VMware 2V0-13.25 VMware Cloud Foundation 9.0 Architect Exam Practice Test

The VMware Cloud Foundation 9.0.2 Design Guide identifies Harbor as the enterprise-grade container registry integrated with vSphere with Tanzu and Supervisor Clusters. It states:

“Harbor provides a cloud-native registry that supports image scanning, replication, and image signing. It is the recommended solution for storing, securing, and distributing container images within VCF environments.”

Harbor integrates with vSphere Namespaces and supports content trust, vulnerability scanning, and image replication across multiple sites — capabilities not available with Docker Hub or Gitea, and only partially supported in Azure ACR.

Therefore, Harbor is the correct and VMware-recommended component for a Supervisor image store that requires enterprise security and replication capabilities.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.2 Design and Architecture Guide — “Harbor Image Registry Integration with Supervisor.”

VMware Cloud Foundation 9.0.1 Tanzu Integration Guide — “Using Harbor as the Image Registry for Supervisor Namespaces.”

In the VMware Cloud Foundation 9.0.4 Architecture and Design Guide, VCF Automation supports multi-tenancy through the creation of separate organizations, each with its own catalog, users, and identity source. The document under “Organizations in VCF Automation” explains:

“Organizations in VCF Automation are created by the provider administrator in the Provider Management Portal. Each organization has its own identity source and resource allocations. The organization administrator can then configure its own self-service catalog and governance policies.”

By configuring separate organizations for Development and Production, the architect ensures logical segregation of resources, catalogs, and permissions. Each organization can manage its own projects, namespaces, and service catalogs independently, meeting both the self-service and segregation requirements.

This design aligns with VMware’s provider–tenant model, where each tenant (organization) operates autonomously while still being managed under a common provider infrastructure.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.4 Design Guide — “Organizations in VCF Automation: All Apps and VM Apps Organizations.”

VMware Cloud Foundation 9.0.4 — “Self-Service Catalog in VCF Automation.”

In VMware Cloud Foundation 9.0.4, automation and governance are enforced through VCF Automation policies built on VMware Aria Automation Service Broker.

Two policies directly address the customer’s requirements:

Resource Quota Policy — Controls total active resource consumption by defining limits on CPU, memory, and storage at the organization, project, or user level.

“Resource quota policies control the amount of resources that are available to your users. You define these policies to limit the resources consumed by each user, project, or the organization.”

Approval Policy — Ensures governance and validation before resource deployment or modification.

“Approval policies are used to control deployment and day-2 action requests before they are executed. Requests are evaluated and approved by designated users or roles to ensure they meet organizational policies.”

Deployment Limit Policies (option D) apply to per-deployment limits but do not govern total user-level resource consumption. Therefore, the correct combination of policies that satisfy both governance and consumption control requirements is Resource Quota Policy and Approval Policy.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.4 Architecture and Design Guide — Automation Governance: Resource Quota Policies and Approval Policies.

VMware Cloud Foundation 9.0.4 Operations Guide — Policy Configuration in VCF Automation for All Apps.

VMware Cloud Foundation 9.0.4 Policy Enforcement Reference — Approval Policy Enforcement Examples.

In VMware Cloud Foundation, each VI workload domain is backed by a single vCenter Server instance. By deploying multiple clusters within the same VI workload domain, the architect can support multiple use cases (e.g., separating prod/dev), without provisioning new vCenters. This design reduces management overhead and operational complexity.

However, if stricter separation is needed (e.g., multi-tenancy or lifecycle independence), separate workload domains may be more suitable. While vSAN is the default, it's not mandatory unless vSAN Ready Nodes are used for bring-up.

Comprehensive and Detailed Explanation from VMware Cloud Foundation 9.0 Documentation:

According to VMware Cloud Foundation 9.0 Design Guide (Table 59, “Certificate Management Design Recommendations”), VMware explicitly mandates that “Use a SHA-2 algorithm or higher for signed certificates. The SHA-1 algorithm is considered less secure and has been deprecated.” This recommendation (VCF-SEC-RCMD-CERT-002) is a foundational part of securing communication between management components and workload domains across the VCF environment.

The use of SHA-2 or higher ensures that all certificates used for SSL/TLS communication within the SDDC ecosystem (including vCenter, NSX Manager, and SDDC Manager) meet modern cryptographic standards to prevent vulnerabilities such as collision attacks. VMware Cloud Foundation enforces certificate management policies that require replacement of default VMCA-signed certificates with CA-signed certificates, and the SHA-2 algorithm ensures cryptographic integrity, authenticity, and resistance to tampering or impersonation.

This configuration directly satisfies the customer’s requirement for secure communication in the logical design of the workload domain. It ensures data in transit between components—such as management clusters, workload domains, and external systems—remains encrypted and trustworthy, aligning with VMware’s zero-trust and compliance-focused architectural principles.

References (VMware Cloud Foundation 9.0.1 Architecture Guide):

Table 59: Certificate Management Design Recommendations — “VCF-SEC-RCMD-CERT-002 Use a SHA-2 algorithm or higher for signed certificates.”

VMware Cloud Foundation 9.0.1 PDF, pp. 306–308, 376, and 592 (Certificate Management Design Recommendations Sections).

VMware Cloud Foundation Security Governance and Compliance Design Section (VCF-SEC-RCMD-CERT-002).

RTO (Recovery Time Objective) defines how quickly a system/service must be restored after a disruption. In this scenario, the infrastructure components should be fully functional within 4 hours.

This contrasts with RPO, which measures data loss tolerance. RTO focuses on downtime tolerance.

VMware Cloud Foundation documentation on BCDR (Business Continuity and Disaster Recovery) explicitly defines these metrics during availability planning.

The VMware Cloud Foundation 9.0.2 Design Guide specifies that in a Highly Available (HA) VCF Automation deployment, three appliances are deployed to ensure redundancy and meet a minimum availability SLA of 99.9%. To maintain continuous performance during host maintenance or hardware failure, VMware recommends:

“Each appliance instance should be placed on a separate ESXi host using a VM-host anti-affinity rule to eliminate single points of failure.”

Furthermore, to achieve external traffic distribution and redundancy, the guide states:

“In HA mode, an external load balancer is required to distribute requests across the cluster nodes and provide failover when a node or host becomes unavailable.”

The native Kubernetes load balancer cannot manage cross-node traffic distribution in an HA VCF Automation setup. Therefore, the architect must configure an external load balancer and define anti-affinity rules to ensure appliance distribution across hosts, achieving both the SLA and fault tolerance requirements.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.2 Architecture and Design Guide — VCF Automation High Availability Deployment Model (pp. 455–460).

VMware Cloud Foundation 9.0.1 Design Guide — Anti-Affinity Rules for Automation Nodes in HA Clusters.

VMware Cloud Foundation 9.0.2 Operations Guide — External Load Balancer Configuration Requirements for VCF Automation.

The VMware Cloud Foundation 9.0.1 and 9.0.2 Design Guides emphasize that NIC teaming is a critical design element for fault tolerance and redundancy. To avoid a single point of failure at the physical layer, VMware prescribes that:

“Each traffic type is spread across separate network cards to avoid single point of failure.”

This ensures that in case one physical NIC card or PCI slot fails, the traffic can continue to flow through another NIC on a separate card, maintaining network connectivity and host resilience. This guidance is part of Physical NIC Level Redundancy (NLR) design considerations, ensuring that no single physical adapter failure disrupts the ESXi host or associated management, vMotion, or vSAN traffic.

The VCF distributed switch and NSX overlay networks benefit from independent uplinks across NIC cards, providing enhanced resiliency for management and workload domains. VMware recommends Active/Active or Active/Standby teaming using policies such as “Route based on physical NIC load” across multiple NIC cards.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Design Guide – “Physical NIC Level Redundancy (NLR)”

VMware Cloud Foundation 9.0.2 Design Guide – “Basic NIC Teaming and Redundancy Considerations”

VMware Cloud Foundation 9.0.1 – “vSphere Distributed Switch Design Recommendations for NLR.”

According to the VMware Cloud Foundation 9.0.2 Design Guide, a vSAN stretched cluster provides zero data loss (RPO = 0) and automated failover between two availability zones within the same region. It ensures continuous availability of workloads with minimal performance impact. The guide specifies:

“Stretching a vSAN cluster automatically initiates VM restart and recovery and has a low recovery time for unplanned failures. The solution supports synchronous replication with a maximum inter-site latency of 5ms RTT.”

This design fully satisfies the RPO (≤5 minutes) and RTO (≤30 minutes) requirements while minimizing performance impact, as all writes are synchronously mirrored between sites.

In contrast:

Backup-based recovery (A) and asynchronous replication (B) cannot achieve RPO < 5 minutes.

Array-based synchronous replication (D) is not applicable to vSAN-only VCF environments and introduces additional complexity.

Therefore, the vSAN stretched cluster is the recommended and VMware-validated solution for meeting near-zero RPO/RTO and automated failover requirements in a business-critical VCF environment.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.2 Design Guide — “Stretching vSAN Clusters Across Availability Zones.” (pp. 1039–1042)

VMware Cloud Foundation 9.0.1 Architecture Overview — “Disaster Avoidance and Recovery with vSAN Stretched Clusters.” (pp. 290–292)

The High Availability (HA) deployment model of VCF Operations ensures that both monitoring and alerting services are resilient to node failure. Deploying Collector nodes at remote sites enables local data collection, reducing WAN dependency and ensuring data is not lost during network interruptions.

This configuration aligns perfectly with the need to minimize monitoring and alerting downtime, which is critical in distributed, multi-instance environments.

A stretched cluster model allows synchronous replication between sites with RPO = 0, ensuring no data loss.

Since the datacenters are within low-latency (<5ms) distance, stretched vSAN clusters with fault domains can span across them.

Other options:

A/B (disaster recovery models) rely on asynchronous replication, introducing potential data loss.

C (multi-rack fault domains) improves rack-level resiliency, not site-level protection.

Thus, the correct design is a VCF fleet with stretched cluster model across fault domains.

When gathering business requirements, VMware’s VCF Design and Planning methodology (referenced in the VMware Cloud Foundation 9.0 Architecture and Design Guide) specifies that architects must first analyze the business-level inputs that define availability, manageability, and compliance objectives. The documentation identifies Service-Level Agreements (SLAs) and Organizational Structure as key influencing factors on design decisions because they define the scope of reliability, operational responsibility, and risk tolerance of the solution.

SLAs determine the required uptime, RPO/RTO targets, and recovery policies, directly impacting design elements such as stretched clusters, backup configuration, and resource redundancy. Similarly, the organizational structure affects operational models and determines how administrative domains, roles, and tenancy will be separated — influencing whether to implement single-tenancy or multi-tenancy within VCF Automation and how management domains are segregated.

Other options such as product versions, VM sizes, or storage capacity are important for implementation and scaling phases, not the business requirements stage. VMware explicitly distinguishes between business requirements (goals, SLAs, governance) and technical requirements (capacity, configuration) in the VCF Design Library.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0 Design Guide — Business Requirements Gathering Framework (VCF-DES-PLN-BREQ-001).

VMware Cloud Foundation 9.0 Architecture Overview — SLAs and Organizational Models Impact on Design Decisions.

VMware Cloud Foundation 9.0.1 Design Library — Mapping Business Requirements to Design Factors.

VMware Cloud Foundation architecture uses the RACR framework (Requirements, Assumptions, Constraints, Risks) to classify inputs:

Business requirements describe high-level outcomes the business wants to achieve, often focusing on cost, efficiency, or customer satisfaction.

Technical requirements define how infrastructure should behave to meet performance, resiliency, or security needs.

Among the given options:

A (growth by 30%) and C (no SPOF) are technical requirements.

B (security and resiliency) is also a technical requirement.

D (reduce operational costs) directly aligns with business goals, making it the correct business requirement.

Constraints are design limitations that cannot be changed and must be worked around.

B (no funding for new storage, so existing must be used) is a clear constraint, as it restricts the architect from proposing new storage hardware.

A (out of maintenance) represents a risk (unsupported hardware may fail).

C and D are requirements, not constraints, because they describe desired functionality of the solution.

Thus, the correct constraint is that existing storage must be used due to funding limitations.

Comprehensive and Detailed Explanation (Based on VMware Cloud Foundation 9.0.1 Design Guide):

The VCF 9.0.1 Design Guide and vSphere HA Design Best Practices define N+1 as a configuration where one additional host is reserved to ensure full workload recovery in case of a host failure. It specifies:

“To satisfy N+1 availability, the number of cluster hosts must exceed the required workload hosts by one to provide failover capacity.”

Therefore, for five resource-intensive VMs, a six-host cluster (D) ensures that in case of one host failure, performance and availability SLAs are maintained.

In addition, using automated placement rules (A) (e.g., anti-affinity rules) ensures that mission-critical VMs are separated across hosts, minimizing risk of concurrent failure. Resource pools (B) only control scheduling priority and do not affect availability, and keeping all VMs together (C) violates redundancy principles.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Design Guide — “N+1 Cluster Sizing and Availability Considerations.” (pp. 902–905)

VMware vSphere HA Best Practices — “VM Placement Rules and Anti-Affinity Configuration.”

According to the VMware Cloud Foundation 9.0.4 Architecture and Design Guide, vSphere Pods (which support VMware Kubernetes Service or VKS clusters) use three types of storage: ephemeral VMDKs, persistent volume VMDKs, and container image VMDKs.

The document explicitly states:

> “A vSphere Pod requires ephemeral storage to store such Kubernetes objects as logs, emptyDir volumes, and ConfigMaps during its operations. This ephemeral, or transient, storage lasts as long as the pod continues to exist.”

Ephemeral storage is non-persistent by design and is deleted once the pod lifecycle ends. It provides temporary space for data that doesn’t need to persist beyond the pod’s lifespan, such as application logs, temporary caches, or transient compute data. This aligns with Kubernetes’ ephemeral storage model integrated into vSphere infrastructure.

Persistent workloads, by contrast, utilize storage policies and vSphere CNS-backed persistent volumes. Therefore, ephemeral storage is the correct type for non-persistent pod data.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.4 — “Storage Policies for a Supervisor” (p. 5632–5633)

VMware Cloud Foundation 9.0.4 — “vSphere Pod Storage Types: Ephemeral, Persistent, and Container Image VMDKs.”

---

Validating a BCDR strategy in VCF with vSAN DP requires both impact analysis and active testing:

B. Assess the impact of failover scenarios – Ensures application dependencies, such as inter-site routing, DNS, and external services, are validated against failover scenarios. This prevents unexpected downtime due to overlooked dependencies.

D. Planned and unplanned failover tests – VMware best practices emphasize testing both scheduled and unexpected recovery workflows to validate RTOs and confirm operational procedures.

Why not the others?

A (annual testing only) contradicts VMware guidance, which recommends frequent and scenario-based validation.

C (generic plans) reduces workload alignment; VMware requires application-aware recovery plans.

E (vSphere HA/DRS) does not replace site-level recovery orchestration and validation — HA/DRS only handles local host failures, not site disasters.

The requirement ensures data protection, secure access, encryption, auditing, and regulatory compliance—fundamental principles in cybersecurity. These attributes fall squarely within the design quality of Security, which concerns protecting confidentiality, integrity, and compliance. PCI-DSS compliance is about implementing security policies, encryption, access controls, monitoring, and auditing—all aspects of the Security design quality in VMware frameworks.

The VCF 9.0.1 Design Guide provides sizing best practices for vSAN stretched clusters, emphasizing capacity planning to accommodate failover conditions. It states:

“When sizing a stretched vSAN cluster, consider that in case of a site failure, all resources from the failed site must be supported by the surviving site. Therefore, compute and storage should not exceed 50% utilization per site.”

This translates into a maximum target utilization of ~45% compute and ~40% storage per site, ensuring compliance with the company’s overall 90% capacity policy when combined across both sites.

A homogeneous cluster configuration (A) ensures consistent performance and predictable recovery during failover.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Design Guide — “vSAN Stretched Cluster Capacity Planning and Sizing.” (pp. 874–885)

VMware vSAN Design and Sizing Reference — “Cluster Utilization Planning for Failover Scenarios.”

In a multi-tenant environment, isolation, predictable performance, and scalability are critical. vSAN with tiered storage policies enables the architect to define performance tiers (e.g., RAID-1 for critical workloads, RAID-5/6 for capacity-efficient workloads). This aligns with the need for low latency and high IOPS for tenant workloads, without oversubscribing or compromising performance.

Options A and D disregard tenant performance and isolation, potentially leading to noisy neighbor issues. Option B reduces availability and scalability and is contrary to best practices.

Business requirements describe the high-level goals of the organization, typically related to user experience, cost reduction, compliance, or agility.

A (best end-user experience) aligns directly with business objectives.

B, C, and D are technical requirements: they specify infrastructure design behaviors (migration, security, SLA).

Therefore, the business requirement is ensuring the best end-user experience.

The VMware Cloud Foundation 9.0.1 Architecture Guide defines three levels of design abstraction — Conceptual, Logical, and Physical. The Physical Design translates logical components into tangible configuration and implementation details. VMware describes it as:

“The physical design includes the specific details for hardware models, network topologies, storage layouts, port configurations, VLAN IDs, and zoning of Fibre Channel fabrics.”

In contrast:

The Conceptual Design defines what the solution must deliver (high-level goals and relationships).

The Logical Design outlines component relationships and service flows without vendor-specific or configuration details.

Therefore, the Physical Design is where the architect defines server model types, port mappings, uplink configurations, vSAN disk group layouts, and Fibre Channel zones, all aligned to the validated VCF Bill of Materials (BOM).

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Design Guide — Conceptual, Logical, and Physical Design Definitions (pp. 79–81).

VMware Cloud Foundation 9.0.2 Architecture Overview — Physical Design Implementation Detailing Hardware and Network Configuration.

A single VCF instance with dedicated Workload Domains per tenant strikes the balance between operational efficiency and isolation. It reduces lifecycle tasks since only one management domain must be maintained, while each tenant having a dedicated workload domain ensures isolation of compute resources. This meets all three stated requirements effectively: lifecycle simplicity, minimal overhead, and tenant-specific compute separation.

The requirement specifying "yearly workload growth of up to 10%" relates directly to the system's ability to handle increased demand over time, which falls under the design quality of Performance. Performance in VMware Cloud Foundation design includes considerations for scalability and the ability to sustain projected growth. This requirement addresses the system’s capacity to manage future workload expansion without degradation in service levels.

According to the VMware Cloud Foundation 9.0.1 Design Framework, Technical Requirements describe how the business and functional goals are to be implemented through technology, configuration, and design mechanisms. The document defines:

“Technical requirements determine how a solution’s business and functional objectives are achieved using technical means such as architecture components, configurations, and integrations.”

These are distinct from business requirements, which define what must be achieved, and constraints, which limit design options. Technical requirements translate abstract needs (for example, availability, scalability, performance) into actionable design implementations (such as anti-affinity rules, distributed switches, NSX federation, or vSAN stretched clusters).

By following VMware’s VCF Design Methodology, architects use technical requirements to shape logical and physical architectures, ensuring that all solution components meet the identified business outcomes and compliance standards.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Design and Architecture Guide — Requirements Classification and Technical Requirements Definition (pp. 58–61).

VMware Cloud Foundation 9.0.2 Design Framework — Business, Functional, and Technical Requirement Mapping to Design Decisions.

VCF Automation (Aria Automation) supports multi-tenancy with separate AD integration:

B: Each tenant must use their own AD instance, aligning with independence across business units.

C: Create a tenant per business unit, ensuring isolation and dedicated resource allocation.

D (projects per business unit) could work in a single-tenant scenario but doesn’t address multi-AD separation.

A/E force consolidation into corporate AD or single projects, violating independence requirements.

D: Setting UserVars.SuppressShellWarning = 0 ensures warnings are shown when shell access is used, improving auditability and compliance.

E: Using certificates signed by a trusted military Root CA aligns with security compliance standards for certificate trust and chain of custody.

Options A and C are operational best practices, but not military hardening. B is about operations automation, not compliance-level hardening.

The VMware Cloud Foundation 9.0.1 Architecture Overview and Operations Integration Guide state that VCF Operations, combined with VCF Operations for Logs, provides a unified monitoring and observability solution across the entire VCF fleet. The documentation specifies:

“Integrating VCF Operations with VCF Operations for Logs and VCF Automation provides a single-pane-of-glass for monitoring metrics, events, and flows across all management and workload domains.”

Furthermore, the High Availability deployment model for VCF Operations for Logs is required to meet the 99.9% SLA for continuous availability of monitoring data.

“VCF Operations for Logs can be deployed in High Availability mode to ensure log continuity and fault tolerance.”

Thus, the architect must:

Integrate VCF Operations with both Logs and Automation (B, D) for unified visibility.

Deploy Logs in High Availability (F) mode to achieve the 99.9% availability SLA.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Operations Design Guide — “Integrated Operations and Log Monitoring Architecture.”

VMware Cloud Foundation 9.0.4 Integration Guide — “VCF Operations and Logs HA Deployment.”

As defined in the VMware Cloud Foundation 9.0.1 Architecture and Design Guide, the vSAN Compute Cluster Storage Model is designed to allow compute and storage scaling to occur independently. The guide specifies:

“A vSAN Compute Cluster is a vSphere cluster that does not contribute storage resources to the vSAN datastore. Instead, it consumes storage from a remote vSAN cluster through HCI Mesh. This architecture enables compute and network resources to scale independently of storage.”

This design provides flexibility in disaggregated architectures, allowing organizations to expand compute clusters without needing to expand vSAN capacity nodes and vice versa. Such a model is particularly useful for data-intensive workloads or environments with unpredictable growth patterns in compute versus storage.

Other options, such as vSAN ESA Storage Model or vSAN ESA Storage Cluster Model, represent Enhanced Storage Architecture configurations but do not inherently separate compute scaling. Hence, the correct answer is the vSAN Compute Cluster Storage Model, as it uniquely supports independent scalability while maintaining centralized management under the VCF architecture.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Architecture and Design Guide — “vSAN Compute Cluster Model (Disaggregated Storage Architecture)” (pp. 870–875).

VMware Cloud Foundation 9.0.2 Design Guide — “Compute and Storage Independent Scaling using HCI Mesh.”