VMware Cloud Foundation 9 Architect Practice Exam Questions and Answers – Part 6/6

Answer: C. Organize and allocate resources

Resource pools logically group virtual machines to hierarchically allocate CPU and memory. Distractors like high availability are features of VMware HA, not resource pools, which strictly focus on resource delegation and management.

Answer: C. 443

The vSphere Client uses port 443 for secure HTTPS connections to vCenter Server. While port 902 is used for specific backend data transfers, standard web client access relies exclusively on the default HTTPS port.

Answer: D. Use a single vSphere Lifecycle Manager composite image for the management and workload domain clusters.

A single vSphere Lifecycle Manager composite image ensures consistent ESXi versions and drivers across mixed hardware generations. This architecture leverages vendor add-ons within the image to handle heterogeneous clusters, rendering legacy baselines obsolete and unnecessary.

Answer: B. Deploy VCF Operations using the High Availability model with Collector nodes at remote sites.

The High Availability model protects the central analytics cluster, minimizing monitoring and alerting downtime. Collector nodes at remote sites continuously gather data from distributed instances, making this the only option that directly satisfies both resilience requirements.

Answer: B. vSAN

vSAN provides data security through native encryption features like data-at-rest and data-in-transit encryption. Hardware components and basic availability features like HA do not inherently provide the cryptographic protections needed for strict data security.

Answer: A. Default segment profiles provide sufficient security and operational baseline settings for most common workloads and simplify lifecycle management.

Default segment profiles are preconfigured with operational and security best practices to provide a reliable baseline for most workloads. They also simplify lifecycle management and reduce design complexity, unlike custom profiles which require continuous manual tuning and validation.

Answer: D. .vmdk

The virtual machine disk file acts as the virtual hard drive, storing the guest operating system, applications, and all user data. Configuration settings and BIOS states are stored in separate files, but the actual data payload relies entirely on the disk file.

Answer: D. Implement vSAN with tiered storage policies to ensure high I/O performance and low latency for tenant workloads.

Implementing vSAN with tiered storage policies provides granular, per-VM performance control using Storage Policy-Based Management. Single large datastores or unlimited VMs create severe noisy neighbor contention, directly degrading multi-tenant I/O performance and availability.

Answer: D. The maximum tolerable amount of time allowed before an application/service should be recovered to a usable state

The Recovery Time Objective determines the maximum tolerable downtime before a service must be restored. Remember that RTO is always about service availability time, whereas RPO is specifically focused on the maximum acceptable amount of data loss.

Answer: H. Perform ESXi host maintenance activities outside of the stated business hours.

Entering maintenance mode triggers a massive vSAN data evacuation, generating heavy storage I/O. Scheduling host maintenance outside business hours prevents this activity from impacting the application. While DRS anti-affinity rules protect availability, they do nothing to mitigate storage I/O contention.

Answer: C,E. Establish an operations practice to capture and update the thumbprint of the NSX Local Manager certificate on the NSX Global Manager every time the certificate is updated.

Using SHA-2 algorithms and maintaining NSX Federation certificate thumbprints are direct security controls. Edge appliance sizing and routing protocols address performance and availability, while VM monitoring handles restarts, meaning they do not satisfy strict security compliance requirements.

Answer: B,E. A multi-tenancy statement should be documented. || The Provider Tenant must use the embedded VCF Operations orchestrator instance.

The provider tenant leverages the embedded orchestrator, while individual tenants require dedicated external orchestrators. Sharing instances violates isolation because workflows and credentials must remain logically and physically separated across business units.

Answer: D,E. Encryption at rest capable disk drives || Dual 10Gb or faster storage network adapters

Physical design decisions specify actual hardware capabilities, such as self-encrypting drives and physical network adapters. Logical design decisions, like vSAN disk group configurations or storage policy fault domain definitions, are applied within the software layer and do not represent the hardware bill of materials.

Answer: F,G. The solution will create a VM-host anti-affinity rule to ensure all nodes of the VCF Automation cluster are located on different ESX hosts.

The correct option uses a VM-host anti-affinity rule to physically separate the automation nodes, ensuring a single hardware failure does not take down the cluster. An external load balancer is also required to intelligently route traffic away from failed nodes, satisfying the strict availability and performance requirements.

Answer: B. Deploy a second workload domain within the existing VCF Instance

Deploying a second workload domain provides a new dedicated vCenter Server, directly solving the scaling limitation. A workload domain is bound by single vCenter capacity limits, so adding clusters inside the same domain fails to bypass those hard architectural constraints.

Answer: D. VMware HA Agent

The VMware HA Agent, specifically the Fault Domain Manager service, directly monitors host health and restarts failed virtual machines. While vCenter configures this service, agents operate independently to ensure failover capabilities even during vCenter outages.