VMware NSX 4.x Professional (VCP-NV) practice questions

1. Question 1 of 25

   What is the VMware recommended way to deploy a virtual NSX Edge Node?

   • AThrough the NSX UI
   • BThrough automated or interactive mode using an ISO
   • CThrough the vSphere Web Client
   • DThrough the OVF command line tool

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Supporting references

   • docs.vmware.com documentation
   • docs.vmware.com documentation

   View community discussion2

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

   1. A

      amorcle

      2024-12-03

      Selected A3 upvotes

      Install NSX Edge on an ESXi host using NSX Manager UI (recommended method), https://docs.vmware.com/en/VMware-NSX/4.1/installation/GUID-E9A01C68-93E7-4140-B306-19CD6806199F.html

   2. Y

      yorchiluis

      2024-12-03

      Selected A2 upvotes

      https://docs.vmware.com/en/VMware-NSX/4.0/installation/GUID-E9A01C68-93E7-4140-B306-19CD6806199F.html

2. Question 2 of 25

   What is VMware’s recommendation for the minimum MTU requirements when planning an NSX deployment?

   • AMTU should be set to 1700 or greater across the data center network including inter-data center connections.
   • BMTU should be set to 1500 or less only on inter-data center connections.
   • CConfigure Path MTU Discovery and rely on fragmentation.
   • DMTU should be set to 1550 or less across the data center network including inter-data center connections.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   View community discussion1

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

   1. A

      amorcle

      2025-02-04

      Selected A1 upvote

      VMware recommends setting the MTU to at least 1700 bytes to ensure optimal performance and to future-proof the environment. This helps accommodate various functions and potential expansions

3. Question 3 of 25

   An administrator has connected two virtual machines on the same overlay segment. Ping between both virtual machines is successful. What type of network boundary does this represent?

   • ALayer 2 bridge
   • BLayer 2 broadcast domain
   • CLayer 2 VPN
   • DLayer 3 route

   Show answer

   Correct answer: B

   How others answered

   • B67%
   • D33%

   Only 67% agreed on this answer — treat it as contested rather than settled.

   Explanation

   In this scenario, both virtual machines are on the same overlay segment, meaning they are part of the same Layer 2 network. In a Layer 2 broadcast domain, devices can communicate with each other at the Ethernet level, meaning they are in the same broadcast domain, and broadcast traffic can reach all devices in the same domain. Layer 2 bridge (A): This refers to connecting two different Layer 2 segments together, but in the case described, the VMs are already on the same segment, so this does not apply. Layer 2 VPN (C): This would typically be used to extend a Layer 2 network over a Layer 3 infrastructure, not applicable in this scenario where the VMs are already on the same segment. Layer 3 route (D): A Layer 3 boundary implies routing between different subnets or networks, which is not the case here, as the VMs are in the same network. So, the scenario describes a Layer 2 broadcast domain where both VMs can communicate.

   Adapted from community discussion by electro165 · 2025-02-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   View community discussion1

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

   1. E

      electro165

      2025-02-12

      Selected B2 upvotes

      In this scenario, both virtual machines are on the same overlay segment, meaning they are part of the same Layer 2 network. In a Layer 2 broadcast domain, devices can communicate with each other at the Ethernet level, meaning they are in the same broadcast domain, and broadcast traffic can reach all devices in the same domain. Layer 2 bridge (A): This refers to connecting two different Layer 2 segments together, but in the case described, the VMs are already on the same segment, so this does not apply. Layer 2 VPN (C): This would typically be used to extend a Layer 2 network over a Layer 3 infrastructure, not applicable in this scenario where the VMs are already on the same segment. Layer 3 route (D): A Layer 3 boundary implies routing between different subnets or networks, which is not the case here, as the VMs are in the same network. So, the scenario describes a Layer 2 broadcast domain where both VMs can communicate.

4. Question 4 of 25

   Select 2

   Which two steps must an NSX administrator take to integrate VMware Identity Manager in NSX to support role-based access control? (Choose two.)

   • ACreate a SAML authentication in VMware Identity Manager using the NSX Manager FQDN.
   • BAdd NSX Manager as a Service Provider (SP) in VMware Identity Manager.
   • CEnter the Identity Provider (IdP) metadata URL in NSX Manager.
   • DEnter the service URL, Client Secret, and SSL thumbprint in NSX Manager.
   • ECreate an OAuth 2.0 client in VMware Identity Manager.

   Show answer

   Correct answer: D, E

   How others answered

   • DE80%
   • BC20%

   Supporting references

   • docs.vmware.com documentation

   View community discussion1

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

   1. T

      TheNorthernGeek

      2024-11-29

      Selected D, E2 upvotes

      https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-EAAD1FBE-F750-4A5A-A3BF-92B1E7D016FE.html

5. Question 5 of 25

   A customer is preparing to deploy a VMware Kubernetes solution in an NSX environment. What is the minimum MTU size for the UPLINK profile?

   • A1700
   • B1500
   • C1550
   • D1650

   Show answer

   Correct answer: A

   How others answered

   • A100%

   View community discussion1

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

   1. A

      amorcle

      2025-02-06

      Selected A1 upvote

      The correct answer is A. 1700. For VMware Tanzu (and related Kubernetes solutions deployed on NSX), the minimum MTU size for the Uplink profile is 1700 bytes. This is due to the overhead introduced by Geneve encapsulation used by NSX. While 1600 might work in some very limited cases, 1700 is the officially supported and recommended minimum to avoid potential issues. Using a smaller MTU can lead to fragmentation and performance problems.

6. Question 6 of 25

   Select 3

   What are three NSX Manager roles? (Choose three.)

   • Amaster
   • Bcloud
   • Cpolicy
   • Dzookeeper
   • Emanager
   • Fcontroller

   Show answer

   Correct answer: C, E, F

   How others answered

   • CEF100%

   View community discussion1

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

   1. A

      amorcle

      2025-02-06

      Selected C, E, F1 upvote

      C. policy: Handles the configuration and management of network policies, firewall rules, and security settings. E. manager: The core management component responsible for overall system configuration, monitoring, and APIs. It's the central point of interaction for administrators. F. controller: Controls the distributed switching and routing functions within the NSX environment. It pushes configurations to the hypervisors.

7. Question 7 of 25

   Which VMware NSX Portfolio product can be described as a distributed analysis solution that provides visibility and dynamic security policy enforcement for NSX environments?

   • ANSX Manager
   • BNSX Distributed IDS/IPS
   • CNSX Intelligence
   • DNSX Cloud

   Show answer

   Correct answer: C

   How others answered

   • C100%

   View community discussion1

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

   1. A

      amorcle

      2025-02-06

      Selected C1 upvote

      The correct answer is C. NSX Intelligence. NSX Intelligence is the product that provides advanced network traffic analysis, visibility, and dynamic security policy enforcement within NSX environments. 1 It uses distributed analysis to gain insights into application behavior and network flows, enabling automated threat detection and prevention

8. Question 8 of 25

   Which command on ESXi is used to verify the Local Control Plane connectivity with Central Control Plane?

   • Aesxcli network ip connection list | grep netcpa
   • Besxcli network ip connection list | grep ccpd
   • Cesxcli network ip connection list | grep 1234
   • Desxcli network ip connection list | grep 1235

   Show answer

   Correct answer: D

   How others answered

   • D100%

   View community discussion1

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

   1. A

      amorcle

      2025-02-08

      Selected D2 upvotes

      In the new version 4.X. The communication between CCP and LCP in on the port 1235.

9. Question 9 of 25

   Which two commands does an NSX administrator use to check the IP address of the VMkernel port for the Geneve protocol on the ESXi transport node? (Choose two.)

   • Anet-dvs
   • Besxcfg-nics -l
   • Cesxcli network ip interface ipv4 get
   • Desxcfg-vmknic -l
   • Eesxcli network nic list

   Show answer

   Correct answer: C

   How others answered

   • C67%
   • D33%

   Only 67% agreed on this answer — treat it as contested rather than settled.

   View community discussion1

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

   1. A

      amorcle

      2025-02-03

      Selected C2 upvotes

      C and D Like in the official guide. There are two choices not one

10. Question 10 of 25

    Select 2

    Which two statements describe the characteristics of an Edge Cluster in NSX? (Choose two.)

    • AMust have only active-active edge nodes
    • BCan contain multiple types of edge nodes (VM or bare metal)
    • CMust contain only one type of edge nodes (VM or bare metal)
    • DCan have a maximum of 10 edge nodes
    • ECan have a maximum of 8 edge nodes

    Show answer

    Correct answer: B, D

    How others answered

    • BD40%
    • CD20%
    • BE20%

    Only 40% agreed on this answer — treat it as contested rather than settled.

    View community discussion2

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. T

       twohandz

       2025-03-02

       Selected B, D1 upvote

       Support for NSX Edge VM and Bare-Metal to Co-Exist in the Same NSX Edge Cluster: NSX Edge nodes VM and bare-metal can now exist in the same NSX Edge cluster to simplify the scaling of services hosted on the NSX Edge node, such as load balancer. NSX-T Reference Design Guide 3-0 also has a reference to this: "NSX-T 2.3 introduced the support for heterogeneous Edge nodes which facilitates easy migration from Edge node VM to bare metal Edge node without reconfiguring the logical routers on bare metal Edge nodes."

    2. A

       amorcle

       2025-02-08

       Selected B, D1 upvote

       Supports up to 10 edge nodes, and a maximum of 160 clusters can be configured

11. Question 11 of 25

    An NSX administrator is using ping to check connectivity between VM1 running on ESXi1 to VM2 running on ESXi2. The ping tests fail. The administrator knows the maximum transmission unit size on the physical switch is 1600. Which command does the administrator use to check the VMware kernel ports for tunnel end point communication?

    • Avmkping ++netstack=geneve -d -s 1572 <destination IP address>
    • Bvmkping ++netstack=vxlan -d -s 1572 <destination IP address>
    • Cesxcli network diag ping –H <destination IP address>
    • Desxcli network diag ping -I vmk0 -H <destination IP address>

    Show answer

    Correct answer: A

    How others answered

    • A67%
    • B33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    vmkping is the command used to test network connectivity for VMware kernel ports (vmk interfaces). The ++netstack=geneve option specifies that the Geneve (Generic Network Virtualization Encapsulation) protocol is being used. Geneve is the protocol used in NSX-T for overlay tunneling between ESXi hosts. -d enables the Don't Fragment (DF) bit, which ensures that the packet will not be fragmented. This is important because you're testing with a specific MTU size. -s 1572 sets the packet size to 1572 bytes. This accounts for the overhead of the encapsulation and leaves the packet size of 1600 bytes (the maximum allowed by the physical switch), considering the Geneve header.

    Adapted from community discussion by electro165 · 2025-02-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion1

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. E

       electro165

       2025-02-12

       Selected A2 upvotes

       vmkping is the command used to test network connectivity for VMware kernel ports (vmk interfaces). The ++netstack=geneve option specifies that the Geneve (Generic Network Virtualization Encapsulation) protocol is being used. Geneve is the protocol used in NSX-T for overlay tunneling between ESXi hosts. -d enables the Don't Fragment (DF) bit, which ensures that the packet will not be fragmented. This is important because you're testing with a specific MTU size. -s 1572 sets the packet size to 1572 bytes. This accounts for the overhead of the encapsulation and leaves the packet size of 1600 bytes (the maximum allowed by the physical switch), considering the Geneve header.

12. Question 12 of 25

    An NSX administrator is creating a NAT rule on a Tier-0 Gateway configured in active-standby high availability mode. Which two NAT rule types are supported for this configuration? (Choose two.)

    • APort NAT
    • B1:1 NAT
    • CDestination NAT
    • DReflexive NAT
    • ESource NAT

    Show answer

    Correct answer: B

    How others answered

    • B75%
    • C25%

    Explanation

    Destination NAT is supported, but Tier-0 Gateways in active-standby HA mode have specific limitations regarding dynamic or stateful destination NAT configurations. Some more complex forms of DNAT may not work as expected in HA mode. In active-standby HA mode on a Tier-0 Gateway, the supported NAT rule types are: 1:1 NAT Source NAT (SNAT)

    Adapted from community discussion by electro165 · 2025-02-12 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion1

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. E

       electro165

       2025-02-12

       Selected B3 upvotes

       Destination NAT is supported, but Tier-0 Gateways in active-standby HA mode have specific limitations regarding dynamic or stateful destination NAT configurations. Some more complex forms of DNAT may not work as expected in HA mode. In active-standby HA mode on a Tier-0 Gateway, the supported NAT rule types are: 1:1 NAT Source NAT (SNAT)

13. Question 13 of 25

    Select 2

    When deploying an NSX Edge Transport Node, what two valid IP address assignment options should be specified for the TEP IP addresses? (Choose two.)

    • AUse an IP Pool
    • BUse RADIUS
    • CUse a Static IP List
    • DUse BootP
    • EUse a DHCP Server

    Show answer

    Correct answer: A, C

    How others answered

    • AC100%

    View community discussion1

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. E

       electro165

       2025-02-12

       Selected A, C1 upvote

       The two valid options for specifying IP addresses for TEP in NSX Edge Transport Node deployment are: A. Use an IP Pool C. Use a Static IP List

14. Question 14 of 25

    Select 2

    Which two of the following will be used for ingress traffic on the Edge node supporting a Single Tier topology? (Choose two.)

    • ATier-1 SR Router Port
    • BTier-0 Uplink interface
    • CDownlink Interface for the Tier-0 DR
    • DDownlink Interface for the Tier-1 DR
    • EInter-Tier interface on the Tier-0 gateway

    Show answer

    Correct answer: B, C

    How others answered

    • BC67%
    • BD33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The two interfaces that will be used for ingress traffic on the Edge node supporting a Single Tier topology are: B) Tier-0 Uplink interface C) Downlink Interface for the Tier-0 DR

    Adapted from community discussion by amorcle · 2025-02-09 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion1

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. A

       amorcle

       2025-02-09

       Selected B, C2 upvotes

       The two interfaces that will be used for ingress traffic on the Edge node supporting a Single Tier topology are: B) Tier-0 Uplink interface C) Downlink Interface for the Tier-0 DR

15. Question 15 of 25

    Select 2

    Which two are supported by L2 VPN clients? (Choose two.)

    • ANSX Autonomous Edge
    • BNSX Edge
    • CNSX for vSphere Edge
    • D3rd party Hardware VPN Device

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

    View community discussion1

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. A

       Arslan7

       2024-12-30

       Selected A, B1 upvote

       Saw in the ICM 4.0 p.595. The following L2 VPN clients are recommended: 1. NSX Managed NSX Edge in a separate NSX Managed environment. • Overlay and VLAN segments can be extended. 2. Autonomous Edge: • Enables L2 VPN access from a non-a NSX environment to NSX environments. • Deployed by using an OVF file on a host that is not managed by NSX. • Only VLAN segments can be extended.

16. Question 16 of 25

    Select 2

    An administrator is configuring service insertion for Network Introspection. Which two places can the Network Introspection be configured? (Choose two.)

    • AEdge Node
    • BHost pNIC
    • CTier-0 gateway
    • DTier-1 gateway
    • EPartner SVM

    Show answer

    Correct answer: A, E

    How others answered

    • AE100%

    View community discussion2

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. E

       electro165

       2025-02-12

       Selected A, E1 upvote

       A. Edge Node: Network Introspection is typically configured on Edge Nodes in NSX, where network traffic can be inspected for security and other purposes. The Edge Node plays a crucial role in service insertion, where additional services (such as firewalls, IDS/IPS, or other security tools) are inserted into the traffic flow. E. Partner SVM (Service Virtual Machine): A Partner SVM is a virtual machine provided by a third-party partner (such as a security appliance) that is integrated with NSX for service insertion. Service insertion allows the integration of third-party appliances into the network traffic flow for inspection or other purposes, and this is done using Partner SVMs.

    2. S

       Salanazi

       2025-01-28

       Selected A, E1 upvote

       Tier-1 gateway: Tier-1 gateways are used for east-west traffic, but introspection is not configured at the gateway level directly.

17. Question 17 of 25

    Where can an administrator see a visual overview of network connections between different VMs and different networks, within the NSX domain?

    • ANetwork Intelligence
    • BNSX Intelligence
    • CVMware Aria Operations
    • DVMware Aria Operations for Networks

    Show answer

    Correct answer: B

    How others answered

    • B100%

    View community discussion1

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. A

       amorcle

       2025-02-09

       Selected B1 upvote

       NSX Intelligence provides a visual overview of network connections within the NSX domain, allowing administrators to see the traffic flows between different VMs and networks. It offers detailed visibility into network traffic patterns, application dependencies, and security posture, making it a valuable tool for monitoring and troubleshooting within NSX environments.

18. Question 18 of 25

    Select 4

    What are the four types of role-based access control (RBAC) permissions? (Choose four.)

    • AAuditor
    • BFull access
    • CEnterprise Admin
    • DNone
    • EExecute
    • FRead
    • GNetwork Admin

    Show answer

    Correct answer: B, D, E, F

    How others answered

    • BDEF100%

    View community discussion1

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. A

       amorcle

       2025-02-09

       Selected B, D, E, F1 upvote

       In addition to different authentication mechanisms, NSX Manager also supports RBAC (Role-Based Access Control) to control the level of access to the environment with the help of different roles. There are four levels of access or permissions that can be assigned in NSX Manager as follows: Full Access: Includes Create, Read, Update, Delete Execute: Includes Read and Update Read: Read-only access None: No access

19. Question 19 of 25

    Select 4

    What are four NSX built-in role-based access control (RBAC) roles? (Choose four.)

    • ANone
    • BRead
    • CAuditor
    • DFull Access
    • ENetwork Admin
    • FEnterprise Admin
    • GLB Operator

    Show answer

    Correct answer: B, C, D, E

    How others answered

    • BCDE67%
    • CEFG33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A. None: This is not a valid role in NSX. Users with "None" access wouldn't have permissions. F. Enterprise Admin: This is not a built-in NSX role. It may exist in other systems but not in NSX's role list. G. LB Operator: While NSX has features related to load balancing, "LB Operator" is not a default RBAC role.

    Adapted from community discussion by electro165 · 2025-02-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion2

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. E

       electro165

       2025-02-12

       Selected B, C, D, E2 upvotes

       A. None: This is not a valid role in NSX. Users with "None" access wouldn't have permissions. F. Enterprise Admin: This is not a built-in NSX role. It may exist in other systems but not in NSX's role list. G. LB Operator: While NSX has features related to load balancing, "LB Operator" is not a default RBAC role.

    2. A

       amorcle

       2025-02-15

       1 upvote

       10-33 Built-In Roles (1) NSX provides built-in roles. Role Auditor Enterprise Admin GI Partner Admin LB Admin LB Operator Description Read permissions on all features Full access permissions on all features Role used for third-party endpoint protection service insertion Read permissions on all networking services and full access permissions on load-balancing features Read permissions on all networking services and load-balancing features Netx Partner Admin Role used for third-party Network Introspection service insertion Network Admin Full access permissions on all networking services

20. Question 20 of 25

    Select 3

    Which three DHCP Services are supported by NSX? (Choose three.)

    • AGateway DHCP
    • BSegment DHCP
    • CDHCP Relay
    • DPort DHCP per VNF
    • EVRF DHCP Server

    Show answer

    Correct answer: A, B, C

    How others answered

    • ABC83%
    • BCE17%

    Explanation

    D. Port DHCP per VNF: This is not a valid DHCP service in NSX. DHCP is not configured per VNF port. E. VRF DHCP Server: NSX doesn't explicitly support a "VRF DHCP Server." While VRFs are supported for routing, DHCP services are associated with gateways or segments, not VRFs.

    Adapted from community discussion by electro165 · 2025-02-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion1

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. E

       electro165

       2025-02-12

       Selected A, B, C2 upvotes

       D. Port DHCP per VNF: This is not a valid DHCP service in NSX. DHCP is not configured per VNF port. E. VRF DHCP Server: NSX doesn't explicitly support a "VRF DHCP Server." While VRFs are supported for routing, DHCP services are associated with gateways or segments, not VRFs.

21. Question 21 of 25

    Which of the following settings must be configured in an NSX environment before enabling stateful active-active SNAT?

    • ATier-1 gateway in active-standby mode
    • BA Punting Traffic Group for the NSX Edge uplinks
    • CAn Interface Group for the NSX Edge uplinks
    • DTier-1 gateway in distributed only mode

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Supporting references

    • docs.vmware.com documentation

    View community discussion1

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. A

       amorcle

       2025-02-10

       Selected C1 upvote

       C is the Answer. Need an Interface group for stateful services (including SNAT) on T-0 active-active gateway. https://docs.vmware.com/en/VMware-NSX/4.1/administration/GUID-37BE3A32-C4CA-4C31-80E0-7B8D2889D96A.html

22. Question 22 of 25

    An administrator has been tasked with implementing the SSL certificates for the NSX Manager Cluster VIP. Which is the correct way to implement this change?

    • ASend an API call to https://<nsx-mgr>/api/vl/cluster/api-certificate?action=set_cluster_certificate&certificate_id=<certificate_id>
    • BSend an API call to https://<nsx-mgr>/api/vl/node/services/http?action=apply_certificate&certificate_id=<certificate_id>
    • CSSH as admin into the NSX manager with the cluster VIP IP and run nsxcli cluster certificate node install <certificate_id>
    • DSSH as admin into the NSX manager with the cluster VIP IP and run nsxcli cluster certificate vip install <certificate_id>

    Show answer

    Correct answer: A

    How others answered

    • A80%
    • D20%

    Supporting references

    • techdocs.broadcom.com documentation

    View community discussion1

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. V

       visse

       2025-04-03

       Selected A1 upvote

       https://techdocs.broadcom.com/us/en/vmware-tanzu/standalone-components/tanzu-kubernetes-grid-integrated-edition/1-19/tkgi/nsxt-install-tls-certs.html

23. Question 23 of 25

    An administrator needs to download the support bundle for NSX Manager. Where does the administrator download the log bundle from?

    • ASystem > Support Bundle
    • BSystem > Settings
    • CSystem > Utilities > Tools
    • DSystem > Settings > Support Bundle

    Show answer

    Correct answer: A

    How others answered

    • A60%
    • D40%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    To download the support bundle for NSX Manager, the administrator navigates to the System tab in the NSX Manager web interface and selects Support Bundle. This is where the option to generate and download the log bundle for troubleshooting is located.

    Adapted from community discussion by electro165 · 2025-02-12 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • techdocs.broadcom.com documentation

    View community discussion2

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. E

       electro165

       2025-02-12

       Selected A2 upvotes

       To download the support bundle for NSX Manager, the administrator navigates to the System tab in the NSX Manager web interface and selects Support Bundle. This is where the option to generate and download the log bundle for troubleshooting is located.

    2. T

       twohandz

       2025-03-02

       Selected A1 upvote

       https://techdocs.broadcom.com/us/en/vmware-cis/nsx/vmware-nsx/4-2/administration-guide/operations-and-management/collect-support-bundles.html From your browser, log in as a local admin user to an NSX Manager at https://nsx-manager-ip-address/login.jsp?local=true . Select System Support Bundle Select the target nodes.

24. Question 24 of 25

    Which of the following statements is true regarding the use of a Dynamic Routing Protocol on a Tier-1 Gateway?

    • ABoth BGP and OSPF can be used on a Tier-1 Gateway.
    • BYou can only use OSPF on the Tier-1 Gateway.
    • CA Dynamic Routing Protocol cannot be used on a Tier-1 Gateway.
    • DYou can only use BGP on the Tier-1 Gateway.

    Show answer

    Correct answer: D

    How others answered

    • D50%
    • A25%
    • C25%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    In NSX, BGP is the only supported dynamic routing protocol on a Tier-1 Gateway. OSPF is not supported at the Tier-1 level; it is only available on Tier-0 Gateways. This limitation means that for dynamic routing on a Tier-1 Gateway, administrators can configure BGP to exchange routing information with connected Tier-0 Gateways

    Adapted from community discussion by amorcle · 2025-02-10 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    View community discussion1

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. A

       amorcle

       2025-02-10

       Selected D2 upvotes

       In NSX, BGP is the only supported dynamic routing protocol on a Tier-1 Gateway. OSPF is not supported at the Tier-1 level; it is only available on Tier-0 Gateways. This limitation means that for dynamic routing on a Tier-1 Gateway, administrators can configure BGP to exchange routing information with connected Tier-0 Gateways

25. Question 25 of 25

    An administrator wants to validate the BGP connection status between the Tier-0 Gateway and the upstream physical router. What sequence of commands could be used to check this status on NSX Edge node?

    • A- enable <LR-D> - get vrf <ID> - show bgp neighbor
    • B- get gateways - vrf <number> - get bgp neighbor
    • C- set vrf <ID> - show logical-routers - show <LR-D> bgp
    • D- show logical-routers - get vrf - show ip route bgp

    Show answer

    Correct answer: B

    How others answered

    • B75%
    • A25%

    View community discussion2

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by 2V0-41.24 or CertExamHQ.

    1. P

       putifarri

       2025-04-03

       Selected B2 upvotes

       there isn't a command in NSX that starts with show, so for me that discard all the others

    2. G

       General_HCCIE

       2025-04-08

       Selected B1 upvote

       there is no enable in the NSX Edge shell, the correct order is get gateways to see all the available gateways, then select by using the vrf and id of the logical gateway in this case the logical gateway need to be SR, then sget bgp neighbor

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

2V0-41.24 practice, question 1 of 25