VMware VCF (VMware Cloud Foundation) interview questions

VCF bundles vSphere (ESXi + vCenter) for compute, vSAN for storage, NSX for networking and security, and SDDC Manager to deploy and lifecycle-manage it all as one stack. SDDC Manager is the differentiator — it automates bring-up, patching and certificate rotation across the whole platform.

The management domain is the first domain SDDC Manager deploys and runs the management components (vCenter, NSX managers, SDDC Manager). Workload (VI) domains carry the actual tenant/application VMs and have their own vCenter and resources. Separating them keeps management lifecycle and failures isolated from production workloads.

vSAN pools local disks across hosts into a shared datastore and protects data with storage policies. FTT (Failures To Tolerate) sets how many host/disk failures an object survives — FTT=1 with RAID-1 keeps two copies plus a witness, so you need enough hosts. You set protection per-VM through policy, not per-LUN.

NSX provides software-defined networking: logical switches (overlay/Geneve), distributed routing, and crucially a distributed firewall that enforces micro-segmentation at each VM's vNIC — east-west security without hair-pinning to a physical firewall. It also brings load balancing, VPN and multi-site networking in software.

Through SDDC Manager Lifecycle Management: download the bundle, run it against the management domain first, then workload domains, in the supported order and sequence it enforces. It respects vSAN and cluster health and does hosts in a rolling fashion so workloads keep running. You do not patch each component by hand.

HA restarts VMs on surviving hosts after a host failure — it is about recovery. DRS balances load by vMotioning VMs across hosts based on resource use, and can place VMs at power-on — it is about efficiency. They complement each other: DRS keeps things balanced, HA brings them back after a failure.

The witness holds metadata (not data) to break ties so the cluster can tell a real failure from a network partition and keep a quorum. In stretched or 2-node clusters the witness lives at a third site/host; without it a split-brain could corrupt or down the datastore.

Confirm both hosts share the VM's storage and networks, have a vMotion-enabled VMkernel on the same subnet with working MTU (jumbo frames must match end to end), compatible CPU (or EVC enabled on the cluster), and enough resources on the target. The task error and vpxd logs usually name the exact blocker.

Use the NSX distributed firewall with security groups built on tags/VM attributes rather than IPs, and default-deny east-west traffic, allowing only required flows. Because the rule is enforced at each VM's vNIC, a compromised VM cannot move laterally even within the same subnet.

Size for usable capacity after the FTT policy overhead (RAID-1 doubles, RAID-5/6 adds parity), keep ~25-30% slack free for rebuilds and so vSAN can self-heal, and account for dedup/compression realistically. Plan host count so losing one still meets the FTT policy, and monitor with vSAN health and skyline.

Read the pre-check report for the failing items (certificates, DNS, NTP, host health, vSAN health, passwords out of sync), fix them, and run the pre-check again. Never skip pre-checks; check the interoperability matrix and back up SDDC Manager, vCenter and NSX first.

What they are checking: Respecting the lifecycle process.

Likely follow-up: Why does DNS and NTP matter so much in VCF?

vSAN keeps data available from the other copies if the storage policy tolerates the failure, and starts rebuilding after the repair delay. Replace the failed device, check the resync progress and capacity headroom, and confirm all objects are compliant again.

What they are checking: Policy-based availability and resync.

Likely follow-up: What is FTT in a vSAN storage policy?

Software-defined networking and security for the private cloud: overlay segments that do not need physical VLAN changes, distributed routing and a distributed firewall for micro-segmentation between workloads, and edges for north-south traffic and load balancing.

What they are checking: Why the stack is integrated.

Likely follow-up: What is micro-segmentation?

The management domain runs the infrastructure components themselves (SDDC Manager, vCenter, NSX managers). Workload domains are separate vCenter-and-cluster units for business workloads, so you can size, secure and upgrade them independently.

What they are checking: Basic VCF architecture.

Likely follow-up: Why keep business VMs out of the management domain?

In business terms: faster delivery of servers, standard security, predictable costs, less manual work through automation, and keeping sensitive data on premises. Back it with numbers such as time to deliver a VM before and after.

What they are checking: Business communication.

Likely follow-up: When would you suggest public cloud instead?