VMware 3V0-23.25 Advanced VMware Cloud Foundation 9.0 Storage Exam Practice Test

The correct design is to use VMFS datastores on the existing Fibre Channel SAN as principal storage for each workload domain. VCF supports Fibre Channel storage as a principal storage model for workload domains, and FC-backed VMFS datastores integrate directly with vSphere storage operations, VCF Operations monitoring, datastore clusters, Storage DRS, and Storage Policy Based Management. Assigning multiple storage policies based on array and LUN performance tiers allows VM placement and operational control to reflect the service levels provided by the SAN. This aligns with large-scale VI best practices where block storage arrays provide resilient paths, LUN masking, zoning, multipathing, and consistent performance tiers. Option A fails because it limits FC use to the Management Domain and uses local disks for workload domains, which does not match the requirement to leverage enterprise FC SAN for workloads. Option C is invalid because an external FC SAN cannot be mounted as a vSAN datastore. Option D incorrectly routes workload storage through management-cluster vVols and does not match the requested VMFS-on-FC architecture. Reference topics: Fibre Channel Storage Model, VMFS Datastores, Principal Storage, SPBM, Datastore Clusters.

The Live! vSphere Heavy Hitter VM dashboard is the correct place to identify which virtual machines are driving storage IOPS and disk throughput problems. In VCF Operations, heavy hitter dashboards are designed to isolate the consumers creating the highest demand on shared infrastructure resources. For storage troubleshooting, this dashboard identifies VMs producing significant I/O load, including IOPS and throughput. This is especially useful when a Fibre Channel datastore is reporting performance alerts because the datastore itself may show contention, but the root cause is often one or more high-demand VMs consuming disproportionate backend storage resources. The vSAN Health dashboard is not correct because the affected datastore is Fibre Channel, not vSAN. The vSphere Storage Inventory dashboard is useful for topology and inventory visibility, but it is not the best view for identifying the VM-level consumers causing IOPS and throughput pressure. The Storage Operations page is broader and less targeted than the Live heavy hitter view. Reference topics: VCF Operations Performance Dashboards, Storage Heavy Hitters, VM IOPS and Throughput Troubleshooting.

The policy edit is valid for a six-node vSAN ESA cluster because RAID-6 with Failures to tolerate set to 2 requires at least six ESX hosts in the vSphere cluster. However, editing a VM storage policy that is already associated with virtual machine objects does not automatically communicate the new requirements to those objects. vSphere marks the compliance status as Out of Date, indicating that the policy has been edited but the new requirements have not yet been communicated to the datastore where the VM objects reside. The administrator must reapply the VM Storage Policy to the affected objects before vSAN evaluates the new RAID-6 requirement and begins any layout changes or resynchronization needed to bring objects into compliance. The change is not rejected because the cluster satisfies the minimum host count. It is not automatically applied serially to the VMs, and the 60-minute timer is related to repair-delay behavior after failures, not normal storage policy changes. Reference topics: Reapply Virtual Machine Storage Policy, Out-of-Date Compliance, vSAN ESA RAID-5, vSAN ESA RAID-6.

With “Ensure Accessibility,” vSAN migrates only the minimum amount of data required to keep objects accessible while the host enters maintenance mode. This mode is faster than Full Data Migration, but it does not fully reprotect all objects. The documentation states that objects might no longer be fully compliant with their storage policy during this evacuation mode, meaning they might not have access to all replicas. Because the default policy is RAID-1 with FTT=1, each object can tolerate only one failure. While the first host is in maintenance mode, some VM objects are already running in a reduced-availability state. If a second host loses network connectivity during this window, affected objects can lose quorum or access to required components. vSAN does not immediately rebalance or fully rebuild objects simply because Ensure Accessibility was selected, and permanent data loss is not the expected result from a temporary network loss. The likely impact is that some VMs become inaccessible until either the maintenance host returns or the isolated host reconnects. Reference topics: vSAN Maintenance Mode, Ensure Accessibility, Default Storage Policy, RAID-1 FTT=1, Network Partition Handling.

Both vSAN OSA and vSAN ESA require a trusted key provider before Data-at-Rest Encryption can be enabled. With a standard external KMS, the configuration process includes adding the KMS to vCenter and establishing trust with the KMS. vCenter then provisions encryption keys from the key provider. The vSAN encryption workflow uses a Key Encryption Key from the KMS to protect Data Encryption Keys used by ESX hosts. This requirement applies to vSAN encryption generally and is not limited to a specific vSAN architecture. OSA supports external KMS integration, so the option stating that OSA does not support external KMS integration is incorrect. Trusted Platform Modules are not mandatory prerequisites for either OSA or ESA. The vSphere key provider requirements state that TPM is not required for a standard key provider or for vSphere Native Key Provider, although Native Key Provider availability can optionally be restricted to hosts with TPMs. Therefore, the mandatory prerequisite is a trusted KMS identity for both OSA and ESA. Reference topics: vSAN Data-at-Rest Encryption, Standard Key Provider, KMS Trust, OSA and ESA Encryption Support, TPM Requirements.

Option D is the only design that uses supported non-vSAN storage models while matching the workload characteristics. VMFS over Fibre Channel is a supported enterprise block-storage option for the Management Domain and provides shared, resilient storage with SAN fabric pathing, zoning, LUN masking, and multipathing. Production requires low-latency block storage, and VMFS over NVMe/FC aligns with that requirement by using NVMe over Fibre Channel transport for high-performance block access. Non-production requires high-capacity file-based storage, and NFS v4.1 is the supported file-based option listed in the design. Option A is invalid because SMB is not a supported vSphere datastore protocol for VCF workload domain storage. Option B fails because local VMFS datastores do not provide the required shared storage model for a VCF Management Domain, and iSCSI is not presented as the complete best-fit block-storage design in the choices. Option C violates the explicit non-vSAN requirement by using vSAN ESA, vSAN HCI Mesh, and vSAN File Services. Reference topics: Supported Non-vSAN Storage, Fibre Channel Storage Model, NVMe/FC, NFS Storage Model, Principal and Supplemental Storage.

The correct steps are to create an NFS export on the storage array and mount the NFS datastore on each ESX host in the cluster. NFS datastore creation begins on the storage system, where the storage administrator creates and exports the NFS volume or directory with the required access permissions for the ESX hosts. After the export exists, vSphere mounts that export as a datastore. For a clustered VCF workload domain, the datastore must be mounted consistently across all ESX hosts in the cluster so that HA, DRS, vMotion, and VM placement can operate correctly. Mounting the datastore on only one host would create inconsistent datastore accessibility and could prevent workloads from moving or restarting on other hosts. “Attach NFS as a secondary datastore” is not the correct procedural step; the datastore is created and mounted as a vSphere datastore. Configuring vSAN is irrelevant because the workload domain already uses NFS storage and the task is to add another NFS datastore. Reference topics: NFS Datastore Creation, NFS Export, Host Accessibility, VCF Workload Domain Storage Administration.

vSAN ESA Storage Clusters are the optimal choice because the workload profile is capacity-heavy and benefits from disaggregated storage. The requirement for 2.5 PB of application data, archival workloads, gateways, and development/test applications indicates a need to scale storage capacity independently from compute resources. VMware Cloud Foundation describes a vSAN storage cluster as a disaggregated storage solution based on vSAN ESA. It provides storage resources but not compute resources, and its datastore can be mounted by vSAN compute clusters or vSAN HCI clusters. This model is designed for storage-dense environments where capacity and performance can be expanded without adding unnecessary compute. A standard vSAN ESA HCI cluster is excellent for high-performance workloads, but it scales compute and storage together. vSAN OSA all-flash and hybrid use the older disk-group architecture and are less suitable for this large-capacity, storage-centric design. Therefore, the principal storage recommendation should be vSAN ESA Storage Clusters to meet scalability, performance, and capacity growth requirements. Reference topics: vSAN Storage Cluster, Disaggregated Storage, vSAN ESA, Storage Models.

Because the vSAN cluster uses vSphere Lifecycle Manager images, the least disruptive remediation method from the provided choices is to enable Quick Boot in the host remediation settings for images. Quick Boot reduces host remediation time by skipping the full hardware reboot, including the BIOS or UEFI firmware reboot. This reduces the amount of time each ESX host spends in maintenance mode and lowers operational disruption during patching. The documentation states that Quick Boot can be configured for clusters or standalone hosts managed with vSphere Lifecycle Manager images, and that it reduces reboot time during remediation. The baseline options are incorrect because the cluster is explicitly managed by images, not baselines. Disabling Quick Boot would increase disruption because hosts would require a full reboot path. Disabling HA admission control is not the least-disruption patching mechanism and is listed for baseline-oriented remediation behavior in the offered answer. In a vSAN cluster, hosts enter maintenance mode one at a time, so reducing each host’s maintenance window through Quick Boot is the appropriate method. Reference topics: vSphere Lifecycle Manager Images, Host Remediation Settings, Quick Boot, vSAN Cluster Remediation.

vSAN Stretched Clusters meet the availability-zone requirement by extending a single logical vSAN cluster across two availability zones and using a witness for quorum. This provides rapid recovery from a site or availability-zone failure because workloads remain protected by the stretched topology and vSAN site-failure tolerance. vSAN Storage Cluster addresses the need for scalable, high-performance storage that can grow independently as application capacity requirements increase. In VCF 9.0, a vSAN Storage Cluster is based on vSAN ESA and provides disaggregated storage to vSAN compute or HCI clusters. This design supports storage-dense NVMe-based nodes, high IOPS, low latency, independent capacity scaling, and centralized storage services. Encryption at rest and in transit are native vSAN capabilities that can be enabled on the vSAN-backed storage architecture. vSAN File Service is for file shares, and vSAN iSCSI Target Service is for presenting block LUNs to external initiators; neither is required by the stated application-storage design. vSAN Data Protection is valuable for snapshots and recovery points, but the core architecture requirements are best satisfied by stretched site resilience plus scalable vSAN storage clustering. Reference topics: vSAN Storage Cluster, vSAN Stretched Cluster, vSAN ESA, vSAN Encryption.

The Repair Delay Timer expires, and vSAN starts automatic repair evaluation.

Once data resync completes, objects are marked as Compliant again.

vSAN verifies policy requirements and rebuilds missing components on available capacity devices.

When a host goes offline unexpectedly, vSAN treats the missing components as absent and waits for the configured repair delay timer before initiating rebuild operations. This prevents unnecessary resynchronization when a host or device returns quickly. In this scenario, the host is offline for more than an hour, so the repair delay timer expires and vSAN begins automatic repair evaluation. vSAN then checks the assigned storage policies, available capacity, and fault-domain placement requirements to determine whether missing components can be rebuilt safely on available capacity devices. If sufficient capacity and fault domains exist, vSAN creates replacement components and starts resynchronization. When the resync process finishes and the affected objects again satisfy their assigned policies, the objects are marked Compliant. The administrator does not need to manually run a resync task from vCenter, and the host does not need to be placed into maintenance mode for automatic repair. A full cluster rebalance is a separate capacity-balancing operation and is not required before object repair. Reference topics: vSAN Repair Delay Timer, Object Compliance, Resynchronization, ESA Object Repair.

The available custom recovery steps are top-level commands, message prompts, and per-machine commands. VMware Live Site Recovery recovery plans operate like automated runbooks, and administrators can insert custom steps to match business continuity requirements. Broadcom TechDocs states that custom recovery steps can run commands or present messages to the user during a recovery. Command recovery steps are divided into two categories: top-level commands and per-virtual-machine commands. Top-level commands are inserted directly into the recovery plan and run on the VMware Live Site Recovery server. Per-machine commands are associated with individual recovered VMs and run before or after that VM is powered on, depending on placement in the workflow. Message prompts are interactive steps that pause the plan until an operator acknowledges the message, making them useful for manual validation, external approvals, or runbook checkpoints. IP reconfiguration is handled through recovery plan networking and guest customization, not as a custom step type. Writable storage snapshots are part of test recovery/storage behavior, not a custom recovery step. Reference topics: VMware Live Site Recovery Recovery Plans, Creating Custom Recovery Steps, Top-Level Commands, Message Prompts, Per-VM Commands.

vSAN datastores are not managed through datastore clusters and Storage DRS in the same way as traditional VMFS or NFS datastore collections. A vSAN cluster exposes a distributed vSAN datastore, and VM placement, resilience, space efficiency, and compliance are controlled through vSAN Storage Policy Based Management rather than Storage DRS. The scenario also includes mixed vSAN OSA and vSAN ESA storage across clusters, which introduces an additional compatibility concern. vSAN OSA and vSAN ESA datastores are different architectures and are not combined into a single datastore-cluster construct for uniform Storage DRS placement. A datastore cluster should not combine different storage architectures such as vSAN, Fibre Channel, and NFS because Storage DRS assumes similar, interchangeable datastore resources. Creating a datastore cluster through APIs does not make vSAN datastores supported in this model. Therefore, the administrator should consider that vSAN datastores are not supported in datastore clusters and should use vSAN storage policies and appropriate datastore selection instead. Reference topics: vSAN Datastores, Storage Policy Based Management, Datastore Cluster Requirements, vSAN OSA and ESA Compatibility.

A witness host for a 2-node vSAN cluster must be external to the 2-node vSAN-enabled data cluster. The witness provides quorum and must be placed outside the protected data-node pair so that it can arbitrate availability during host or site failure. If the proposed witness host resides inside the 2-node vSAN enabled cluster, it is not eligible and therefore does not appear as an available selection during the replacement workflow. Having a VMkernel adapter configured with vSAN traffic enabled is required for witness communication, so that is not the cause of the issue. Connectivity to the data hosts is also expected and does not make the witness invalid. A witness host already assigned to another 2-node vSAN cluster is not necessarily disqualified because shared witness configurations are supported within scale and sizing limits. The core eligibility issue is that the witness host cannot be a member of the same 2-node vSAN cluster that it is intended to witness. Reference topics: 2-Node vSAN Cluster, Witness Host Placement, Replace Witness Host, Shared Witness Support.

The administrator must validate that the vSphere Native Key Provider has been backed up. When a Native Key Provider is created, vCenter pushes the key provider configuration to clustered ESX hosts, but the provider is not usable for encryption tasks until it has been backed up. The documentation states that after adding a Native Key Provider, it appears as not backed up, and that it must be backed up before use. The backup process changes the provider status from Not Backed Up, to Warning while vCenter propagates information to hosts, and then to Active when the information has been pushed to all hosts. A TPM 2.0 device is not required when using Native Key Provider with default settings, although TPM can provide enhanced security and can optionally be enforced. Crypto Safe Mode and disabling Secure Boot are not prerequisites for enabling vSAN Data-at-Rest Encryption with NKP. Therefore, the validation step is to confirm that the NKP backup has been created and the provider is active on the hosts. Reference topics: vSphere Native Key Provider, Back Up Native Key Provider, vSAN Data-at-Rest Encryption, Key Provider Availability.

Assigning different vSAN Storage Policies to each file share during creation satisfies the requirement because vSAN File Service allows each file share to be created with its own storage policy. The Create File Share workflow includes a Storage Policy selection, which controls how the file share’s underlying vSAN objects are protected and placed. This is the correct mechanism when each department requires distinct protection levels or placement rules. IP pools and file server bindings provide network endpoint capacity and service placement, but they do not define the protection level of file share data. Creating separate File Service clusters per department is unnecessary and operationally inefficient because file shares can be differentiated by policy within the same File Service deployment. vSphere Compute Policies influence compute placement, not vSAN object protection or file-share resilience. Therefore, the department-specific requirement is fulfilled directly by assigning the appropriate vSAN Storage Policy to each file share at creation time. Reference topics: vSAN File Service, Create File Share, Storage Policy, Placement and Protection Rules.

Disabling the vSAN iSCSI Target Service stops the service that presents iSCSI targets and LUNs to initiators, but it does not automatically delete the targets or LUNs. The vSAN administration guidance states that if an administrator wants to remove vSAN iSCSI objects and reclaim capacity, the LUNs and targets must be deleted manually before or after disabling the service. Therefore, when the service is disabled, the existing targets and LUNs remain in the vSAN datastore but are no longer accessible to the clustered legacy application. This behavior prevents accidental deletion of application or quorum data simply because the service is turned off. The targets are not archived for a fixed retention period, and they are not automatically migrated to another namespace for retention. They are also not deleted automatically. Operationally, administrators should confirm that the legacy application no longer depends on the LUNs before disabling the service or should remove the iSCSI objects through the supported workflow when decommissioning is complete. Reference topics: vSAN iSCSI Target Service, Disable iSCSI Target Service, LUN and Target Lifecycle, vSAN Object Retention.

The cluster must not include hosts from different subnets or networks (L3).

The default management vSphere cluster must already be stretched.

The cluster must not include DPU-backed hosts.

The cluster must not share a vSAN Storage Policy with any other cluster.

To stretch a vSAN cluster in a VCF Workload Domain, the environment must satisfy specific VCF stretch prerequisites and avoid unsupported configurations. The default management vSphere cluster must already be stretched so the management plane remains available if an availability zone fails. The workload cluster must not include hosts from different subnets or Layer 3 networks because the stretch workflow expects supported site and network placement assumptions for the cluster being stretched. The cluster must also not include DPU-backed hosts, because clusters with DPU-backed hosts are excluded from this stretch operation. In addition, the cluster must not share a vSAN Storage Policy with any other cluster, because shared policies can create policy scope and compliance conflicts during stretch configuration. SSH does not need to be manually activated on all hosts as a prerequisite. The default management cluster being “not stretched” is the opposite of the required condition. Host self-signed certificates are not the listed blocking condition for this workflow. Reference topics: Stretch vSAN Cluster in VCF, Workload Domain Stretch Prerequisites, vSAN Storage Policy Constraints, Unsupported Stretch Configurations.

The correct mapping comes from the VCF 9.0 Principal and Supplemental Storage model. vSAN ESA is supported as principal storage for the Management Domain default cluster, Management Domain additional clusters, and VI Workload Domains. A vSAN Storage Cluster is not supported for the Management Domain default cluster because the initial management cluster requires a standard principal storage model, but it is supported as principal storage for Management Domain additional clusters and VI Workload Domains. Fibre Channel is supported as both principal and supplemental storage across all three domain or cluster categories, allowing either initial cluster creation or later datastore expansion. NFS v4.1 is supplemental-only across these categories. NFS can be principal only when using NFS v3; NFS v4.1 is used as supplemental storage after the domain or cluster exists. These statuses align with VCF’s distinction between principal storage, which is used during workload domain or cluster creation, and supplemental storage, which is added after creation for workloads or data-at-rest use cases. Reference topics: Storage Models, Principal Storage, Supplemental Storage, vSAN ESA, Storage Cluster, Fibre Channel, NFS.

Full Clone from Volume Snapshot

4kn Support

Online Volume Expansion

Offline Volume Expansion

Static Persistent Volume

VMware Kubernetes Service persistent volumes use vSphere storage integrations such as CNS and pvCSI to provide Kubernetes storage services backed by vSphere datastores and storage policies. The supported persistent volume capabilities include Static Persistent Volume, which allows pre-existing storage to be consumed by Kubernetes workloads; Offline Volume Expansion and Online Volume Expansion, which allow persistent volumes to be resized depending on workload and filesystem state; Full Clone from Volume Snapshot, which enables a new volume to be created from an existing snapshot; and 4kn Support, which supports modern 4K native storage devices where the underlying stack supports them. Storage vMotion with attached Persistent Volumes is not supported because moving an attached Kubernetes persistent volume while it is in active use can break attachment and consistency assumptions. Storage DRS is also not a supported persistent volume capability in this VKS context. Flash Read Cache is not part of the supported VKS persistent-volume capability set. Reference topics: VMware Kubernetes Service Storage, CNS, pvCSI, Persistent Volume Capabilities, Volume Expansion, Volume Snapshot Clone.

NFS v3 is the best recommendation because the scenario provides only Ethernet-based host connectivity and no budget for additional hardware. Fibre Channel would require appropriate FC HBAs, SAN zoning, and array presentation to all hosts. The provided hosts only have Ethernet NICs and local boot/storage devices, so they are not prepared for FC without additional hardware. VMware Cloud Foundation supports NFS as principal storage for VI workload domains, but the supported principal NFS protocol version is NFS v3. NFS v4.1 is supported as supplemental storage, not as principal storage for this use case. The documentation also states that when NFS is used as principal storage with vSphere Lifecycle Manager images, only two hosts are required, matching this two-host scenario. Fibre Channel over Ethernet is not the appropriate supported principal storage option in this VCF storage model. Therefore, NFS v3 uses the existing network capability, avoids new hardware spend, and aligns with the supported VCF principal storage model. Reference topics: Principal Storage, NFS Storage Model, VI Workload Domain Storage, Fibre Channel Prerequisites.

The prerequisite is to enable vSAN on the non-vSAN cluster so it can operate as a vSAN compute cluster. A vSAN compute cluster is a vSphere cluster that does not contribute local vSAN capacity, but it has vSAN functionality enabled so it can mount a remote vSAN datastore provided by a vSAN Storage Cluster. The Datastore Management option under the vSAN section appears only when the consuming cluster is prepared for vSAN datastore sharing. Without vSAN enabled in compute-cluster mode, the vSphere cluster remains a conventional VMFS-backed cluster and cannot use the vSAN remote datastore management workflow. The cluster does not need to be in a different VCF Workload Domain, and there is no requirement that the storage cluster maintain exactly 80% free space before the option appears. A fourth host is also not required simply to mount remote vSAN capacity. The key requirement is enabling vSAN capability on the client cluster so it can communicate with and consume the remote ESA datastore. Reference topics: vSAN Compute Cluster, Remote vSAN Datastore, Datastore Management, vSAN Storage Cluster.

The two most relevant causes are insufficient vCenter permissions and incorrect DNS resolution. The VMware Live Recovery appliance must register with vCenter as a managed extension and service endpoint, so the account used during the Configure Appliance workflow must have the required vCenter privileges. A user that can authenticate but lacks registration or administration privileges can still cause the appliance registration to fail. DNS is equally critical because appliance registration depends on stable FQDN resolution, certificate validation, Lookup Service communication, and service endpoint registration. Forward and reverse DNS records must resolve correctly between the VMware Live Recovery appliance and vCenter Server. Deploying the appliance to a non-vSAN datastore is not the primary reason for vCenter registration failure. DHCP is not inherently invalid if the resulting address and DNS records are correct, though static addressing is usually preferred. A local Photon OS account on the VCSA is not the correct account type, but the direct technical issue is the lack of required vCenter permissions. Reference topics: vSAN Data Protection, VMware Live Recovery Appliance Registration, vCenter Permissions, DNS Forward and Reverse Resolution.