VMware 2V0-15.25 VMware Certified Professional - VMware Cloud Foundation 9.0 Support Exam Practice Test

vDefend – Distributed Firewall is a security capability delivered byNSXwithin VMware Cloud Foundation. Although VCF components such as SDDC Manager, VCF Operations, and VCF Automation rely on licensing frameworks, the enforcement and activation ofNSX features—including Distributed Firewall—occur entirely withinNSX Manager.

To enablevDefend (Distributed Firewall), NSX Manager must detect a valid NSX license that includes security features. Without applying the correct license directly to NSX Manager:

The Distributed Firewall feature remains locked

vDefend cannot be enabled in workload domains

Security rules and micro-segmentation capability remain unavailable

VCF does not apply NSX security licensing at the SDDC Manager, VCF Automation, or VCF Operations layers. Instead, NSX Manager handles all feature entitlement checks internally.

Therefore, the new license must be installeddirectly in NSX Manager, under:

System → Licensing → NSX → Add License

Options A, C, and D are incorrect because none of those components control NSX feature activation.

In VMware Cloud Foundation 9.0,host commissioningis performed exclusively throughSDDC Manager, not from the vSphere Client. When expanding a vSAN cluster inside a workload domain, all ESXi hosts must first be placed in anUnassignedstate and thencommissionedin SDDC Manager before they can appear in the “Add Host” wizard of the vSphere Client. The message in the problem—“No unassigned hosts available with storage type VSAN. Commission hosts with physical NICs 0 & 1 to Add Host from UI”—indicates that SDDC Manager has not yet commissioned any suitable hosts with the required NIC layout.

VCF 9.0 documentation states that for workload domain expansion, hosts must be commissioned under:

SDDC Manager → Workload Domains → (Select WLD) → Hosts → Commission Hosts.

This validates hardware, storage type (such as vSAN ESA or OSA), NIC placement, and ensures the host is compatible with the domain’s configuration.

Options pointing to vSphere Client (A, D) or VCF Operations (B) do not perform the commissioning workflow. Therefore, the correct and verified answer isC, the only interface where host commissioning is officially supported.

TheGlobal Inventory List (GIL)is only available whenmulti-vCenter SSO domain linkingis configured. In VMware Cloud Foundation, themanagement domain vCenteris deployed first and becomes theroot vCenterfor global inventory data. For workload domains, their vCenter Servers must beregistered into the same SSO domainandlinkedwith the management-domain vCenter in order for the global inventory data (VMs, hosts, clusters, content libraries) to appear.

If a workload domain vCenter is not SSO-linked, it operates in its own identity domain, and thereforecannot access or present Global Inventory, resulting in exactly the symptom described: the management domain vCenter shows the GIL, while the workload domain vCenter does not.

Option B (Supervisor Management) relates to vSphere with Tanzu and has no impact on Global Inventory.

Option C (inventory sync) is incorrect—there is no manual sync required; GIL relies entirely on SSO linking.

Option D (VIDB) is not related to vCenter linking or inventory visibility; it is used by VCF Identity Broker.

Therefore, the reason the Global Inventory is missing from the workload domain vCenter is thatSSO/vCenter Linking has not been configured, which is required for federation across all VCF vCenters.

In VMware Cloud Foundation 9.0, password changes mademanually on an NSX Edge Transport Nodearenot automatically synchronizedwith VCF Operations. VCF Operations maintains secure credential records for all managed components, including NSX Manager appliances and NSX Edge Transport Nodes. When credentials become stale—such as after a password expiration and manual reset—VCF Operations marks the credential object asout of syncand requires administrative remediation.

The official workflow described in VCF 9.0 Operations documentation states that administrators must use the“Remediate Password”function whenever a password was changed outside of VCF Operations, ensuring that the platform revalidates and updates the stored credentials used for monitoring, log collection, and automation tasks. Options such as “rotate,” “sync,” or “update” do not apply because rotation implies generating a new password managed by VCF, and “sync” does not overwrite the stored credential. Only remediation forces VCF Operations to re-validate and align credentials with the external system.

Therefore, after manually resetting the NSX Edge admin password, the administrator must perform passwordremediationin VCF Operations to restore operational consistency, makingBthe correct and verified answer.

AvSAN cluster network partitionoccurs when vSAN nodes cannot communicate over the designated vSAN network. In VMware Cloud Foundation workload domains, the vSAN network relies onL2 adjacency, consistent VLAN configuration, and stable multicast/BUM behavior (in older versions). VCF 9.0 uses unicast-mode vSAN, so multicast-related issues (such as IGMP snooping configuration) are no longer relevant.

A network partition can occur when theVLAN ID on the physical switch port differsfrom the VLAN configured on the vSphere Distributed Switch (VDS) for the vSAN VMkernel adapters. The documentation emphasizes thatconsistent VLAN configuration across the physical and virtual networkis required for proper vSAN cluster communication. If a switch port is reconfigured—intentionally or accidentally—to use a different VLAN, the node becomes isolated from the rest of the vSAN cluster, causing:

"vSAN cluster partition" warnings in vCenter

degraded performance

objects marked asnon-compliant

resyncs that cannot complete

Option A (IGMP snooping) does not apply because modern vSAN uses unicast, not multicast.

Option C (Jumbo frames) would cause packet loss only if inconsistently configured, but it doesnotcause a full network partition.

Option D (vSAN Witness on vMotion) is relevant only for stretched clusters and does not cause a partition in a standard four-node cluster.

The vSphere Client “no healthy upstream” error is a classic indicator that one or morevCenter backend services are not running or responding, preventing the reverse proxy layer (envoy / nginx) from routing requests to the appropriate upstream services.

Two services in particular are known root causes:

A. vpxd service not running

vpxd is the core vCenter Server service responsible for inventory, host management, and client interaction. If vpxd is stopped, crashed, or restarting, the vSphere Client cannot communicate with backend APIs, resulting in the “no healthy upstream” condition.

B. SSO (vmware-stsd / identity service) not running

Authentication in vCenter depends on the SSO/Identity service. If SSO is unavailable, login sessions cannot be validated, and vCenter marks the upstream service as unhealthy.

Other options donotmatch the behavior:

C (Port 443 closed)would produce a connection failure, not the upstream error.

D (logging in with root)is fully supported and does not trigger this message.

E (vmware-rbd-watchdog)relates to backup/restore health, not core authentication/management planes.

In VCF 9.0, when adding a host to a vSAN ESA-enabled cluster, the hostmust be commissioned with a network pool that includes a vSAN network configuration. Network pools define host-level networking templates for VCF, including management, vSAN, vMotion, and overlay networks. A host commissioned with avMotion-only network pooldoes not have the required vSAN ESA network interfaces (vmk + NIC mapping) to join an ESA cluster.

Because the administrator successfully commissioned the new host but only using avMotion-only network pool, VCF correctly prevents the host from being added to the ESA cluster.

The required action is:

Reassociate the host with the correct network pool that includes the vSAN ESA network.

Option A (reinstall ESXi) is unnecessary; commissioning workflows can be redone.

Option C (manual vCenter configuration) is explicitly unsupported—VCF manages host networking.

Option D (reconfiguring the existing pool) is not correct because the new host must be associated with thesame network pool used by the existing ESA cluster, not change the pool definition itself.

Therefore, the precise and VMware-documented resolution isB.

In VMware Cloud Foundation 9.0, supplemental storage such as NFS is fully supported for workload domains when configured correctly. When an NFS datastore mounts successfully in vSphere but users cannot write data, the issue almost always lies in theexport permissions on the NFS server. vSphere will allow mounting a read-only NFS export, but write operations will fail silently at the VM or guest OS level.

VCF documentation confirms that ESXi requires explicitread/write export permissions, typically configured per-host or by IP subnet, on the NFS server. Even if network connectivity and VM-level access appear healthy, incorrect server-side permissions prevent ESXi from executing write operations.

Option A is incorrect because NFS servers are not validated by the HCL for write capability.

Option B (rebooting the host) is unnecessary and unrelated to permission enforcement.

Option D (MTU mismatch) may cause performance issues, not write-access failures.

Thus, the next troubleshooting step is to verify that the ESXi hosts haveread/write accesson the NFS share, makingCthe correct answer.

In avSAN Stretched Cluster, communication between thewitness nodeanddata nodesrequires several specific TCP/UDP ports. The ability to successfully execute:

vmkping -I -s 1472 -d

confirms that:

L2/L3 connectivity is present

MTU is correctly configured

ICMP traffic flows without fragmentation

However,vmkping alone does not verify vSAN control-plane communication.

For the vSAN Witness to properly form a cluster,TCP port 12321must be openbidirectionallybetween:

Witness → Data nodes

Data nodes → Witness

Port12321is required for:

vSAN cluster membership

Witness traffic

vSAN object health/state synchronization

If this port is blocked by firewall policy or misconfigured network ACLs, the nodes can ping each other, butvSAN witness traffic will fail, preventing the stretched cluster from forming.

Why the other options are incorrect:

B. Port 443— Required for management, not cluster formation.

C. No VMs in cluster— Hasno impacton witness formation.

D. Jumbo frames not enabled— Already ruled out by the successful 1472-byte vmkping with DF bit.

In VMware Cloud Foundation (VCF) 9.0 Automation,Provider Administratorsmanage which types of Organizations can be created:

VM Apps Organizations

All Apps Organizations

These capabilities are controlled byFeature Flagswithin theVCF Automation Provider Management Portal. If the administrator logs in and only sees the ability to createAll Apps Organizations, it means that the feature flag enablingVM Apps Organization creationhas not been turned on.

VCF Automation requires the Provider Admin to explicitly enable creation ofVM Apps Organizations, because doing so exposes VM-centric consumption models and allows the environment to differentiate between VM-only and hybrid (VM + Kubernetes) application deployments.

Therefore, the administrator simply needs to navigate to:

Provider Management Portal → Administration → Feature Flags → Enable “Create VM Apps Organizations”

Option A (creating via API) is unnecessary—the UI will support it once the feature is enabled.

Option B (deleting existing VM Apps orgs) has no effect on feature availability.

Option C (deleting All Apps orgs) is unrelated and would not unlock VM Apps org creation.

VMware Cloud Foundation 9.0 introduces a major architectural redesign that replaces the traditional SDDC Manager–centric domain management model with aunified Fleet Management architectureimplemented throughVCF Operations Fleet Manager. In this model, each Workload Domain operates withits own vCenter, but Enhanced Linked Mode (ELM) isremovedto improve isolation, reduce blast radius, and support multi-site scalability. As a result, administrators logged into the vSphere Client of the Management Domaincan no longer manage or expand clusters in other Workload Domains, which explains why the vSphere UI blocks the attempted expansion of WLD-02.

Fleet Manager becomes the new authoritative control plane for lifecycle, topology, host commissioning, and workload domain expansion. Only Fleet Manager maintains the fullglobal viewnecessary to orchestrate cluster addition operations across distributed vCenters and domains. Because WLD-02 is running VCF 9.0 and is fully fleet-aware, its expansion must occur throughVCF Operations Fleet Manager, not through the vSphere Client or legacy SDDC Manager workflows.

Options involving WLD-03 are invalid since that domain is running VCF 5.2.1, is isolated, and cannot participate in fleet-aware operations. SDDC Manager (A) is no longer the correct interface for VCF 9.0 domain expansion operations.

Application Monitoring in VCF Operations uses Telegraf agents running inside virtual machines. These agents forward metrics to theCloud Proxy, which then sends them to the Operations analytics cluster. One of the most common reasons an agent stops reporting data—especially exactly24 hoursafter deployment—isclock drift or time mismatchbetween the VM (running the Telegraf agent) and the Cloud Proxy.

VCF Operations enforcesstrict timestamp validation. If the timestamps from the agent are outside the acceptable drift window, the Cloud Proxyrejectsincoming data as invalid. In this case, the Telegraf agents appear installed and functional, but no new metrics are received by the analytics engine.

This is a well-known issue documented in VMware Aria/VCF Operations agent-based monitoring, where:

Agents send metrics with local system time.

Cloud Proxy enforces time validation to prevent corrupt metric ingestion.

A drift >5 minutes commonly results inzero data collectiondespite healthy connectivity.

Options B and C cannot stop data flow after exactly 24 hours; they would preventinitialcollection. Option D (virtual hardware/tools compatibility) affects VM operations butnotTelegraf metric time-stamp validation.

To diagnose and resolve the intermittent performance and connection drop issues with the supplemental iSCSI storage, the administrator should focus on network layer consistency and health, particularly regarding packet size (MTU) and delivery (TCP).

Examine the iSCSI VMkernel port for TCP retransmissions (Action B - Diagnose):"Intermittent" connection drops and slow I/O are classic symptoms of packet loss or fragmentation issues. By examining the ESXi network stats (e.g., using esxtop key n or viewing vSphere performance charts) forTCP retransmissions, the administrator can confirm if packets are being dropped or lost in transit.Checksum offload errorscan also indicate issues where the NIC hardware is incorrectly validating packets, causing the OS to drop them. This step identifies theroot cause(packet loss/corruption).

Ensure all ESX hosts have the VMkernel port MTU set to 9000 (Action E - Resolve):For high-performance storage traffic like iSCSI in a VMware Cloud Foundation environment, it is best practice to useJumbo Frames (MTU 9000)end-to-end (Host -> Switch -> Storage Array).

The symptom thatsomehosts are affected suggestsconfiguration driftwhere those specific hosts might be set to a different MTU (e.g., 1500) or are mismatched with the physical network/target (which is likely set to 9000 for performance).

An MTU mismatch (e.g., Target sending 9000-byte frames to a Host/Switch expecting 1500) typically results in the "Do Not Fragment" (DF) bit causing packet drops, leading to the reported connection drops and retransmission delays. Ensuring a consistent MTU of 9000 across the fleet resolves this and aligns with VCF performance standards.

Note: Option A (CHAP) is for authentication security, not performance. Option C (Update network plugin) is a lifecycle task but less likely to be the immediate fix for "some hosts" having intermittent drops compared to the common issue of MTU mismatch. Option D (MTU 1500) would resolve drops if the physical network doesn't support Jumbo Frames, but would degrade performance, making E the preferred resolution for a "performance" storage tier.

In vSAN ESA or OSA networking configured through a dedicated vSphere Distributed Switch (vDS), each vSAN vmkernel port must have at least oneActivephysical uplink available at all times. The scenario describes a vDS withtwo physical adaptersandtwo uplinks, but after failure of the active uplink,vSAN traffic was lost. This only occurs when the second physical NIC isnot actually assigned to the vSAN port group—typically because its uplink is set to“Unused”.

In such a misconfiguration:

vSAN traffic only uses the single active uplink.

When that uplink fails, vSAN hasno failover path, causing immediate connectivity loss.

Option A (storage policies) does not affect network uplink behavior.

Option B (VLAN tagging) could cause connectivity failure but would not suddenly break only after an uplink failure.

Option D (failover policy not allowing fallback) affects recovery order, not immediate redundancy.

The symptoms described—reduced cluster capacity,degraded virtual machine components, andautomatic component rebuild operations—are classic indicators of avSAN disk failure or disk group degradation. vSAN continuously monitors the health of disks, disk groups, and network paths. When a physical disk or disk group becomes unavailable, vSAN will:

Mark affected components as degradedbecause the required number of replicas or witnesses cannot be maintained.

Trigger automatic repair/rebuild operations, provided there are enough healthy disks remaining in the cluster to satisfy the storage policy (e.g., FTT=1, RAID1/5/6).

Reduce available storage capacitybecause the failed device is removed from contributing to the vSAN datastore.

These behaviors align directly with documented vSAN failure-response logic, which states thatcomponent rebuilds begin automatically after a disk failure, assuming the cluster still has adequate resources.

The other options do not match the symptoms:

A. VM migration to another cluster→ does not reduce vSAN capacity nor trigger component rebuilds.

B. vSAN license capacity too small→ restricts features, not component state or capacity changes.

C. Too many VMs created→ may cause capacity pressure but doesnotmark components degraded or trigger automated rebuilds.

Onlyphysical disk failureaccurately explains all three observations simultaneously.

The status"Node Not Ready"in the NSX Manager UI (specifically in theConfiguration Statecolumn of the Edge Transport Nodes view) indicates that the NSX Manager has failed to push or validate the necessary configuration to the Edge VM.

Check Uplink Network Configuration (Option C):This is the most common cause for a "Node Not Ready" state during deployment or operation. For an Edge Node to be "Ready" (Success/Up), it must have a validTransport Nodeconfiguration, which includes theUplink Profile,IP Pool(for TEPs), and mapping to theFastpath Interfaces(N-VDS). If the uplink configuration is missing, incorrect, or the management plane cannot communicate with the edge to apply it, the node remains in a "Not Ready" state.

Why not Option A?While an Edge must be in anEdge Clusterto beutilizedby a Tier-0 Gateway, a standalone Edge Node should still report a status of "Success" (Configuration) and "Up" (Node Status) if it is healthy. Adding a "Not Ready" (unhealthy/unconfigured) node to a cluster will not fix the underlying configuration issue.

Why not Option D?Missing CPU reservations typically lead to a"Degraded"status or service crashes (Dataplane down), but "Node Not Ready" is the specific indicator of an incomplete or stalled configuration workflow, usually tied to the transport/uplink setup.

In VMware Cloud Foundation 9.0 Operations,tags created inside VCF Operations do not automatically appear in vCenter. Tags must be explicitly synchronized ("pushed") to the selected vCenter instance before they become usable for VM tagging within vCenter. This is because VCF Operations maintains its own metadata store for tags, super metrics, groups, and policies.

The correct workflow is:

Create the tag in VCF Operations.

Push (synchronize) the tag to the appropriate vCenter instance.

The tag then appears in vCenter’sTags & Custom Attributessection.

Administrators can then assign the tag to VMs.

If the push step is skipped, the tag exists only inside VCF Operations and cannot be referenced by vCenter, which is exactly the symptom described:tag not found when attempting to assign it to a VM.

Option A is incorrect because Custom Groups do not affect vCenter tag visibility.

Option B is incorrect because tag synchronization is not tied to a specific vCenter version as long as the vCenter is officially supported by VCF 9.x.

Option D is irrelevant—VMware Tools has nothing to do with tag visibility.

VMware Cloud Foundation (VCF) 9.x usesVMware Identity Broker (VIDB)as the central identity provider for the entire VCF fleet. VIDB synchronizes user and group metadata from the connected enterprise identity source, in this caseActive Directory. When a user is added to an AD groupafterthe group was already synced into VIDB,VIDB does not automatically resync group membership on demandunless a directory synchronization is performed.

In this scenario, the groupVCFA_ProviderAdminswas synchronized five days earlier. When the new userprovideradmin05was later added to the AD group, VIDB—and therefore the VCF Automation Provider Management Portal—does not recognize that new user until amanual directory resynchronizationoccurs fromVCF Operations.

This operation forces VIDB to:

Requery Active Directory

Update group membership information

Repopulate available users for import into VCF Automation

Options B and D are incorrect because they donotinfluence Identity Broker directory synchronization. Option C (disable VCF SSO) would break authentication and is not a valid solution.