3V0-11 26 Practice Questions PDF

Prévia do material em texto

https://www.passcert.com/3V0-11.26.html
Page 2
27 questions selected from source version V8.02
SOFTWARE-DEFINED STORAGE (VSAN)
Question 1
An enterprise deploys a 4-host VI Workload Domain cluster utilizing vSAN Express Storage Architecture
(ESA). The administrator is tasked with defining an appropriate Storage Policy-Based Management (SPBM)
policy for business-critical virtual machines requiring high performance and resilience against a single host
failure.
Which configuration represents the default and recommended failure tolerance method for this 4-host vSAN
ESA cluster?
A. RAID-1 (Mirroring) - 1 failure - RAID-1 (Mirroring)
B. RAID-5 (Erasure Coding) - 1 failure - RAID-5 (Single Parity) with 4+1 scheme
C. RAID-6 (Erasure Coding) - 2 failures - RAID-6 (Dual Parity) with 4+2 scheme
D. RAID-5 (Erasure Coding) - 1 failure - RAID-5 (Single Parity) with 2+1 scheme
Answer: D
Explanation
● Correct Option (D): In vSAN Express Storage Architecture (ESA), VMware introduced adaptive RAID-5 erasure coding.
For clusters with 3 to 5 hosts, vSAN ESA automatically employs a 2+1 RAID-5 erasure coding scheme (consuming only 1.5x
storage capacity compared to RAID-1's 2.0x while tolerating 1 failure). When the cluster scales to 6 or more hosts, vSAN
ESA switches to a 4+1 scheme (1.25x overhead). In a 4-host cluster, 2+1 is the native supported RAID-5 configuration.
● Distractor Analysis:
■ Option A: RAID-1 is supported but is not the recommended default in vSAN ESA because ESA provides RAID-5 erasure
coding with performance equal to or better than RAID-1, without the 100% capacity penalty.
■ Option B: The 4+1 RAID-5 scheme in vSAN ESA requires a minimum of 6 hosts (4 data + 1 parity + 1 spare/rebuild host).
■ Option C: RAID-6 (4+2 dual parity) requires a minimum of 7 hosts in vSAN ESA.
LIFECYCLE MANAGEMENT (LCM)
Question 2
An administrator clicks "Check for Updates" under Lifecycle Management in SDDC Manager, but newly
announced VMware Cloud Foundation 5.x maintenance release bundles fail to appear. The SDDC Manager
appliance has direct, unrestricted HTTPS internet connectivity to the VMware depot.
Which metadata asset must SDDC Manager successfully retrieve and parse to populate newly available
release bundles in the LCM catalog?
A. The local vSphere Lifecycle Manager (vLCM) hardware support manager (HSM) catalog.
B. The NSX Upgrade Coordinator target compatibility schema file.
C. The VMware Aria Suite Lifecycle product definition repository (PDR).
D. The VCF LCM Release Compatibility Manifest (lcm-manifest.json).
Answer: D
Explanation
● Correct Option (D): SDDC Manager discovers and validates upgrade bundles by fetching the digitally signed VCF LCM
Release Compatibility Manifest (lcm-manifest.json) from the VMware online repository. This manifest defines the complete
Bill of Materials (BOM), cryptographic hashes, target version sequencing, and prerequisite matrix for every release. If the
manifest cannot be retrieved or refreshed, SDDC Manager cannot identify or display newly released update bundles.
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 3
Question 2 continued
● Distractor Analysis:
■ Option A: The vLCM HSM catalog handles physical server hardware vendor firmware (e.g., Dell OpenManage, HPE
OneView), not VCF core system BOM bundles.
■ Option B: The NSX Upgrade Coordinator schema manages NSX internal upgrade stages, not the overarching SDDC
Manager LCM catalog.
■ Option C: The Product Definition Report (PDR) in Aria Suite Lifecycle manages Aria components, not the core VCF
software stack.
SDDC MANAGER & ARCHITECTURE OPERATIONS
Question 3
An administrator is adding a second ESXi cluster to an existing VI Workload Domain using the SDDC
Manager interface. The initial cluster uses vSAN storage and NSX networking.
Which architectural rule governs the NSX Manager deployment for this second cluster within the same VI
Workload Domain?
A. A new dedicated 3-node NSX Manager cluster must be deployed specifically for each cluster in a VI
Workload Domain.
B. The second cluster shares the existing NSX Manager cluster deployed for that VI Workload Domain and
can utilize the same or a newly defined Transport Node Profile.
C. The second cluster must connect to the Management Domain's NSX Manager cluster and cannot utilize
the workload domain's NSX instance.
D. Multi-cluster configurations within a single VI Workload Domain are unsupported in VMware Cloud
Foundation.
Answer: B
Explanation
● Correct Option (B): In VMware Cloud Foundation architecture, an NSX Manager cluster is deployed on a per-Workload
Domain basis. When multiple clusters are created within the same VI Workload Domain, all clusters share the same NSX
Manager instance. Each cluster can either apply the existing Transport Node Profile (TNP) or a newly configured TNP
depending on whether the physical server hardware and uplink topologies match.
● Distractor Analysis:
■ Option A: Deploying an NSX Manager cluster for every single vSphere cluster would result in massive, unnecessary
control plane resource consumption.
■ Option C: By default in standard VCF architecture, VI Workload Domains have dedicated NSX Manager clusters separate
from the Management Domain NSX instance.
■ Option D: Multi-cluster VI Workload Domains are a core, fully supported capability of VMware Cloud Foundation.
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 4
SOFTWARE-DEFINED STORAGE (VSAN)
Question 4
An administrator manages virtual machines hosting high-throughput OLTP relational databases on a vSAN
Express Storage Architecture (ESA) cluster. The backup administrator schedules frequent VM snapshots
during business hours.
How does the snapshot mechanism in vSAN ESA prevent the severe application latency penalties historically
observed in legacy VMFS/vSAN OSA redo-log snapshot chains?
A. By pausing virtual machine vCPUs during write bursts and caching I/O in hypervisor host RAM.
B. By redirecting all subsequent database writes to an external NFS temporary volume.
C. By converting all snapshot requests into asynchronous storage vMotion tasks.
D. By utilizing a native log-structured object engine that writes new data without maintaining deep redo-log
chains or incurring high merge/consolidation overhead.
Answer: D
Explanation
● Correct Option (D): In vSAN Original Storage Architecture (OSA) and legacy VMFS, snapshots rely on copy-on-write or
redirect-on-write redo logs (e.g., sesparse). Traversing long snapshot chains incurs a severe I/O read penalty, and snapshot
deletion/consolidation produces massive storage write amplification that stutters latency-sensitive databases. vSAN ESA
introduces a brand-new native snapshot engine built directly into its log-structured design. Snapshots in ESA are
instantaneous pointer updates that incur virtually no I/O performance penalty, supporting fast creation and consolidation
without impacting OLTP applications.
● Distractor Analysis:
■ Option A: Freezing or pausing vCPUs degrades database transactions and causes application timeouts.
■ Option B: vSAN ESA snapshots remain entirely on the local vSAN datastore; no external NFS redirection occurs.
■ Option C: Snapshots do not perform storage vMotion operations.
AUTOMATION & OPERATIONS INTEGRATION
Question 5
An enterprise deploys VMware Aria Operations for Logs (formerly vRealize Log Insight) to centralize log
management across all VMware Cloud Foundation domains.
How does SDDC Manager automate log forwarding from ESXi hosts and management appliances to the Aria
Operations for Logs cluster?
A. By installing a custom Python daemon script on each virtual machine via VMware Tools.
B. By automatically configuring the VMware Aria Operations for Logs Linux/ESXi agent (liagent) and syslog
settings across all deployed vCenters, NSX Managers, and ESXi hosts.
C. By establishing an SNMP v3 trap receiver on the physical Top-of-Rack switches.
D. By utilizing Windows EventForwarding (WEF) through an Active Directory Group Policy Object.
Answer: B
Explanation
● Correct Option (B): When VMware Aria Operations for Logs is integrated into VMware Cloud Foundation via Aria Suite
Lifecycle and SDDC Manager, SDDC Manager automatically orchestrates the configuration of the Log Insight Agent (liagent)
and syslog targets across all infrastructure endpoints: the SDDC Manager appliance, all vCenter Server instances, NSX
Manager nodes, and ESXi hosts. This ensures real-time log streaming without manual per-host configuration.
● Distractor Analysis:
■ Option A: SDDC Manager does not deploy arbitrary Python daemons inside customer VM guests for logging.
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 5
Question 5 continued
■ Option C: SNMP traps provide basic monitoring notifications, not comprehensive structured syslog telemetry.
■ Option D: Windows Event Forwarding is specific to Windows Server operating systems, whereas VCF infrastructure
components are Linux/Photon OS and ESXi appliances.
MODERN APPS & VSPHERE SUPERVISOR
Question 6
An administrator is preparing to enable Workload Management (vSphere Supervisor Cluster) on a VI
Workload Domain cluster using NSX-T networking. During the network configuration step, the wizard requires
defining the Pod CIDRs and Service CIDRs.
Which architectural rule must be strictly observed when allocating IP address ranges for these Kubernetes
internal CIDR blocks?
A. Pod CIDRs and Service CIDRs must not overlap with each other, nor with the node network, management
subnets, or enterprise routable networks.
B. The Pod CIDR must be a public routable /16 subnet configured in the external BGP route table.
C. The Service CIDR must be identical to the NSX Edge TEP subnet to enable hardware offloading.
D. The Pod CIDR must be carved out of the ESXi Host Management Network Pool.
Answer: A
Explanation
● Correct Option (A): When configuring Kubernetes networking in a vSphere Supervisor Cluster, the Pod CIDRs (used for
internal container pod IP allocation) and Service CIDRs (used for internal Kubernetes ClusterIP services) must be completely
non-overlapping private subnets (such as RFC 1918 blocks). Furthermore, they must not conflict with any physical node
subnets, management networks, or existing routable corporate IP spaces to prevent routing loops and IP conflicts.
● Distractor Analysis:
■ Option B: Pod CIDRs are internal private overlays dynamically routed or SNATed by NSX; they do not need to be public IP
ranges.
■ Option C: Service CIDRs are purely logical Kubernetes abstractions and must never share subnets with physical Host or
Edge TEP transport interfaces.
■ Option D: Pod CIDRs must never overlap with the ESXi management network pool.
SDDC MANAGER & ARCHITECTURE OPERATIONS
Question 7
An administrator runs the SOS utility on the SDDC Manager appliance with the --health-check argument to
audit system readiness before a maintenance window.
Where are the generated health check report files and diagnostic archives saved on the SDDC Manager
appliance filesystem?
A. /opt/vmware/vcf/reports/health/
B. /tmp/sddc-health-check/
C. /home/vcf/diagnostics/
D. /var/log/vmware/vcf/sddc-support/
Answer: D
Explanation
● Correct Option (D): Whenever the SOS (Supportability and Serviceability) tool completes an operation (such as
--health-check, --audit-networking, or --support-pkg), the generated summary logs, HTML/JSON report dashboards, and
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 6
Question 7 continued
compressed diagnostic bundles are archived under /var/log/vmware/vcf/sddc-support/.
● Distractor Analysis:
■ Option A, B, & C: These directory paths are incorrect; SDDC Manager structures its persistent diagnostic and support data
within /var/log/vmware/vcf/sddc-support/.
SOFTWARE-DEFINED STORAGE (VSAN)
Question 8
An administrator installs two certified NVMe SSDs into an existing ESXi host in a vSAN Express Storage
Architecture (ESA) cluster. The cluster has "Automatic disk claiming" disabled.
How should the administrator claim these new drives into the host's vSAN ESA Storage Pool using the
vSphere Client?
A. Format the drives as VMFS6 datastores and click "Mount as vSAN Extent".
B. Navigate to Host > Configure > vSAN > Disk Management, select the host, click "Claim Unused Disks",
and add the drives to the Storage Pool.
C. Create a new Disk Group on the host, assigning one NVMe drive as Tier-1 cache and the other as
capacity.
D. Run esxcli storage core device set --state offline on both drives and reboot the host.
Answer: B
Explanation
● Correct Option (B): In vSAN ESA, drives belong to a single-tier Storage Pool rather than discrete disk groups. When new
NVMe drives are installed on a host with automatic claiming disabled, the administrator navigates to Host > Configure >
vSAN > Disk Management, highlights the target host, clicks "Claim Unused Disks", verifies that the disks are detected as
eligible NVMe devices, and confirms their inclusion into the host's vSAN Storage Pool.
● Distractor Analysis:
■ Option A: Formatting disks as VMFS datastores prevents vSAN from claiming them, as vSAN requires raw, unformatted
physical block devices.
■ Option C: Disk groups are unique to vSAN OSA; vSAN ESA does not use cache/capacity disk groups.
■ Option D: Setting devices to offline marks them unreadable by the hypervisor and storage controller.
SDDC MANAGER & ARCHITECTURE OPERATIONS
Question 9
An administrator observes that the SDDC Manager web UI fails to load, returning an HTTP 503 Service
Unavailable error. The administrator logs into the SDDC Manager appliance via SSH as vcf and switches to
the root user.
Which official script should the administrator execute to perform a synchronized, graceful restart of all
backend SDDC Manager microservices (commonsvcs, operationsmanager, and lcm)?
A. /opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh
B. systemctl restart vcf-all-daemons
C. /etc/init.d/sddc-manager restart --force
D. sos --restart-management-services
Answer: A
Explanation
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 7
Question 9 continued
● Correct Option (A): VMware provides the dedicated shell script
/opt/vmware/vcf/operationsmanager/scripts/cli/sddcmanager_restart_services.sh on the SDDC Manager appliance.
Executing this script as root orchestrates the graceful termination and sequential restart of all underlying SDDC Manager
platform services-including commonsvcs, operationsmanager, and the lcm service-ensuring database locks are released and
inter-service dependencies re-initialize in the correct order.
● Distractor Analysis:
■ Option B: vcf-all-daemons is not a valid systemd unit file in Photon OS.
■ Option C: SDDC Manager runs on systemd; legacy sysvinit scripts under /etc/init.d/do not manage core VCF
microservices.
■ Option D: The sos utility does not provide a service restart parameter.
SOFTWARE-DEFINED STORAGE (VSAN)
Question 10
An administrator needs to monitor individual virtual machine disk IOPS, latency breakdowns, and physical
NVMe drive health trends in a VI Workload Domain cluster running vSAN Express Storage Architecture.
Which built-in vSAN component must be active to record and display these historical time-series performance
graphs within the vSphere Client?
A. vSAN Performance Service backed by the internal vSAN performance database object.
B. An external InfluxDB time-series database configured on the SDDC Manager appliance.
C. NetFlow v9 exporter enabled on the ESXi host management VMkernel port.
D. Storage I/O Control (SIOC) automated queue calibration.
Answer: A
Explanation
● Correct Option (A): The vSAN Performance Service collects and visualizes detailed performance metrics (IOPS,
throughput, latency, congestion, and hardware stats) across clusters, hosts, disk pools, and virtual machines. In vSAN ESAand modern vSphere clusters, the Performance Service is enabled by default and stores its statistical time-series data in a
resilient internal vSAN object (.vsan.stats), surfaced natively in the vSphere Client Monitor tab.
● Distractor Analysis:
■ Option B: vSAN does not require external third-party time-series databases like InfluxDB for native performance
monitoring.
■ Option C: NetFlow collects network traffic flow statistics, not storage I/O and device metrics.
■ Option D: Storage I/O Control (SIOC) is a legacy queue throttling mechanism and does not generate vSAN historical
diagnostic performance dashboards.
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 8
MODERN APPS & VSPHERE SUPERVISOR
Question 11
When deploying Tanzu Kubernetes clusters using modern declarative Cluster API (CAPI) on vSphere 8
/VMware Cloud Foundation 5.x, which Kubernetes custom resource definition (CRD) standardizes cluster
topology, OS version, and control plane configurations across multiple cluster deployments?
A. MachineDeploymentGroup
B. PodSecurityPolicy
C. KubeProxyDaemonSet
D. ClusterClass
Answer: D
Explanation
● Correct Option (D): In modern vSphere with Tanzu (v1beta1 API /Cluster API), ClusterClass is the declarative template
mechanism that defines the structural blueprint of a Kubernetes cluster. A ClusterClass specifies the control plane
architecture, worker node machine deployments, operating system images (TKr), networking components (Antrea/Calico),
and storage drivers, enabling administrators to stamp out standardized, production-ready clusters using concise custom
resource manifests.
● Distractor Analysis:
■ Option A: MachineDeploymentGroup is not a standard Kubernetes Cluster API resource type.
■ Option B: PodSecurityPolicy is a deprecated Kubernetes security mechanism (replaced by Pod Security
Standards/Admission), not a cluster templating framework.
■ Option C: KubeProxyDaemonSet is an internal networking daemon running inside Kubernetes, not a cluster lifecycle
template.
LIFECYCLE MANAGEMENT (LCM)
Question 12
A VI Workload Domain consists of three 8-node ESXi clusters. The administrator applies an ESXi host
update bundle through SDDC Manager.
How does SDDC Manager orchestrate host remediation across multiple clusters within the same Workload
Domain?
A. SDDC Manager remediates all hosts across all three clusters simultaneously in parallel.
B. SDDC Manager places the entire domain into read-only lockdown mode until all 24 hosts are updated.
C. SDDC Manager remediates one cluster at a time sequentially; within each cluster, hosts are evacuated
and updated one by one using vSphere Lifecycle Manager (vLCM).
D. SDDC Manager skips DRS maintenance mode checks and forces rolling host reboots every 10 minutes.
Answer: C
Explanation
● Correct Option (C): SDDC Manager coordinates multi-cluster upgrades in a strictly safe, non-disruptive sequence:
1. It processes one cluster at a time sequentially within the Workload Domain.
2. Within the active cluster, it coordinates with vSphere Lifecycle Manager (vLCM) to place hosts into maintenance mode
sequentially, evacuating virtual machines via vSphere DRS, applying software updates, rebooting the host, verifying health,
and taking the host out of maintenance mode before proceeding to the next host.
● Distractor Analysis:
■ Option A: Remediating all hosts in parallel would cause catastrophic cluster downtime and take down all running virtual
machines.
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 9
Question 12 continued
■ Option B: Workload domains never enter read-only lockdown mode during standard rolling lifecycle upgrades.
■ Option D: SDDC Manager relies heavily on DRS maintenance mode to prevent VM downtime.
LIFECYCLE MANAGEMENT (LCM)
Question 13
During a scheduled maintenance window, an administrator initiates an automated upgrade of the NSX
Manager cluster in SDDC Manager. The administrator wants to follow real-time orchestration logs from the
command line of the SDDC Manager appliance.
Which command should the administrator execute in the SDDC Manager shell?
A. tail -f /var/log/messages | grep nsx
B. tail -f /var/log/vmware/vcf/lcm/lcm-debug.log
C. journalctl -u vcf-ui -f
D. tail -f /opt/vmware/sddc-support/sos.log
Answer: B
Explanation
● Correct Option (B): The real-time, detailed execution logs for all SDDC Manager LCM operations-including bundle
verification, task sequencing, API calls to NSX/vCenter, and error stack traces-are streamed to
/var/log/vmware/vcf/lcm/lcm-debug.log. Executing tail -f /var/log/vmware/vcf/lcm/lcm-debug.log gives administrators complete
visibility into active lifecycle workflows.
● Distractor Analysis:
■ Option A: /var/log/messages logs generic operating system events and will not display LCM orchestration task progression.
■ Option C: vcf-ui logs UI web server interactions, not the underlying LCM workflow engine.
■ Option D: sos.log records diagnostic tool runs, not active upgrade task execution.
SOFTWARE-DEFINED NETWORKING (NSX)
Question 14
A security administrator wants to implement dynamic micro-segmentation in a VI Workload Domain. Virtual
machines should automatically be placed into the PCI-Compliance-Group security group when tagged,
without requiring manual group edits whenever new VMs are provisioned.
Which NSX grouping criteria mechanism enables this automated, dynamic membership?
A. Static IP address mapping list entered into the NSX inventory database.
B. Active Directory organizational unit (OU) LDAP synchronization.
C. Hypervisor physical MAC address matching tables.
D. Dynamic Membership criteria based on VM Tag (Scope and Tag string).
Answer: D
Explanation
● Correct Option (D): In NSX Distributed Firewall, Dynamic Membership criteria allows administrators to define security
groups based on VM metadata-specifically Tags (e.g., Scope: Compliance, Tag: PCI). Whenever a new virtual machine is
provisioned and tagged, NSX automatically adds the VM's vNICs to the security group, immediately applying all
corresponding micro-segmentation policies without manual intervention.
● Distractor Analysis:
■ Option A: Static IP lists require manual maintenance and defeat the purpose of automated provisioning.
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 10
Question 14 continued
■ Option B: Active Directory OU mapping is used for Identity Firewall (IDFW) user logins, not general VM
micro-segmentation.
■ Option C: MAC address matching is static, fragile, and does not scale across dynamic virtualized clouds.
SOFTWARE-DEFINED STORAGE (VSAN)
Question 15
A stretched vSAN cluster is deployed across Preferred Site (Site A) and Secondary Site (Site B) with a
Witness Host at Site C. An optical network cable failure completely isolates Preferred Site A from both Site B
and Site C.
How do vSphere HA and vSAN react to this Preferred Site failure?
A. Secondary Site B shuts down all virtual machines because Site A was marked as preferred.
B. The Witness Host assumes the role of a storage node and takes over hosting all VM disks.
C. Site B and the Witness Host form a quorum (>50% votes), and vSphere HA restarts the virtual machines
that were running on Site A onto the surviving hosts in Site B.
D. Both sites enter an unrecoverable split-brain lock until physical cables are restored.
Answer: C
Explanation
● Correct Option (C): In a vSAN stretched cluster, quorum requires more than 50% of the total cluster voting weight. When
Preferred Site A is completely severed, Secondary Site B and the Witness Host communicate and combine their votes to
achieve quorum (>50%). Recognizing that Site A has failed, vSphere HA initiates automated failover, restarting the virtual
machines previously running on Site A onto the available hosts in Site B using the surviving synchronous mirror copies.
● Distractor Analysis:
■ Option A: Site B remains active; the "Preferred"designation only dictates master tie-breaking when both sites are healthy,
not abandonment upon site failure.
■ Option B: The Witness Host stores only metadata and cluster tokens; it possesses no compute or capacity disks to run
virtual machines.
■ Option D: vSAN's witness architecture specifically prevents split-brain conditions by enforcing strict majority quorum.
SOFTWARE-DEFINED STORAGE (VSAN)
Question 16
Following a brief power fluctuation affecting a physical rack in a 12-node vSAN cluster, several virtual
machines experience storage I/O alerts. An administrator logs into an ESXi host shell to check the health of
all vSAN storage objects across the cluster.
Which command outputs a summarized count of object health states (such as Healthy, Data moved,
Reduced Availability with no rebuild, and Inaccessible)?
A. vim-cmd vmsvc/getallvms
B. esxcli network nic list
C. esxcli vsan debug object health summary
D. vcf-dump --vsan-status
Answer: C
Explanation
● Correct Option (C): The command esxcli vsan debug object health summary provides an immediate cluster-wide health
status of all vSAN objects. It categorizes objects into distinct states: Healthy, Data moved, Reduced Availability with no
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 11
Question 16 continued
rebuild, Reduced Availability with no rebuild - delay timer, and Inaccessible. This enables administrators to quickly diagnose if
objects have lost quorum or are undergoing active rebuilds.
● Distractor Analysis:
■ Option A: vim-cmd lists registered virtual machine IDs, not underlying vSAN object component health.
■ Option B: esxcli network nic list displays physical network cards on the local ESXi host.
■ Option D: vcf-dump is an SDDC diagnostic collector, not an ESXi live vSAN object debugging tool.
SOFTWARE-DEFINED NETWORKING (NSX)
Question 17
An enterprise has deployed an Active-Standby Tier-0 Gateway on a 2-node NSX Edge cluster. Both Edge
nodes (Edge-01 and Edge-02) establish external BGP peering with upstream physical Top-of-Rack routers.
The network team wants all inbound traffic from the physical network to preferentially enter through Edge-01,
while keeping Edge-02 as a passive backup.
Which BGP mechanism should be configured on Edge-02's outbound BGP route advertisement policy to
achieve this asymmetric inbound traffic preference?
A. Increase the BGP Local Preference value on route advertisements sent from Edge-02.
B. Set the BGP Weight attribute to 65535 on Edge-02.
C. Configure a BGP Route Map on Edge-02 that applies AS-Path Prepending (adding multiple copies of its
own ASN) to outbound routes.
D. Enable bidirectional multicast forwarding on Edge-01.
Answer: C
Explanation
● Correct Option (C): The BGP AS-Path Prepend technique is the standard method used to influence inbound routing from
external autonomous systems. By configuring a route map on Edge-02 that prepends its own AS number two or three times
on outbound BGP updates, upstream physical routers perceive the path through Edge-02 as longer and less desirable than
the path through Edge-01. As a result, all inbound traffic flows through Edge-01 under normal conditions.
● Distractor Analysis:
■ Option A: BGP Local Preference influences outbound egress traffic from the local AS, not inbound ingress traffic from
external physical routers.
■ Option B: Weight is a Cisco/proprietary local attribute that only impacts local router path selection; it is never transmitted in
BGP updates to neighbors.
■ Option D: Multicast forwarding has no impact on unicast BGP path preference.
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 12
SOFTWARE-DEFINED NETWORKING (NSX)
Question 18
A security engineer is investigating why a web server virtual machine (web-01) is failing to receive inbound
TCP port 443 traffic in an NSX-managed VI Workload Domain. The engineer suspects an active Distributed
Firewall (DFW) rule is blocking the traffic.
Which ESXi hypervisor CLI workflow allows the engineer to identify the exact virtual network filter name for
web-01 and dump its active firewall rule table?
A. Run esxcli network ip connection list and grep for port 443.
B. Run vim-cmd vmsvc/getallvms followed by vim-cmd vmsvc/power.getstate.
C. Run summarize-dvfilter to identify the VM's vNIC filter name, then execute vsipioctl getrules -f
 to inspect active firewall rules.
D. Run cat /etc/hosts on the ESXi host shell.
Answer: C
Explanation
● Correct Option (C): On an ESXi host running NSX, the hypervisor uses the DVFilter infrastructure to enforce Distributed
Firewall policies directly at the virtual NIC.
The standard low-level CLI diagnostic workflow is:
1. Run summarize-dvfilter to locate the target VM's virtual interface filter name (e.g., nic-1234567-eth0-vmware-sfw.2).
2. Run vsipioctl getrules -f (or use nsxcli -c get firewall rules) to dump the live compiled rule table,
counter statistics, and drop actions for that specific VM interface.
● Distractor Analysis:
■ Option A: esxcli network ip connection list shows host VMkernel connections, not VM guest vNIC firewall rule tables.
■ Option B: vim-cmd provides VM inventory and power states, but has no visibility into NSX packet inspection engines.
■ Option D: /etc/hosts provides local hostname resolution and has nothing to do with firewall rules.
MODERN APPS & VSPHERE SUPERVISOR
Question 19
A stateful enterprise application deployed on a Tanzu Kubernetes Grid (TKG) cluster requires a
PersistentVolume with ReadWriteMany (RWX) access mode so that multiple pods scheduled across different
ESXi hosts can concurrently mount, read, and write to the same shared volume.
Which vSAN capability must be enabled on the underlying vSphere cluster to natively provide RWX
file-based persistent volumes for Cloud Native Storage (CNS)?
A. vSAN iSCSI Target Service.
B. vSAN File Service.
C. vSAN Performance Service.
D. vSAN Stretched Cluster with local fault domains.
Answer: B
Explanation
● Correct Option (B): In Kubernetes, ReadWriteMany (RWX) volumes require file-level shared storage (such as NFS) rather
than block storage (which supports only ReadWriteOnce /RWO). To satisfy RWX persistent volume claims in vSphere with
Tanzu, the administrator enables vSAN File Service on the cluster. The vSphere CSI driver automatically coordinates with
vSAN File Service to dynamically export NFS shares as Kubernetes PersistentVolumes that multiple pods can mount
concurrently.
● Distractor Analysis:
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 13
Question 19 continued
■ Option A: vSAN iSCSI Target Service provides block LUNs, which cannot support concurrent multi-node file-level write
semantics (RWX) without a clustered filesystem.
■ Option C: Performance Service records metrics and does not provide file share exports.
■ Option D: Stretched clustering provides multi-site availability, not multi-pod shared file access modes.
SOFTWARE-DEFINED NETWORKING (NSX)
Question 20
An enterprise deploys an NSX Edge Cluster consisting of two virtual Edge nodes (edge-01 and edge-02) on
a shared compute cluster to host an Active-Standby Tier-0 Gateway.
Which vSphere DRS configuration must be enforced in vCenter Server to ensure that a single physical ESXi
host hardware failure cannot cause both Edge virtual machines to go offline simultaneously?
A. A DRS "Virtual Machines to Hosts" affinity rule forcing both Edge VMs to run on host 1.
B. A DRS "Separate Virtual Machines" (Anti-Affinity) rule containing edge-01 and edge-02.
C. A DRS rule setting automation level to "Manual" for all cluster hosts.
D. Disabling vSphere High Availability (HA) on the Edge VM folder.
Answer: B
Explanation
● Correct Option (B): To maintain true high availability for an Active-Standby or Active-Active NSX Edge cluster, the Edge
virtual machines must not reside on the same physical hypervisor. Creatinga DRS Anti-Affinity Rule ("Separate Virtual
Machines") ensures that vSphere DRS keeps edge-01 and edge-02 on separate physical ESXi hosts, guaranteeing that a
hardware crash on one host only triggers failover to the surviving peer without causing a double-edge outage.
● Distractor Analysis:
■ Option A: An affinity rule forcing both VMs to the same host guarantees a simultaneous double outage if that host crashes.
■ Option C: Setting DRS to Manual prevents vSphere from automatically rebalancing and separating the VMs.
■ Option D: Disabling vSphere HA eliminates hypervisor restart recovery, reducing overall resilience.
LIFECYCLE MANAGEMENT (LCM)
Question 21
During an automated ESXi cluster upgrade in SDDC Manager using vSphere Lifecycle Manager (vLCM)
image-based management, the LCM pre-check fails with the error: Hardware Support Manager (HSM)
validation error: Firmware package not found on vendor integration appliance.
Which administrative action resolves this hardware integration error?
A. Disconnect the physical power cables from all ESXi hosts for 10 minutes.
B. Access the vendor Hardware Support Manager console (e.g., Dell OpenManage Integration or HPE
OneView), synchronize the firmware catalog with the vendor repository to download the required compliance
package, and refresh the vLCM depot in vCenter.
C. Disable all Distributed Firewall rules on the NSX Edge cluster.
D. Downgrade the SDDC Manager appliance to version 4.5.
Answer: B
Explanation
● Correct Option (B): In vSphere Lifecycle Manager (vLCM) single-image management, the desired state image contains
base ESXi software, vendor add-ons, and a Hardware Support Manager (HSM) firmware/driver package provided by the
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 14
Question 21 continued
server OEM (e.g., Dell OMEVV, HPE OneView, Lenovo XClarity). If the HSM appliance has not downloaded the specified
firmware bundle from the hardware vendor's repository, vLCM blocks the upgrade. The administrator must sync the vendor
HSM catalog, ensure the package is staged, and refresh the image depot in vCenter before re-running the pre-check.
● Distractor Analysis:
■ Option A: Pulling power cables induces an immediate physical outage without solving catalog synchronization.
■ Option C: NSX DFW rules do not manage server hardware firmware repositories.
■ Option D: Downgrading SDDC Manager is unsupported and will not resolve missing hardware vendor firmware bundles.
SDDC MANAGER & ARCHITECTURE OPERATIONS
Question 22
During the host commissioning validation phase in SDDC Manager, the validation task for host
esx-09.corp.local (IP: 192.168.10.59) fails with the error: Host FQDN reverse lookup validation failed.
What is the underlying network configuration error on the enterprise infrastructure?
A. The corporate DNS server lacks a valid Pointer (PTR) record mapping IP 192.168.10.59 back to
esx-09.corp.local, or the reverse lookup zone returns a mismatched FQDN.
B. The ESXi host physical NIC is operating at 1 Gbps instead of 10 Gbps.
C. The host management VMkernel port is missing a vSAN storage policy tag.
D. The SDDC Manager appliance has an expired license key.
Answer: A
Explanation
● Correct Option (A): SDDC Manager enforces strict bidirectional DNS validation before commissioning any ESXi host.
It verifies that:
1. A forward lookup (A record) for esx-09.corp.local resolves to 192.168.10.59.
2. A reverse lookup (PTR record) for 192.168.10.59 resolves back to esx-09.corp.local.
If the PTR record is missing, corrupted, or returns an outdated hostname, SDDC Manager rejects the host during validation
to prevent certificate, SSO, and cluster configuration failures.
● Distractor Analysis:
■ Option B: Link speed discrepancies do not generate DNS reverse lookup failure messages.
■ Option C: vSAN tags are assigned to storage VMkernel ports, not the ESXi management DNS interface.
■ Option D: License expiration produces licensing warnings, not DNS PTR validation errors.
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 15
AUTOMATION & OPERATIONS INTEGRATION
Question 23
A cloud automation engineer needs to execute a custom Python script to register newly provisioned virtual
machines into an external configuration management database (CMDB) immediately after virtual disk
creation in VMware Aria Automation.
Which extensibility mechanism inside Aria Automation Cloud Assembly provides the most lightweight,
cloud-native method to trigger this custom Python logic on post-provisioning lifecycle events?
A. Action-Based Extensibility (ABX) bound to a Lifecycle Event Topic subscription.
B. Manual execution of a shell script on the SDDC Manager appliance.
C. Creating an NSX Distributed Firewall rule action.
D. Configuring a vCenter Scheduled Task on the virtual machine folder.
Answer: A
Explanation
● Correct Option (A): Action-Based Extensibility (ABX) in VMware Aria Automation allows developers to write lightweight
serverless actions using Python, Node.js, or PowerShell. By creating a Subscription that listens to the compute.provision.post
Lifecycle Event Topic, Aria Automation automatically triggers the ABX Python action whenever a VM finishes provisioning,
passing VM metadata (hostname, IP, tags) to register the asset in the external CMDB.
● Distractor Analysis:
■ Option B: Running scripts manually on SDDC Manager bypasses Aria Automation workflow pipelines and is not
automated.
■ Option C: NSX DFW rules enforce network packet filtering, not application API automation.
■ Option D: vCenter Scheduled Tasks execute basic VM power operations, not custom external CMDB REST API
integrations.
SOFTWARE-DEFINED NETWORKING (NSX)
Question 24
An administrator needs to restrict access to a database segment in a VI Workload Domain so that only
human users in the Finance-Auditors Active Directory security group can establish SSH sessions to the
database VMs, regardless of which physical desktop they log in from.
Which NSX security feature enables firewall policy enforcement based on Active Directory user and group
login sessions?
A. Context-Aware Layer 7 APP-ID
B. Identity Firewall (IDFW)
C. Unicast Reverse Path Forwarding (uRPF)
D. Port Mirroring SPAN session
Answer: B
Explanation
● Correct Option (B): NSX Identity Firewall (IDFW) enables user-based micro-segmentation. By integrating NSX Manager
with Microsoft Active Directory and configuring event log scraping (via VMware Identity Event Scraping or guest
introspection), NSX dynamically maps user logins to the IP address of their virtual desktop or terminal. Administrators can
then write Distributed Firewall rules specifying Active Directory user groups (e.g., Finance-Auditors) as the traffic source.
● Distractor Analysis:
■ Option A: Context-Aware Layer 7 APP-ID inspects packet application signatures (e.g., SSL, SSH, MySQL), but does not
identify the human Active Directory user identity.
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 16
Question 24 continued
■ Option C: uRPF prevents IP address spoofing.
■ Option D: Port mirroring captures traffic for external packet analyzers.
LIFECYCLE MANAGEMENT (LCM)
Question 25
Immediately following an automated vCenter Server upgrade in a VI Workload Domain, SDDC Manager
reports an inventory synchronization failure with the updated vCenter. The administrator logs into the SDDC
Manager appliance and attempts to resolve the vCenter FQDN using nslookup. The command returns
NXDOMAIN (non-existent domain).
What is the root cause of this post-upgrade inventory synchronization failure?
A. The vCenter Server license has expired.
B. vCenter Server Appliance has powered off its physical network interface.
C. The corporate DNS server record for the vCenter Server was inadvertently altered or deleted during the
maintenance window, breaking mutual FQDN resolution.
D. The vSAN datastore has entered read-only mode.Answer: C
Explanation
● Correct Option (C): SDDC Manager and all VMware Cloud Foundation components communicate strictly via Fully
Qualified Domain Names (FQDNs) with mutual TLS verification. If the corporate DNS server cannot resolve the vCenter
Server FQDN (NXDOMAIN), SDDC Manager's REST API clients and inventory collection daemons cannot establish
connections to vCenter, causing synchronization and post-upgrade validation tasks to fail. Restoring the correct forward A
record on the DNS server resolves the issue.
● Distractor Analysis:
■ Option A: License issues generate compliance alerts, but do not cause DNS lookup failures (NXDOMAIN).
■ Option B: Virtual machines do not have physical network interfaces.
■ Option D: Storage issues do not cause DNS servers to return NXDOMAIN for an infrastructure hostname.
MODERN APPS & VSPHERE SUPERVISOR
Question 26
A development team deploying microservices on a Tanzu Kubernetes Grid cluster needs to securely store
and inject database passwords and API tokens into application pods without embedding credentials into
container images or Git repositories.
Which native Kubernetes declarative object should the team configure to securely mount these credentials as
environment variables or volume files inside the container pods?
A. ConfigMap
B. Kubernetes Secret
C. HorizontalPodAutoscaler
D. NetworkPolicy
Answer: B
Explanation
● Correct Option (B): In Kubernetes, Secrets (v1/Secret) are specifically engineered to hold sensitive data (passwords,
tokens, TLS certificates). Secrets can be mounted securely into pod containers as environment variables or projected as
read-only tmpfs files in memory, preventing secrets from being hardcoded into Dockerfiles, manifests, or source code
https://www.passcert.com/3V0-11.26.html
https://www.passcert.com/3V0-11.26.html
Page 17
Question 26 continued
repositories.
● Distractor Analysis:
■ Option A: ConfigMaps are designed for non-confidential configuration settings (such as application port numbers or URLs),
not sensitive passwords.
■ Option C: HorizontalPodAutoscalers scale pod replica counts based on CPU/memory utilization.
■ Option D: NetworkPolicies define layer 3/4 packet filtering rules for pod communication.
SOFTWARE-DEFINED STORAGE (VSAN)
Question 27
The Skyline Health for vSAN dashboard generates a yellow warning: vSAN Disk Latency and Resync
Congestion. Virtual machines on the cluster experience intermittent I/O pauses.
What is the underlying physical or architectural cause of vSAN storage congestion?
A. Physical switch MTU misconfiguration causing dropped jumbo frames across the dedicated vSAN
VMkernel interfaces.
B. The vSAN object directory reaching the maximum supported limit of 9,000 components per ESXi host in
the cluster.
C. Deduplication and compression background tasks exhausting the available memory buffer allocated to the
disk group caching tier.
D. Lower-tier storage devices, network interfaces, or storage controllers cannot process incoming I/O write
queues as fast as virtual machines are submitting them, forcing vSAN to throttle write operations to prevent
buffer exhaustion.
Answer: D
Explanation
● Correct Option (D): vSAN Congestion occurs when an element in the I/O pipeline (disk queue depth, storage controller
throughput, write buffer cache, or network transport) becomes overwhelmed. When inbound write bursts exceed the physical
hardware's ability to drain data to persistent media, vSAN automatically injects micro-throttles (latency pauses) on client
virtual machine write requests. This prevents buffer overflows and maintains transactional consistency, but indicates that
storage hardware or network bandwidth is saturated.
● Distractor Analysis:
■ Option A: MTU mismatches typically cause complete packet drops or network disconnects, not gradual resync queue
congestion throttling.
■ Option B: Exceeding component limits triggers object creation failures, not write latency congestion throttling.
■ Option C: Deduplication and compression utilize host CPU/memory, but vSAN congestion is specifically triggered by disk
and network buffer drain delays.
https://www.passcert.com/3V0-11.26.html