VMware 3V0-23.25 Advanced VMware Cloud Foundation 9.0 Storage Exam Practice Test

Immutable snapshots are intended to provide hardened recovery points for cyber-recovery scenarios. In vSAN Data Protection, immutability is enabled at the protection group level. Once enabled, snapshots are read-only recovery points that cannot be modified or deleted, even by an attacker with administrative privileges. This immutability model imposes operational restrictions. A VM with immutable snapshots should not have its virtual hardware changed because hardware changes can alter the VM configuration state associated with protected recovery points. In addition, a protection group cannot be configured as both replicated and immutable, because replication and immutable local snapshot protection are separate protection behaviors with different lifecycle and retention handling. The statement that a VM cannot be part of multiple protection groups is not the specific limitation tested here. The number of snapshot schedules is not limited to seven by this requirement. Virtual hardware version 10 is also not the controlling condition for immutable snapshot configuration in this context. Reference topics: vSAN Data Protection, Immutable Snapshots, Protection Groups, Cyber-Recovery Snapshot Restrictions.

After vSAN File Services has been deployed, the editable settings are primarily related to the File Service domain network configuration. The vSAN File Service workflow allows modification of primary IP addresses, static IP addresses, and DNS names. These values define how the file service endpoints are presented to clients and how file server instances are resolved on the network. The File Service domain can be adjusted by editing the network configuration and adding or removing IP addresses as needed. The Active Directory domain is not treated as a simple post-deployment editable field because changing domain membership can disrupt authentication, permissions, and file-share access. The Active Directory username and Organizational Unit are part of the directory integration and domain-join configuration, but they are not the three standard settings identified for modification after the initial File Services configuration. Therefore, the three modifiable settings are Static IP addresses, Primary IP addresses, and DNS names. Reference topics: vSAN File Service, Edit File Service Domain, File Service Network Configuration, Active Directory Integration.

The cluster must not include hosts from different subnets or networks (L3).

The default management vSphere cluster must already be stretched.

The cluster must not include DPU-backed hosts.

The cluster must not share a vSAN Storage Policy with any other cluster.

To stretch a vSAN cluster in a VCF Workload Domain, the environment must satisfy specific VCF stretch prerequisites and avoid unsupported configurations. The default management vSphere cluster must already be stretched so the management plane remains available if an availability zone fails. The workload cluster must not include hosts from different subnets or Layer 3 networks because the stretch workflow expects supported site and network placement assumptions for the cluster being stretched. The cluster must also not include DPU-backed hosts, because clusters with DPU-backed hosts are excluded from this stretch operation. In addition, the cluster must not share a vSAN Storage Policy with any other cluster, because shared policies can create policy scope and compliance conflicts during stretch configuration. SSH does not need to be manually activated on all hosts as a prerequisite. The default management cluster being “not stretched” is the opposite of the required condition. Host self-signed certificates are not the listed blocking condition for this workflow. Reference topics: Stretch vSAN Cluster in VCF, Workload Domain Stretch Prerequisites, vSAN Storage Policy Constraints, Unsupported Stretch Configurations.

The minimum total number of nested fault domains is six. In a two-node vSAN design, site disaster tolerance is provided through host mirroring between the two data hosts, with a witness maintaining quorum. The requirement adds another layer: the solution must also survive a disk group or local storage failure in addition to a host failure. vSAN’s two-node host mirroring rule states that each data host must have at least three disk groups, or three disks in a storage pool, to use the rule. In ESA, the equivalent construct is disks in the storage pool rather than OSA-style disk groups. Because there are two data hosts, and each data host requires three nested placement units, the minimum total is 3 + 3 = 6 nested fault domains. Four would not meet the host-mirroring rule requirement, and two would only represent the two hosts without local storage fault isolation. Reference topics: vSAN Two-Node Cluster, Host Mirroring, Nested Fault Domains, vSAN ESA Storage Pool Placement.

vSAN File Share SMB services are required because the storage must be consumed by Windows workstations and the application requires native NTFS permissions. SMB is the Windows-native file sharing protocol and integrates with Active Directory authentication. vSAN File Service supports SMB file shares, and Windows clients joined to the Active Directory domain configured with vSAN File Service can access those shares by using the SMB path. vSAN File Service also supports Microsoft Management Console for SMB shares, including Access Control List management, open file viewing, active sessions, and client connection management. These capabilities align directly with NTFS-style permission expectations for Windows-based graphic design workstations. vSAN File Service also supports two-node vSAN configurations, which matches the remote-site rack-space constraint of two hosts with a witness deployed remotely or in a shared location. NFSv3 does not provide native NTFS permissions for Windows clients. vSAN Storage Cluster and vSAN HCI Mesh address remote datastore capacity sharing, not SMB file access for Windows users. Reference topics: vSAN File Service, SMB File Shares, Active Directory Integration, Two-Node vSAN Support.

Disabling the vSAN iSCSI Target Service stops the service that presents iSCSI targets and LUNs to initiators, but it does not automatically delete the targets or LUNs. The vSAN administration guidance states that if an administrator wants to remove vSAN iSCSI objects and reclaim capacity, the LUNs and targets must be deleted manually before or after disabling the service. Therefore, when the service is disabled, the existing targets and LUNs remain in the vSAN datastore but are no longer accessible to the clustered legacy application. This behavior prevents accidental deletion of application or quorum data simply because the service is turned off. The targets are not archived for a fixed retention period, and they are not automatically migrated to another namespace for retention. They are also not deleted automatically. Operationally, administrators should confirm that the legacy application no longer depends on the LUNs before disabling the service or should remove the iSCSI objects through the supported workflow when decommissioning is complete. Reference topics: vSAN iSCSI Target Service, Disable iSCSI Target Service, LUN and Target Lifecycle, vSAN Object Retention.

In vSAN Original Storage Architecture, a disk group consists of one flash cache device and one or more capacity devices. The cache device is a required component of the disk group, so a failed cache device cannot be replaced as an isolated drive while preserving the same disk group. The supported operational approach is to remove the affected disk group, physically replace the failed cache device, verify that ESX detects the new device, and then manually recreate the disk group using the replacement cache device and the appropriate capacity devices. The scenario states that vSAN has already completed resynchronization and that all objects are healthy and compliant, so removing the failed disk group no longer risks object noncompliance. Selecting Full Data Migration on a failed cache device is not the correct workflow because the cache failure affects the entire disk group. Simply inserting a replacement drive does not cause vSAN OSA to automatically rebuild the disk group. Reference topics: vSAN OSA Disk Groups, Replace a Cache Device, Remove Disk Group, Recreate Disk Group.

VMware vSAN is the correct principal storage for both the Management Domain and the Workload Domain because it is integrated, policy-based, scalable, and managed directly through VCF and vSphere. The Management Domain requirement explicitly calls for a highly scalable integrated storage solution that does not require additional storage management software or hardware, which aligns with vSAN. The Workload Domain also requires a highly scalable, policy-based storage solution for critical application workloads, which again maps directly to vSAN storage policies and vSAN datastore services. The second workload tier requires file-based storage that can scale independently of the cluster for workloads with large data requirements. NFS v3 is supported as supplemental storage and is appropriate for adding file-based capacity without changing the principal vSAN datastore. iSCSI is supplemental only and does not meet the Management Domain principal storage requirement. NFS v4.1 is not the correct principal storage selection for the Management Domain. Reference topics: VCF Storage Models, Principal Storage, Supplemental Storage, vSAN Storage Model, NFS Storage Model.

The support status is based on the VCF 9.0 Principal and Supplemental Storage model. vSAN ESA is supported as principal storage for the Management Domain default cluster, Management Domain additional clusters, and Virtual Infrastructure Workload Domains. A vSAN Storage Cluster is not supported for the Management Domain default cluster, but it is supported as principal storage for Management Domain additional clusters and VI Workload Domains. NFS storage supports principal and supplemental usage when the protocol is NFS v3; the table states “Principal (NFS v3)” and “Supplemental (NFSv3 and NFSv4.1)” across all three domain categories, so NFS v3 maps to Both. iSCSI is supported only as supplemental storage across the Management Domain default cluster, Management Domain additional clusters, and VI Workload Domains. This follows the VCF distinction where principal storage is used during workload domain or cluster creation, while supplemental storage is added after creation for workloads or data-at-rest use cases such as templates, backups, and ISO images. Reference topics: Storage Models, Principal Storage, Supplemental Storage, vSAN ESA, vSAN Storage Cluster, NFS, iSCSI.

vSAN datastores are not managed through datastore clusters and Storage DRS in the same way as traditional VMFS or NFS datastore collections. A vSAN cluster exposes a distributed vSAN datastore, and VM placement, resilience, space efficiency, and compliance are controlled through vSAN Storage Policy Based Management rather than Storage DRS. The scenario also includes mixed vSAN OSA and vSAN ESA storage across clusters, which introduces an additional compatibility concern. vSAN OSA and vSAN ESA datastores are different architectures and are not combined into a single datastore-cluster construct for uniform Storage DRS placement. A datastore cluster should not combine different storage architectures such as vSAN, Fibre Channel, and NFS because Storage DRS assumes similar, interchangeable datastore resources. Creating a datastore cluster through APIs does not make vSAN datastores supported in this model. Therefore, the administrator should consider that vSAN datastores are not supported in datastore clusters and should use vSAN storage policies and appropriate datastore selection instead. Reference topics: vSAN Datastores, Storage Policy Based Management, Datastore Cluster Requirements, vSAN OSA and ESA Compatibility.

LUN Masking = A security process performed on the storage array by which specific storage components are hidden to prevent unauthorized access to data;

Datastore Cluster = A collection of shared resources with a shared management interface that enables resource allocation policies;

SAN Fabric = A dedicated high-performance network infrastructure for storage devices;

Datastore = A manageable storage entity used as a repository for Virtual Machine files including log files, scripts, configuration files and virtual disks;

Host Bus Adapter (HBA) = Added to an ESX host server to allow the host access to the dedicated storage area network;

Zoning = A security process completed on the Storage Area Network to ensure only certain devices can communicate with each other.

These definitions describe the core components of a Fibre Channel SAN design in a VCF Workload Domain. LUN masking is performed on the storage array and controls which hosts can see specific LUNs, preventing unauthorized access to storage. A datastore cluster is a collection of datastores managed as a shared resource pool, allowing placement and balancing policies through Storage DRS. A SAN fabric is the dedicated high-performance network that interconnects ESX hosts, Fibre Channel switches, and storage arrays. A datastore is the vSphere logical storage container where VM configuration files, virtual disks, logs, and related files reside. A Host Bus Adapter is the physical or virtual adapter in the ESX host that connects the host to the Fibre Channel storage area network. Zoning is performed on the Fibre Channel fabric and controls which initiators and targets can communicate. Together, zoning and LUN masking provide layered access control, while datastores and datastore clusters provide the vSphere consumption model. Reference topics: Fibre Channel SAN Concepts, SAN Fabric, Zoning, LUN Masking, VMFS Datastores, Datastore Clusters.

vSAN ESA Storage Clusters are the optimal choice because the workload profile is capacity-heavy and benefits from disaggregated storage. The requirement for 2.5 PB of application data, archival workloads, gateways, and development/test applications indicates a need to scale storage capacity independently from compute resources. VMware Cloud Foundation describes a vSAN storage cluster as a disaggregated storage solution based on vSAN ESA. It provides storage resources but not compute resources, and its datastore can be mounted by vSAN compute clusters or vSAN HCI clusters. This model is designed for storage-dense environments where capacity and performance can be expanded without adding unnecessary compute. A standard vSAN ESA HCI cluster is excellent for high-performance workloads, but it scales compute and storage together. vSAN OSA all-flash and hybrid use the older disk-group architecture and are less suitable for this large-capacity, storage-centric design. Therefore, the principal storage recommendation should be vSAN ESA Storage Clusters to meet scalability, performance, and capacity growth requirements. Reference topics: vSAN Storage Cluster, Disaggregated Storage, vSAN ESA, Storage Models.

Windows Server Failover Cluster shared disks require coordinated access to shared block storage. vSAN supports Windows Server Failover Clusters by providing SCSI-3 Persistent Reservation support at the virtual disk level, which allows cluster nodes to arbitrate access to a shared disk resource. One supported approach is to use the vSAN iSCSI Target Service, which presents vSAN-backed LUNs to initiators and can be used for clustered workloads that require shared block access. Another supported approach is to configure a shared virtual disk using a VMware Paravirtual SCSI controller with physical bus sharing. Physical bus sharing allows multiple VMs to access the same shared virtual disk in a WSFC configuration where supported. Raw Device Mapping is not the vSAN ESA-native solution for this requirement. NFS v4.1 is a file datastore protocol, not a WSFC shared block disk mechanism. “LSI SCSI controller per disk” does not satisfy the required shared-disk bus sharing configuration. Reference topics: vSAN Support for Windows Server Failover Clusters, SCSI-3 Persistent Reservations, vSAN iSCSI Target Service, Shared VMDK Configuration.

A shallow rekey operation rotates only the Key Encryption Key (KEK). In vSAN Data-at-Rest Encryption, vCenter obtains or generates the KEK through the configured key provider, while ESX hosts use Data Encryption Keys (DEKs) to encrypt the actual disk or object data. The KEK is used to protect, or wrap, those DEKs. When a shallow rekey is performed, the underlying encrypted data does not need to be rewritten because the DEKs remain the same; only the KEK changes, and the existing DEKs are re-encrypted with the new KEK. This is why shallow rekey is faster and less disruptive than a deep rekey. A deep rekey generates both a new KEK and new DEKs, requiring re-encryption of data. The Host Key is used for encrypted core dumps, not datastore data encryption. Key Derivation Key is not the key rotated in this vSAN shallow rekey workflow. Reference topics: vSAN Data-at-Rest Encryption, Generate New Encryption Keys, Shallow Rekey, Deep Rekey, KEK and DEK lifecycle.

vSAN Stretched Clusters meet the availability-zone requirement by extending a single logical vSAN cluster across two availability zones and using a witness for quorum. This provides rapid recovery from a site or availability-zone failure because workloads remain protected by the stretched topology and vSAN site-failure tolerance. vSAN Storage Cluster addresses the need for scalable, high-performance storage that can grow independently as application capacity requirements increase. In VCF 9.0, a vSAN Storage Cluster is based on vSAN ESA and provides disaggregated storage to vSAN compute or HCI clusters. This design supports storage-dense NVMe-based nodes, high IOPS, low latency, independent capacity scaling, and centralized storage services. Encryption at rest and in transit are native vSAN capabilities that can be enabled on the vSAN-backed storage architecture. vSAN File Service is for file shares, and vSAN iSCSI Target Service is for presenting block LUNs to external initiators; neither is required by the stated application-storage design. vSAN Data Protection is valuable for snapshots and recovery points, but the core architecture requirements are best satisfied by stretched site resilience plus scalable vSAN storage clustering. Reference topics: vSAN Storage Cluster, vSAN Stretched Cluster, vSAN ESA, vSAN Encryption.

The architect should highlight that quotas and Access Based Enumeration are configured when creating the vSAN file share, with ABE available for SMB shares. In the vSAN File Service create-share workflow, the General page allows the administrator to choose the protocol and configure protocol-specific options. When SMB is selected, the share can be configured with Access Based Enumeration, which displays only files and folders that the user has permission to access and hides files or folders where the user lacks Read or equivalent permissions. The same create-share workflow also includes Storage space quotas, including a share warning threshold and a share hard quota. Therefore, the design implication is operational: quotas and ABE must be planned and applied at the file-share configuration level for SMB shares that require both controls. Quotas are not limited only to NFS shares, and ABE is not a cluster-level setting. Separate file service servers are also unnecessary because vSAN File Service supports SMB and NFS shares through the same file service architecture. Reference topics: vSAN File Service, Create vSAN File Share, SMB Access Based Enumeration, Storage Space Quotas.

The two most relevant causes are insufficient vCenter permissions and incorrect DNS resolution. The VMware Live Recovery appliance must register with vCenter as a managed extension and service endpoint, so the account used during the Configure Appliance workflow must have the required vCenter privileges. A user that can authenticate but lacks registration or administration privileges can still cause the appliance registration to fail. DNS is equally critical because appliance registration depends on stable FQDN resolution, certificate validation, Lookup Service communication, and service endpoint registration. Forward and reverse DNS records must resolve correctly between the VMware Live Recovery appliance and vCenter Server. Deploying the appliance to a non-vSAN datastore is not the primary reason for vCenter registration failure. DHCP is not inherently invalid if the resulting address and DNS records are correct, though static addressing is usually preferred. A local Photon OS account on the VCSA is not the correct account type, but the direct technical issue is the lack of required vCenter permissions. Reference topics: vSAN Data Protection, VMware Live Recovery Appliance Registration, vCenter Permissions, DNS Forward and Reverse Resolution.

vSAN HCI Mesh is the correct feature because the application must continue running on the existing compute cluster, but that cluster lacks enough unused vSAN capacity and has no available NVMe slots for expansion. HCI Mesh, also known as vSAN datastore sharing, allows independent vSAN clusters to share remote datastore capacity with other compatible vSAN clusters. The remote datastore can be mounted and used as if it were local storage, allowing VMs running on the current cluster to consume storage from another vSAN cluster that has sufficient capacity and performance. This satisfies the requirement without purchasing hosts, reassigning hosts, or moving the application away from the cluster that provides the required CPU and memory. vSAN Data Protection addresses snapshots and recovery, not capacity expansion. vSAN File Services provides SMB/NFS file shares, not additional VM datastore capacity. vSAN Stretched Clusters provide availability-zone resilience, not cross-cluster capacity borrowing. VCF documentation describes HCI Mesh as cross-cluster capacity sharing that enables multiple independent vSAN HCI clusters to consume storage from adjacent vSAN storage resources. Reference topics: vSAN HCI Mesh, vSAN Datastore Sharing, Cross-Cluster Capacity Sharing, Remote vSAN Datastore.

vSAN object availability is based on two conditions: an intact replica must be available, and more than 50% of the object’s votes must be accessible. In this scenario, vSAN can locate a full replica and 55% of the votes for the noncompliant objects. Because 55% is greater than the quorum threshold, the objects remain available to the vSAN datastore. A noncompliant status means the VM objects do not currently satisfy the assigned storage policy, but it does not automatically mean the VM is inaccessible. The documentation states that if the operational state remains healthy although the object is noncompliant, the virtual machine can continue using the vSAN datastore. If the cluster contains enough resources and the failure is permanent, vSAN automatically recovers failed components and restores compliance. The VM is marked inaccessible only when a full replica cannot be located or when 50% or fewer votes are available. It becomes orphaned only if the VM namespace, such as the .vmx file, cannot be accessed. Reference topics: vSAN Object Health, Quorum Votes, Noncompliant Objects, Inaccessible and Orphaned VM States.

Deploy ESX at 9.x

Deploy vCenter 9.x

Create Storage and General dvS

Configure VMkernel Binding for the NVMe over TCP Adapter

Add Software NVMe over TCP Adapters

Import the workload domain to VCF

The correct sequence starts by preparing the vSphere environment that will later be imported into VMware Cloud Foundation. ESX 9.x must be deployed first on the six blade hosts because the hosts provide the compute foundation for the workload domain. After the hosts are available, vCenter 9.x is deployed to manage the cluster and provide the required vSphere inventory. The two distributed switches are then created: one for storage isolation and one for general host and workload traffic. Because the external array supports NVMe/TCP only and multipathing is required, VMkernel binding must be configured for the NVMe over TCP adapter before the software NVMe over TCP adapters are added. This ensures the NVMe/TCP storage paths are correctly associated with the intended storage network. After the software NVMe over TCP adapters are created and the hosts can access the external storage, the prepared workload domain can be imported into the existing VCF environment. Reference topics: NVMe over TCP Configuration, VMkernel Binding, Software NVMe/TCP Adapters, Existing vCenter Import, VCF Workload Domain Import.

The required action is to deploy the VMware Live Recovery appliance. In VMware Cloud Foundation 9.0, vSAN Data Protection is powered by VMware Live Recovery and provides local virtual machine protection and remote virtual machine replication for supported vSAN ESA environments. The vSAN Services configuration workflow explicitly states that before vSAN Data Protection can be used, the VMware Live Recovery appliance must be deployed. This appliance provides the data protection control plane required for protection groups, native snapshots, recovery workflows, and replication-based protection. Enabling vSAN advanced options is not sufficient because those settings control cluster behaviors such as repair timers, read locality, thin swap, unmap, and rebalance. Data Services Manager is used for database/data-service lifecycle use cases, not vSAN VM data protection. vSphere Replication can be part of broader site-recovery scenarios, but it is not the required action to enable vSAN Data Protection from the vSAN services workflow. Reference topics: vSAN Data Protection, VMware Live Recovery Appliance, vSAN Services Configuration, Local VM Protection and Replication.

The Live! vSphere Heavy Hitter VM dashboard is the correct place to identify which virtual machines are driving storage IOPS and disk throughput problems. In VCF Operations, heavy hitter dashboards are designed to isolate the consumers creating the highest demand on shared infrastructure resources. For storage troubleshooting, this dashboard identifies VMs producing significant I/O load, including IOPS and throughput. This is especially useful when a Fibre Channel datastore is reporting performance alerts because the datastore itself may show contention, but the root cause is often one or more high-demand VMs consuming disproportionate backend storage resources. The vSAN Health dashboard is not correct because the affected datastore is Fibre Channel, not vSAN. The vSphere Storage Inventory dashboard is useful for topology and inventory visibility, but it is not the best view for identifying the VM-level consumers causing IOPS and throughput pressure. The Storage Operations page is broader and less targeted than the Live heavy hitter view. Reference topics: VCF Operations Performance Dashboards, Storage Heavy Hitters, VM IOPS and Throughput Troubleshooting.

VMware Live Site Recovery uses VM readiness signals to control recovery sequencing between priority groups. Recovery Priority is used to start and validate higher-priority workloads before lower-priority workloads continue, which is important for application dependency chains such as identity services, databases, middleware, and application servers. A VM being registered or powered on does not prove that the guest operating system is usable. Similarly, final replication completion only confirms storage synchronization, not guest readiness. VMware Tools heartbeat provides a guest-level indication that the operating system has started and is responsive. This makes it the correct mechanism for determining that a recovery priority step has completed and that the recovery plan can continue to the next priority group. The “successfully recovered” state is the result of the recovery workflow, not the signal used to progress between priority groups. Reference topics: VMware Live Site Recovery, Recovery Plans, Recovery Priority, VMware Tools Heartbeat, Application Recovery Sequencing.