VMware 2V0-13.25 VMware Cloud Foundation 9.0 Architect Exam Practice Test

According to the VMware Cloud Foundation 9.0.4 Architecture and Design Guide, the officially supported solution for backing up and restoring workloads running on VMware Kubernetes Service (VKS) clusters is Velero, specifically the Velero Plugin for vSphere. The documentation explicitly states:

“You can backup and restore workloads running on VKS clusters by using Velero. The Velero Plugin for vSphere provides a solution for backing up and restoring workloads running on vSphere Pods and VKS clusters.”

Velero integrates with vSphere through a plugin that manages persistent volume snapshots and metadata backups to an S3-compatible object store. This provides data protection for both stateless and stateful Kubernetes workloads.

While Restic is mentioned in conjunction with Velero for additional support in some environments, it cannot operate standalone in VKS environments. Site Recovery Manager and VMware Live Recovery are used for virtual machine–based disaster recovery, not containerized workloads. Therefore, Velero is the correct and VMware-supported tool for VKS workload backup and recovery.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.4 — “Backing Up and Restoring VKS Clusters and Workloads” (pp. 5879–5887)

VMware Cloud Foundation 9.0.4 — “Install and Configure the Velero Plugin for vSphere on a Supervisor” (pp. 5880–5885)

The requirement ensures data protection, secure access, encryption, auditing, and regulatory compliance—fundamental principles in cybersecurity. These attributes fall squarely within the design quality of Security, which concerns protecting confidentiality, integrity, and compliance. PCI-DSS compliance is about implementing security policies, encryption, access controls, monitoring, and auditing—all aspects of the Security design quality in VMware frameworks.

In VMware Cloud Foundation 9.0.4, automation and governance are enforced through VCF Automation policies built on VMware Aria Automation Service Broker.

Two policies directly address the customer’s requirements:

Resource Quota Policy — Controls total active resource consumption by defining limits on CPU, memory, and storage at the organization, project, or user level.

“Resource quota policies control the amount of resources that are available to your users. You define these policies to limit the resources consumed by each user, project, or the organization.”

Approval Policy — Ensures governance and validation before resource deployment or modification.

“Approval policies are used to control deployment and day-2 action requests before they are executed. Requests are evaluated and approved by designated users or roles to ensure they meet organizational policies.”

Deployment Limit Policies (option D) apply to per-deployment limits but do not govern total user-level resource consumption. Therefore, the correct combination of policies that satisfy both governance and consumption control requirements is Resource Quota Policy and Approval Policy.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.4 Architecture and Design Guide — Automation Governance: Resource Quota Policies and Approval Policies.

VMware Cloud Foundation 9.0.4 Operations Guide — Policy Configuration in VCF Automation for All Apps.

VMware Cloud Foundation 9.0.4 Policy Enforcement Reference — Approval Policy Enforcement Examples.

In a VCF Fleet with Disaster Recovery (AZ model):

vCenter is replicated to ensure management of vSphere workloads continues after a site failure.

NSX is replicated for networking continuity (segments, TEPs, Edge services).

Other components:

SDDC Manager is fleet-level and not replicated per AZ.

VCF Automation and VCF Operations are optional add-ons and not replicated automatically by the DR model.

Thus, vCenter and NSX are replicated across AZs for resiliency.

The VMware Cloud Foundation 9.0.4 Architecture and Design Guide, in the section covering Istio Service Mesh integration, defines that objects and configurations in a service mesh are grouped and managed under Service and Cluster scopes.

“In an Istio Service Mesh deployment, objects are collected into groups to simplify policy management and routing. These groups can represent logical services or clusters to which policies apply, allowing consistent control across the environment.”

Service groups organize workloads that share a common application or microservice. They enable the consistent application of routing, observability, and security policies (e.g., mTLS, rate limiting).

Cluster groups define the boundary for multi-cluster management, enabling federated control and workload discovery across multiple Kubernetes clusters within the VMware Cloud Foundation ecosystem.

These group types allow centralized configuration, policy enforcement, and telemetry aggregation across workloads deployed in VCF-managed Kubernetes environments.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.4 Architecture and Design Guide — “Istio Service Mesh Architecture and Grouping Constructs.” (pp. 5798–5802).

VMware Cloud Foundation 9.0.4 — “Service and Cluster Group Management in Multi-Cluster Istio Deployments.

RAID-1 policies offer low latency and high performance, ideal for critical workloads such as transactional databases.

RAID-5/6 provides efficient capacity usage, which is preferred for non-critical workloads.

VMware recommends the vSAN Express Storage Architecture (ESA) with 6 nodes minimum for performance and redundancy.The ESA supports better performance with fewer overheads than OSA. VMware Cloud Foundation 9.0 promotes using vSAN ESA for mission-critical workloads when latency is a priority.

Physical Switch MTU set to 9000 ensures optimal performance and reduced packet fragmentation for vSAN and NSX-T overlay networks—critical in HA scenarios.

vSAN Cache Tier Sizing at 800GB provides the necessary performance buffer to support high I/O operations and ensures continued service availability under failure or maintenance events.

Other options like DHCP lease time or NIC load-based routing do not directly influence availability SLA adherence.

Due to the explicit constraint that no internet access is permitted, the VCF Installer cannot connect to an online depot. Instead, the architect must use the offline depot model, where binaries are downloaded externally and made accessible locally within the VCF environment (e.g., using a local web server).

This setup aligns with VMware's "air-gapped" deployment guidance for VCF environments with strict security postures.

Dedicated NSX instances per workload domain provide the highest level of logical isolation and allow independent upgrade cycles, fulfilling the requirement of tenant-specific customization. Each workload domain with its own NSX instance can be managed separately, updated independently, and configured with its own security policies, BGP/VRF, segments, and gateways.

NSX Federation could achieve some level of centralization but does not support independent upgrade cycles per domain. A shared NSX instance breaks isolation and would tightly couple upgrade cycles, violating two of the key stated requirements.

When gathering business requirements, VMware’s VCF Design and Planning methodology (referenced in the VMware Cloud Foundation 9.0 Architecture and Design Guide) specifies that architects must first analyze the business-level inputs that define availability, manageability, and compliance objectives. The documentation identifies Service-Level Agreements (SLAs) and Organizational Structure as key influencing factors on design decisions because they define the scope of reliability, operational responsibility, and risk tolerance of the solution.

SLAs determine the required uptime, RPO/RTO targets, and recovery policies, directly impacting design elements such as stretched clusters, backup configuration, and resource redundancy. Similarly, the organizational structure affects operational models and determines how administrative domains, roles, and tenancy will be separated — influencing whether to implement single-tenancy or multi-tenancy within VCF Automation and how management domains are segregated.

Other options such as product versions, VM sizes, or storage capacity are important for implementation and scaling phases, not the business requirements stage. VMware explicitly distinguishes between business requirements (goals, SLAs, governance) and technical requirements (capacity, configuration) in the VCF Design Library.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0 Design Guide — Business Requirements Gathering Framework (VCF-DES-PLN-BREQ-001).

VMware Cloud Foundation 9.0 Architecture Overview — SLAs and Organizational Models Impact on Design Decisions.

VMware Cloud Foundation 9.0.1 Design Library — Mapping Business Requirements to Design Factors.

In VMware Cloud Foundation 9.0, vSphere Lifecycle Manager (vLCM) with composite images is the recommended method for managing host lifecycle. However, when using hardware of different generations, it's not advisable to use a single composite image across clusters with hardware inconsistencies due to potential compatibility mismatches with firmware and drivers.

By using separate vLCM composite images for each cluster (i.e., management and workload), the architect ensures that each cluster's image is optimized for its specific hardware generation, reducing the risk of driver/firmware issues during updates or drift remediation.

This design aligns with the principle of cluster-level lifecycle independence, especially important when working with a mix of hardware generations.

The constraint forces the use of the existing array. However, there’s a risk that performance/capacity may be insufficient. VMware’s best practice for risk mitigation in RACR is to plan for contingency.

A is correct because securing budget allocation for additional hardware addresses the risk if the array cannot meet requirements.

B (RAID mirroring) improves redundancy, not performance or capacity.

C contradicts the constraint (cannot ignore existing array).

D (extra Fibre Channel switches) doesn’t address storage array performance/capacity.

Thus, the best mitigation is budget planning for new hardware if the array fails to meet requirements.

The NSX VPC Full Services Model allows tenant isolation using VRF-lite, enabling independent routing tables within the same Tier-0 gateway.

This ensures dedicated external access without requiring a separate NSX Edge cluster per tenant, thereby minimizing the number of Edge clusters.

VMware VCF 9.0 recommends VRF Lite for multi-tenant environments with centralized Edge clusters and segmented routing needs.

BGP loop prevention relies on unique AS numbers. If the same AS is reused, routes may be dropped. In NSX VPC designs, assigning a unique private AS per Tier-0 gateway ensures clean routing without triggering loop detection.

A: Timer adjustment affects convergence, not loop detection.

C: iBGP with physical routers is non-standard and doesn’t solve the loop issue.

D: TEP traffic is unrelated to BGP routing loops.

To track configuration drift in VMware Cloud Foundation, the solution uses Configuration Templates and drift checks:

A: Template for the Management Cluster ensures cluster-level baseline is tracked.

B: Scheduling drift checks every 30 days ensures changes are detected.

D: Template for NSX Manager ensures network and security components are included in drift detection.

C (Management vCenter) is not separately templated, it’s part of cluster drift.

E (remediation every 30 days) is not required — detection is enough.

F (Host Profiles) is vSphere-specific, not aligned with VCF’s drift management framework.

In VMware Cloud Foundation, each VI workload domain is backed by a single vCenter Server instance. By deploying multiple clusters within the same VI workload domain, the architect can support multiple use cases (e.g., separating prod/dev), without provisioning new vCenters. This design reduces management overhead and operational complexity.

However, if stricter separation is needed (e.g., multi-tenancy or lifecycle independence), separate workload domains may be more suitable. While vSAN is the default, it's not mandatory unless vSAN Ready Nodes are used for bring-up.

Constraints are design limitations that cannot be changed and must be worked around.

B (no funding for new storage, so existing must be used) is a clear constraint, as it restricts the architect from proposing new storage hardware.

A (out of maintenance) represents a risk (unsupported hardware may fail).

C and D are requirements, not constraints, because they describe desired functionality of the solution.

Thus, the correct constraint is that existing storage must be used due to funding limitations.

These are classic Recoverability metrics. The Recovery Time Objective (RTO) and Recovery Point Objective (RPO) directly relate to how fast and how much data can be recovered after a failure or disaster event. The architect must ensure the VCF deployment includes recovery mechanisms, such as stretched clusters or backup/replication technology, that meet these defined RTO/RPO targets.

VCF 9.0 design documentation specifies that LACP-based link aggregation between ESXi and ToR switches is supported only when LACP failback mode is configured, ensuring a link can pass traffic before LACP PDUs are received . Since the VMware team cannot change physical networking and aggregation is in place, the design must mandate LACP fallback to maintain compatibility and connectivity resilience. Other answers are incorrect because VCF supports link aggregation in both management and workload domains if properly configured .

This statement expresses a financial limit — “Remaining budget” — constraining future expenditures on hardware. This is clearly a constraint, as it restricts the design options (e.g., can't procure new hardware). In the VMware Conceptual Model framework, constraints are factors that limit design choices without introducing risk or goal definitions.

In a multi-tenant environment, isolation, predictable performance, and scalability are critical. vSAN with tiered storage policies enables the architect to define performance tiers (e.g., RAID-1 for critical workloads, RAID-5/6 for capacity-efficient workloads). This aligns with the need for low latency and high IOPS for tenant workloads, without oversubscribing or compromising performance.

Options A and D disregard tenant performance and isolation, potentially leading to noisy neighbor issues. Option B reduces availability and scalability and is contrary to best practices.

The VCF 9.0.1 Design Guide provides sizing best practices for vSAN stretched clusters, emphasizing capacity planning to accommodate failover conditions. It states:

“When sizing a stretched vSAN cluster, consider that in case of a site failure, all resources from the failed site must be supported by the surviving site. Therefore, compute and storage should not exceed 50% utilization per site.”

This translates into a maximum target utilization of ~45% compute and ~40% storage per site, ensuring compliance with the company’s overall 90% capacity policy when combined across both sites.

A homogeneous cluster configuration (A) ensures consistent performance and predictable recovery during failover.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Design Guide — “vSAN Stretched Cluster Capacity Planning and Sizing.” (pp. 874–885)

VMware vSAN Design and Sizing Reference — “Cluster Utilization Planning for Failover Scenarios.”

The overall private cloud SLA is 99.9%, but Platinum applications require 99.99%, which exceeds the infrastructure SLA. VMware design methodology states:

If an application’s SLA is higher than the infrastructure SLA, then the application itself must provide the additional resilience (e.g., clustering, active-active deployment, or application-level HA).

Options A and B reduce flexibility or impose unnecessary complexity.

Option D (Proactive HA) improves resiliency but cannot guarantee 99.99%, since Proactive HA still depends on underlying infrastructure SLA.

Therefore, the only valid recommendation is that Platinum workloads must implement resilience at the application layer.

The Managed Telegraf Agent provides full observability and is centrally managed through VMware Aria Operations (formerly vRealize Operations). It is ideal for scenarios where both OS and infrastructure application metrics are needed, such as in the Fully Managed and OS Managed services. This meets the requirement for monitoring while minimizing manual overhead. The Self-Managed service does not require agent deployment, as only VM-level metrics are needed.

Comprehensive and Detailed Explanation from VMware Cloud Foundation 9.0 Documentation:

According to VMware Cloud Foundation 9.0 Design Guide (Table 59, “Certificate Management Design Recommendations”), VMware explicitly mandates that “Use a SHA-2 algorithm or higher for signed certificates. The SHA-1 algorithm is considered less secure and has been deprecated.” This recommendation (VCF-SEC-RCMD-CERT-002) is a foundational part of securing communication between management components and workload domains across the VCF environment.

The use of SHA-2 or higher ensures that all certificates used for SSL/TLS communication within the SDDC ecosystem (including vCenter, NSX Manager, and SDDC Manager) meet modern cryptographic standards to prevent vulnerabilities such as collision attacks. VMware Cloud Foundation enforces certificate management policies that require replacement of default VMCA-signed certificates with CA-signed certificates, and the SHA-2 algorithm ensures cryptographic integrity, authenticity, and resistance to tampering or impersonation.

This configuration directly satisfies the customer’s requirement for secure communication in the logical design of the workload domain. It ensures data in transit between components—such as management clusters, workload domains, and external systems—remains encrypted and trustworthy, aligning with VMware’s zero-trust and compliance-focused architectural principles.

References (VMware Cloud Foundation 9.0.1 Architecture Guide):

Table 59: Certificate Management Design Recommendations — “VCF-SEC-RCMD-CERT-002 Use a SHA-2 algorithm or higher for signed certificates.”

VMware Cloud Foundation 9.0.1 PDF, pp. 306–308, 376, and 592 (Certificate Management Design Recommendations Sections).

VMware Cloud Foundation Security Governance and Compliance Design Section (VCF-SEC-RCMD-CERT-002).

In the VMware Cloud Foundation 9.0.4 Architecture and Design Guide, VCF Automation supports multi-tenancy through the creation of separate organizations, each with its own catalog, users, and identity source. The document under “Organizations in VCF Automation” explains:

“Organizations in VCF Automation are created by the provider administrator in the Provider Management Portal. Each organization has its own identity source and resource allocations. The organization administrator can then configure its own self-service catalog and governance policies.”

By configuring separate organizations for Development and Production, the architect ensures logical segregation of resources, catalogs, and permissions. Each organization can manage its own projects, namespaces, and service catalogs independently, meeting both the self-service and segregation requirements.

This design aligns with VMware’s provider–tenant model, where each tenant (organization) operates autonomously while still being managed under a common provider infrastructure.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.4 Design Guide — “Organizations in VCF Automation: All Apps and VM Apps Organizations.”

VMware Cloud Foundation 9.0.4 — “Self-Service Catalog in VCF Automation.”

According to the VMware Cloud Foundation 9.0.1 Design Framework, Technical Requirements describe how the business and functional goals are to be implemented through technology, configuration, and design mechanisms. The document defines:

“Technical requirements determine how a solution’s business and functional objectives are achieved using technical means such as architecture components, configurations, and integrations.”

These are distinct from business requirements, which define what must be achieved, and constraints, which limit design options. Technical requirements translate abstract needs (for example, availability, scalability, performance) into actionable design implementations (such as anti-affinity rules, distributed switches, NSX federation, or vSAN stretched clusters).

By following VMware’s VCF Design Methodology, architects use technical requirements to shape logical and physical architectures, ensuring that all solution components meet the identified business outcomes and compliance standards.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.1 Design and Architecture Guide — Requirements Classification and Technical Requirements Definition (pp. 58–61).

VMware Cloud Foundation 9.0.2 Design Framework — Business, Functional, and Technical Requirement Mapping to Design Decisions.

The requirement specifying "yearly workload growth of up to 10%" relates directly to the system's ability to handle increased demand over time, which falls under the design quality of Performance. Performance in VMware Cloud Foundation design includes considerations for scalability and the ability to sustain projected growth. This requirement addresses the system’s capacity to manage future workload expansion without degradation in service levels.

According to the VMware Cloud Foundation 9.0.4 Documentation (p.5802–5804), administrators can configure resource limits for vSphere Namespaces, which define how much CPU, memory, and storage can be consumed.

The guide specifies under “Set Resource Limits to a vSphere Namespace”:

“As a vSphere administrator, you can set resource limits and container defaults on a vSphere Namespace. Options include CPU, Memory, and Storage. Container defaults set CPU limits, CPU requests, memory requests, and memory limits for containers within the Namespace.”

These limits provide governance and ensure that workloads deployed within a namespace do not exceed predefined consumption levels, maintaining cluster resource balance and preventing noisy-neighbor scenarios.

The document further clarifies that storage limits are applied per storage policy and CPU and memory limits define the total reserved compute capacity available to workloads and pods running in the namespace.

References (VMware Cloud Foundation documents):

VMware Cloud Foundation 9.0.4 — “Set Resource Limits to a vSphere Namespace” (p.5802–5803)

VMware Cloud Foundation 9.0.4 — “Self-Service Namespace Template Provisioning Workflow.”