VMware 2V0-13.25 VMware Cloud Foundation 9.0 Architect Exam Practice Test

The VMware Cloud Foundation 9.0.1 Architecture Guide defines three levels of design abstraction — Conceptual, Logical, and Physical. The Physical Design translates logical components into tangible configuration and implementation details. VMware describes it as:

“The physical design includes the specific details for hardware models, network topologies, storage layouts, port configurations, VLAN IDs, and zoning of Fibre Channel fabrics.”

In contrast:

The Conceptual Design defines what the solution must deliver (high-level goals and relationships).

The Logical Design outlines component relationships and service flows without vendor-specific or configuration details.

Therefore, the Physical Design is where the architect defines server model types, port mappings, uplink configurations, vSAN disk group layouts, and Fibre Channel zones, all aligned to the validated VCF Bill of Materials (BOM).

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Design Guide — Conceptual, Logical, and Physical Design Definitions (pp. 79–81).

VMware Cloud Foundation 9.0.2 Architecture Overview — Physical Design Implementation Detailing Hardware and Network Configuration.

SHA-2 or higher certificate signing ensures cryptographic compliance with modern security standards.

Maintaining updated certificate thumbprints is a crucial operational security task to prevent man-in-the-middle attacks between NSX managers.

These measures directly align with security hardening guidance outlined in the VCF design practices.

The constraint forces the use of the existing array. However, there’s a risk that performance/capacity may be insufficient. VMware’s best practice for risk mitigation in RACR is to plan for contingency.

A is correct because securing budget allocation for additional hardware addresses the risk if the array cannot meet requirements.

B (RAID mirroring) improves redundancy, not performance or capacity.

C contradicts the constraint (cannot ignore existing array).

D (extra Fibre Channel switches) doesn’t address storage array performance/capacity.

Thus, the best mitigation is budget planning for new hardware if the array fails to meet requirements.

The VCF Identity Broker (VIDB) enables integration with enterprise identity systems and supports MFA. To reduce operational overhead:

Deploy VIDB once in the first VCF instance at DC01.

Point all additional VCF instances in the same private cloud to this VIDB.

This avoids deploying and managing multiple VIDB instances, reducing lifecycle overhead while still enabling 2FA.

Options A/B introduce unnecessary duplication. Option C centralizes in DC02, but requirement specifies DC01 is primary.

The requirement to maintain software at N-1 versioning ensures that all components in the system maintain the most recent stable version of software while avoiding risks associated with "bleeding-edge" updates. This is a Security design quality because N-1 compliance mitigates exposure to vulnerabilities that might be present in older, unsupported versions. Additionally, VMware Cloud Foundation emphasizes maintaining the full stack within a supported compatibility matrix, aligning with security and compliance frameworks.

The VMware Cloud Foundation 9.0.2 Design Guide specifies that in a Highly Available (HA) VCF Automation deployment, three appliances are deployed to ensure redundancy and meet a minimum availability SLA of 99.9%. To maintain continuous performance during host maintenance or hardware failure, VMware recommends:

“Each appliance instance should be placed on a separate ESXi host using a VM-host anti-affinity rule to eliminate single points of failure.”

Furthermore, to achieve external traffic distribution and redundancy, the guide states:

“In HA mode, an external load balancer is required to distribute requests across the cluster nodes and provide failover when a node or host becomes unavailable.”

The native Kubernetes load balancer cannot manage cross-node traffic distribution in an HA VCF Automation setup. Therefore, the architect must configure an external load balancer and define anti-affinity rules to ensure appliance distribution across hosts, achieving both the SLA and fault tolerance requirements.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.2 Architecture and Design Guide — VCF Automation High Availability Deployment Model (pp. 455–460).

VMware Cloud Foundation 9.0.1 Design Guide — Anti-Affinity Rules for Automation Nodes in HA Clusters.

VMware Cloud Foundation 9.0.2 Operations Guide — External Load Balancer Configuration Requirements for VCF Automation.

Comprehensive and Detailed Explanation (Based on VMware Cloud Foundation 9.0.3 and 9.0.1 Guides):

The VMware Cloud Foundation 9.0.3 Disaster Recovery Planning Guide emphasizes that testing and validation of DR plans must occur regularly and whenever infrastructure changes are made. It states:

“You can perform test runs periodically to ensure the existing disaster recovery plan works with underlying infrastructure and the configured RPO limit. VMware Live Recovery recommends users perform planned migration at regular intervals to validate the integrity of the existing DR plan.”

Additionally, the VCF 9.0.1 Design Blueprints specify that a well-defined process for reviewing and updating DR documentation between changes ensures continuity and compliance with defined Service Level Objectives (SLOs).

Thus, the correct mitigation action is to establish a structured change management process that includes DR plan updates and monthly end-to-end validation tests. Simply limiting change frequency (option C) or setting replication intervals (option D) does not ensure DR plan integrity.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.3 Disaster Recovery Guide — “Validating and Testing DR Plans with VMware Live Recovery.”

VMware Cloud Foundation 9.0.1 Design Guide — “Change Management and DR Validation Requirements.”

According to the VMware Cloud Foundation 9.0.2 Design Guide (NSX Bridging and Layer 2 Connectivity), when workloads or appliances require Layer 2 adjacency with physical network devices and do not support overlay encapsulation (Geneve), NSX Edge bridging is the validated solution.

The documentation states:

“The bridge functionality extends an overlay segment into a VLAN identified by a VLAN ID on an uplink of the NSX Edge. This enables Layer 2 connectivity between virtual machines on NSX overlay segments and physical workloads on VLAN-backed networks.”

By connecting the third-party appliance to a VLAN-backed segment and configuring NSX bridging, the appliance gains direct L2 connectivity to the firewall, while the workloads on overlay segments can still communicate seamlessly through the bridge.

This approach maintains the logical separation of NSX networks while satisfying L2 adjacency requirements, a common design pattern for integrating non-overlay-capable systems.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.2 Architecture and Design Guide — “Edge Bridging: Extending Overlay Segments to VLAN.”

VMware Cloud Foundation 9.0.2 NSX Design Recommendations — “Bridge Profiles and VLAN Uplink Configuration.”

Comprehensive and Detailed Explanation (Based on VMware Cloud Foundation 9.0.1 Design Guide):

The VCF 9.0.1 Design Guide and vSphere HA Design Best Practices define N+1 as a configuration where one additional host is reserved to ensure full workload recovery in case of a host failure. It specifies:

“To satisfy N+1 availability, the number of cluster hosts must exceed the required workload hosts by one to provide failover capacity.”

Therefore, for five resource-intensive VMs, a six-host cluster (D) ensures that in case of one host failure, performance and availability SLAs are maintained.

In addition, using automated placement rules (A) (e.g., anti-affinity rules) ensures that mission-critical VMs are separated across hosts, minimizing risk of concurrent failure. Resource pools (B) only control scheduling priority and do not affect availability, and keeping all VMs together (C) violates redundancy principles.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Design Guide — “N+1 Cluster Sizing and Availability Considerations.” (pp. 902–905)

VMware vSphere HA Best Practices — “VM Placement Rules and Anti-Affinity Configuration.”

VCF Automation (Aria Automation) supports multi-tenancy with separate AD integration:

B: Each tenant must use their own AD instance, aligning with independence across business units.

C: Create a tenant per business unit, ensuring isolation and dedicated resource allocation.

D (projects per business unit) could work in a single-tenant scenario but doesn’t address multi-AD separation.

A/E force consolidation into corporate AD or single projects, violating independence requirements.

The Conceptual Model documents requirements, assumptions, risks, and constraints (RACR). Here, the business use cases explicitly call for migration and containerization, which translates into a requirement for the solution to support VM and containerized workloads.

A = Constraint (UI accessibility).

C = Assumption.

D = Risk.Only B directly aligns with the business use cases and objectives.

This statement expresses a financial limit — “Remaining budget” — constraining future expenditures on hardware. This is clearly a constraint, as it restricts the design options (e.g., can't procure new hardware). In the VMware Conceptual Model framework, constraints are factors that limit design choices without introducing risk or goal definitions.

Deploying a single VCF Operations instance (central management point) while placing Cloud Proxies or Collector nodes at remote sites enables local data ingestion. This ensures remote-site resilience (REQ‑002), centralized visibility for IT users (REQ‑001), and data sovereignty compliance because data can remain within local jurisdictions (REQ‑003). This model aligns with VMware’s recommended best practice for multi-site monitoring with minimal duplication of management infrastructure.

The VMware Cloud Foundation 9.0.4 Documentation explicitly defines the four key component areas provided by a VKS cluster:

“The components that run in a VKS cluster span four areas: Authentication and authorization, storage integration, pod networking, and load balancing.”

These components are implemented as follows:

Authentication webhook: validates user access tokens.

Container Storage Interface (CSI): integrates with VMware Cloud Native Storage (CNS).

Container Network Interface (CNI): provides pod-level networking (Antrea or Calico).

Cloud Provider Implementation: enables Kubernetes LoadBalancer service creation.

This holistic integration ensures secure, scalable, and production-grade operation of Kubernetes workloads within vSphere Supervisor.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.4 Architecture Guide — “VKS Cluster Components.” (pp. 5637–5639)

VMware Cloud Foundation 9.0.4 Workload Management Overview — “VKS Functional Architecture and Services.”

During VCF bring-up, SDDC Manager requires control of a clean vCenter deployment. Since the existing environment already has a vCenter managing the clusters, the vCenter VM must be migrated to a standalone host so that VCF bring-up can properly deploy its own vCenter instance.

A: NSX deployment happens later during WLD creation, not at fleet bring-up.

C: vSAN isn’t auto-configured — it requires explicit design.

D: VCF uses vLCM images, not baselines, post-deployment.

A single workload domain in VCF maps to a single vCenter instance. When the host limit for that vCenter is reached (typically ~1000 hosts per vCenter), the correct and supported scale-out design is to deploy a second VI workload domain, which comes with its own dedicated vCenter instance, allowing continued expansion without affecting the existing domain.

As defined in the VMware Cloud Foundation 9.0.1 Architecture and Design Guide, the vSAN Compute Cluster Storage Model is designed to allow compute and storage scaling to occur independently. The guide specifies:

“A vSAN Compute Cluster is a vSphere cluster that does not contribute storage resources to the vSAN datastore. Instead, it consumes storage from a remote vSAN cluster through HCI Mesh. This architecture enables compute and network resources to scale independently of storage.”

This design provides flexibility in disaggregated architectures, allowing organizations to expand compute clusters without needing to expand vSAN capacity nodes and vice versa. Such a model is particularly useful for data-intensive workloads or environments with unpredictable growth patterns in compute versus storage.

Other options, such as vSAN ESA Storage Model or vSAN ESA Storage Cluster Model, represent Enhanced Storage Architecture configurations but do not inherently separate compute scaling. Hence, the correct answer is the vSAN Compute Cluster Storage Model, as it uniquely supports independent scalability while maintaining centralized management under the VCF architecture.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Architecture and Design Guide — “vSAN Compute Cluster Model (Disaggregated Storage Architecture)” (pp. 870–875).

VMware Cloud Foundation 9.0.2 Design Guide — “Compute and Storage Independent Scaling using HCI Mesh.”

According to the VMware Cloud Foundation 9.0 Architecture Guide under the VMware Kubernetes Service (VKS) Lifecycle Management section, the management and orchestration of Kubernetes clusters within VCF occur through three controller layers. These are explicitly identified as the Virtual Machine Service, the Cluster API (CAPI), and the Cloud Provider Plugin (CPP).

The Virtual Machine Service (VMS) acts as the integration layer between vSphere and Kubernetes, enabling Kubernetes objects (such as clusters and machines) to be represented as vSphere resources. The Cluster API provides declarative lifecycle management for Kubernetes clusters, automating provisioning, upgrades, and scaling through Kubernetes-native APIs. The Cloud Provider Plugin integrates the cluster lifecycle with vSphere infrastructure management, ensuring alignment of networking, storage, and compute resource operations.

Together, these three controller layers deliver a fully automated, policy-driven, and API-centric approach to cluster provisioning, maintenance, and scaling in VCF-based environments, supporting consistent lifecycle operations across workload domains. This framework replaces traditional manual configuration and ensures full compliance with VCF’s software-defined architecture principles.

References (VMware Cloud Foundation documents):

• VMware Cloud Foundation 9.0 Architecture and Design Guide – “VMware Kubernetes Service (VKS) Lifecycle Management Architecture.”

• VMware Cloud Foundation 9.0 Detailed Design Library – “VKS Cluster Architecture: Virtual Machine Service, Cluster API, and Cloud Provider Plugin.”

• VMware Cloud Foundation 9.0.2 Reference Design – “Cluster Lifecycle Controller Layers in VCF Kubernetes Service.”

Comprehensive and Detailed Explanation from VMware Cloud Foundation 9.0 Documentation:

According to VMware Cloud Foundation 9.0 Design Guide (Table 59, “Certificate Management Design Recommendations”), VMware explicitly mandates that “Use a SHA-2 algorithm or higher for signed certificates. The SHA-1 algorithm is considered less secure and has been deprecated.” This recommendation (VCF-SEC-RCMD-CERT-002) is a foundational part of securing communication between management components and workload domains across the VCF environment.

The use of SHA-2 or higher ensures that all certificates used for SSL/TLS communication within the SDDC ecosystem (including vCenter, NSX Manager, and SDDC Manager) meet modern cryptographic standards to prevent vulnerabilities such as collision attacks. VMware Cloud Foundation enforces certificate management policies that require replacement of default VMCA-signed certificates with CA-signed certificates, and the SHA-2 algorithm ensures cryptographic integrity, authenticity, and resistance to tampering or impersonation.

This configuration directly satisfies the customer’s requirement for secure communication in the logical design of the workload domain. It ensures data in transit between components—such as management clusters, workload domains, and external systems—remains encrypted and trustworthy, aligning with VMware’s zero-trust and compliance-focused architectural principles.

References (VMware Cloud Foundation 9.0.1 Architecture Guide):

Table 59: Certificate Management Design Recommendations — “VCF-SEC-RCMD-CERT-002 Use a SHA-2 algorithm or higher for signed certificates.”

VMware Cloud Foundation 9.0.1 PDF, pp. 306–308, 376, and 592 (Certificate Management Design Recommendations Sections).

VMware Cloud Foundation Security Governance and Compliance Design Section (VCF-SEC-RCMD-CERT-002).

In VMware Cloud Foundation 9.0.4, automation and governance are enforced through VCF Automation policies built on VMware Aria Automation Service Broker.

Two policies directly address the customer’s requirements:

Resource Quota Policy — Controls total active resource consumption by defining limits on CPU, memory, and storage at the organization, project, or user level.

“Resource quota policies control the amount of resources that are available to your users. You define these policies to limit the resources consumed by each user, project, or the organization.”

Approval Policy — Ensures governance and validation before resource deployment or modification.

“Approval policies are used to control deployment and day-2 action requests before they are executed. Requests are evaluated and approved by designated users or roles to ensure they meet organizational policies.”

Deployment Limit Policies (option D) apply to per-deployment limits but do not govern total user-level resource consumption. Therefore, the correct combination of policies that satisfy both governance and consumption control requirements is Resource Quota Policy and Approval Policy.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.4 Architecture and Design Guide — Automation Governance: Resource Quota Policies and Approval Policies.

VMware Cloud Foundation 9.0.4 Operations Guide — Policy Configuration in VCF Automation for All Apps.

VMware Cloud Foundation 9.0.4 Policy Enforcement Reference — Approval Policy Enforcement Examples.

The VMware Cloud Foundation 9.0.1 Architecture Overview and Operations Integration Guide state that VCF Operations, combined with VCF Operations for Logs, provides a unified monitoring and observability solution across the entire VCF fleet. The documentation specifies:

“Integrating VCF Operations with VCF Operations for Logs and VCF Automation provides a single-pane-of-glass for monitoring metrics, events, and flows across all management and workload domains.”

Furthermore, the High Availability deployment model for VCF Operations for Logs is required to meet the 99.9% SLA for continuous availability of monitoring data.

“VCF Operations for Logs can be deployed in High Availability mode to ensure log continuity and fault tolerance.”

Thus, the architect must:

Integrate VCF Operations with both Logs and Automation (B, D) for unified visibility.

Deploy Logs in High Availability (F) mode to achieve the 99.9% availability SLA.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Operations Design Guide — “Integrated Operations and Log Monitoring Architecture.”

VMware Cloud Foundation 9.0.4 Integration Guide — “VCF Operations and Logs HA Deployment.”

The Managed Telegraf Agent provides full observability and is centrally managed through VMware Aria Operations (formerly vRealize Operations). It is ideal for scenarios where both OS and infrastructure application metrics are needed, such as in the Fully Managed and OS Managed services. This meets the requirement for monitoring while minimizing manual overhead. The Self-Managed service does not require agent deployment, as only VM-level metrics are needed.

When gathering business requirements, VMware’s VCF Design and Planning methodology (referenced in the VMware Cloud Foundation 9.0 Architecture and Design Guide) specifies that architects must first analyze the business-level inputs that define availability, manageability, and compliance objectives. The documentation identifies Service-Level Agreements (SLAs) and Organizational Structure as key influencing factors on design decisions because they define the scope of reliability, operational responsibility, and risk tolerance of the solution.

SLAs determine the required uptime, RPO/RTO targets, and recovery policies, directly impacting design elements such as stretched clusters, backup configuration, and resource redundancy. Similarly, the organizational structure affects operational models and determines how administrative domains, roles, and tenancy will be separated — influencing whether to implement single-tenancy or multi-tenancy within VCF Automation and how management domains are segregated.

Other options such as product versions, VM sizes, or storage capacity are important for implementation and scaling phases, not the business requirements stage. VMware explicitly distinguishes between business requirements (goals, SLAs, governance) and technical requirements (capacity, configuration) in the VCF Design Library.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0 Design Guide — Business Requirements Gathering Framework (VCF-DES-PLN-BREQ-001).

VMware Cloud Foundation 9.0 Architecture Overview — SLAs and Organizational Models Impact on Design Decisions.

VMware Cloud Foundation 9.0.1 Design Library — Mapping Business Requirements to Design Factors.

This is a constraint, as it defines a non-negotiable time limit imposed by the customer’s budgeting timeline. It restricts the design phase’s schedule and deliverables. In VMware conceptual modeling, timing constraints are explicitly captured as constraints rather than requirements or assumptions.

Due to the explicit constraint that no internet access is permitted, the VCF Installer cannot connect to an online depot. Instead, the architect must use the offline depot model, where binaries are downloaded externally and made accessible locally within the VCF environment (e.g., using a local web server).

This setup aligns with VMware's "air-gapped" deployment guidance for VCF environments with strict security postures.

The requirements specify:

Large-scale migration (800 workloads).

No downtime.

Strict change window (4 weeks).

HCX Replication Assisted vMotion (RAV) is the only method that combines large-scale migration efficiency with zero downtime:

Workloads are replicated in advance.

During the cutover, a vMotion-like switchover completes with no outage.

Other methods:

Cross vCenter vMotion works for live moves but is not efficient for hundreds of VMs within a short timeline.

HCX OS Assisted Migration is for physical-to-virtual or non-vSphere workloads (not applicable).

HCX Bulk Migration is efficient but introduces downtime during cutover.

Thus, HCX RAV best meets the no-downtime, large-scale requirement.

The NSX VPC Full Services Model allows tenant isolation using VRF-lite, enabling independent routing tables within the same Tier-0 gateway.

This ensures dedicated external access without requiring a separate NSX Edge cluster per tenant, thereby minimizing the number of Edge clusters.

VMware VCF 9.0 recommends VRF Lite for multi-tenant environments with centralized Edge clusters and segmented routing needs.

Dedicated NSX instances per workload domain provide the highest level of logical isolation and allow independent upgrade cycles, fulfilling the requirement of tenant-specific customization. Each workload domain with its own NSX instance can be managed separately, updated independently, and configured with its own security policies, BGP/VRF, segments, and gateways.

NSX Federation could achieve some level of centralization but does not support independent upgrade cycles per domain. A shared NSX instance breaks isolation and would tightly couple upgrade cycles, violating two of the key stated requirements.

According to VMware Cloud Foundation 9.0 documentation, when a stretched cluster is deployed across sites with sub-5ms latency and high-speed interconnects, vSAN can be configured for zero RPO (Recovery Point Objective), ensuring 100% data consistency and availability in the event of a site failure. vSAN supports co-locating management and application workloads and provides the shared storage functionality with automatic failover capabilities.

Additionally, vSphere Virtual Volumes (vVols) provide granular control of virtual machine storage, and when backed by a storage system that supports replication and failover across sites (with support for VASA 3.0 or later), vVols can meet the same requirements for data availability and disaster recovery.