port 5989.

When enabling aSupervisor Cluster in vSphere with Tanzuusing vSphere networking and the Foundation Load Balancer:

You must provide astatic IP rangefor the Supervisor control plane VMs so they can be deployed with dedicated addresses. (B)

You must assign avSphere Distributed Switch (VDS)with an appropriateport groupfor Supervisor networking. (E)

Other options:

A.  

Namespace template→ Optional after Supervisor is enabled, not required at setup.

C.  

Tier-0 Gateway→ Applies to NSX networking, not vSphere networking.

D.  

VM Service→ Enabled after Supervisor, not a prerequisite.