VMware 3V0-12.26 - Advanced VMware Cloud Foundation 9 Architect

A and E best satisfy the multi-instance scale requirement while keeping the identity-management footprint as small as possible.

A VCF Identity Broker should be associated with the management infrastructure , not deployed independently in workload domains. Broadcom documentation shows VCF Identity Broker as part of the VCF management-plane architecture and identifies the management domain as the normal installation location for the identity service. ( VMware Blogs )

The scale requirement determines the number of Identity Broker deployments. Broadcom states that an external/appliance VCF Identity Broker is intended for multi-instance fleets and is recommended to support up to five VCF instances . ( VMware Blogs ) With seven VCF instances , one broker would exceed that recommended scale boundary, while seven embedded brokers would create unnecessary compute footprint and operational overhead. The minimum practical topology is therefore two VCF Identity Broker deployments , distributed through the VCF Management Services architecture.

VCF 9.1 further integrates identity services with the broader VCF Management Services platform, and Broadcom requires the Identity Broker to reside on the same management network as those services.

B is incorrect because workload domains are not the preferred hosting boundary for centralized fleet identity. C creates the largest footprint. D is insufficient by itself because a single Identity Broker does not meet the recommended scale for seven VCF instances.

Study Guide References/Topics: VCF Identity Broker; Fleet-Level SSO; VCF Management Services; Management Domain Placement; Multi-Instance Identity Design; Identity Broker Scale and Footprint.

C and E provide the centralized SSO architecture required while minimizing operational complexity. The VCF Identity Broker can provide identity services across a fleet containing multiple VCF instances , eliminating the need to deploy and manage an independent identity stack for every VCF instance. Broadcom describes the external Identity Broker model as providing identity services across a VCF Fleet, with centralized SSO covering VCF Operations, vCenter, NSX, and other platform components. ( VMware Blogs )

Deploying the Identity Broker with the first VCF instance at DC01 (C) establishes the centralized identity service. E then allows additional VCF instances within the same private cloud to consume that existing VIDB rather than introducing redundant identity infrastructure at every site.

This architecture also supports REQ02 . VCF Identity Broker federates authentication to supported enterprise identity providers, including SAML-based providers, Entra ID, Okta, and others. Multi-factor authentication can therefore be enforced by the corporate identity provider and applied across the VCF management stack. ( VMware Blogs )

A unnecessarily duplicates VIDB infrastructure and increases administration. B similarly creates additional identity components without a requirement for separate identity domains. D incorrectly references a VIDB hosted at DC02 when the centralized design establishes the first VIDB at DC01.

Study Guide References/Topics: VCF Single Sign-On; VCF Identity Broker; Fleet-Level Identity Management; Multi-Instance VCF Design; Identity Federation; MFA/Two-Factor Authentication; Centralized Management Services.

The correct design is the Continuous Availability VCF Operations Model because the requirement is to survive the loss of an entire availability zone/fault domain without service interruption .

Broadcom states that VCF Operations Continuous Availability (CA) stretches the analytics cluster across two fault domains and allows the deployment to tolerate the complete failure of one fault domain while continuing to operate without cluster downtime. CA requires an equal number of analytics nodes in each fault domain plus a witness node located in a third failure domain to prevent split-brain conditions.

The use of an external load balancer also aligns with a multi-node VCF Operations design by providing a common service endpoint and directing UI/API traffic to available cluster members. VCF Operations 9.x does not provide a built-in VIP for multi-node deployments, so an external HTTP load balancer is required when a resilient common endpoint is used.

B is insufficient because standard High Availability protects against one node failure , not loss of an entire fault domain. C is a connectivity/federation concept rather than an availability topology. D is the smallest footprint but provides no protection against an AZ failure.

Therefore, the simplest topology that actually satisfies zero interruption during a single AZ failure is Continuous Availability .

Study Guide References/Topics: VCF Operations Deployment Models; Continuous Availability; Fault Domains; Witness Node; External Load Balancing; High Availability versus Continuous Availability.

D is correct. The requirements call for dynamic BGP connectivity to the physical network, availability-zone independence, and separate northbound connectivity for management and workload infrastructure . A Provider Gateway is backed by an NSX Tier-0/VRF gateway and provides the northbound connection between VCF virtual networking and the physical network. Establishing BGP peering between each AZ ' s Provider Gateway and its local ToR/core switches provides deterministic dynamic route exchange while maintaining fault-domain independence.

Broadcom identifies BGP as the recommended route-distribution protocol between NSX Tier-0 gateways and the physical network. In centralized connectivity designs, Tier-0 Service Routers can peer directly with physical routers using BGP, with multiple service routers providing resilient northbound paths.

Using an independent Provider Gateway per AZ also creates a scalable pattern for adding the planned third availability zone without forcing all northbound traffic through one centralized gateway.

A is incorrect because VRRP is not the prescribed NSX Provider Gateway HA mechanism. B contradicts the explicit BGP requirement by proposing static routing. C creates a centralized dependency and does not satisfy independent management-domain and workload-domain northbound connectivity.

Study Guide References/Topics: VCF Provider Gateway Design; NSX Tier-0 Gateways; BGP Northbound Routing; Multi-Availability-Zone Network Fabric; ToR Connectivity; Fault-Domain Independence; ECMP and Network Scalability.

B, C, and F are the factors that directly influence business requirements during the conceptual-design phase.

Service-level agreements (B) define business expectations for service delivery, including availability, recovery objectives, responsiveness, and support commitments. These requirements ultimately drive technical architecture decisions around redundancy, disaster recovery, monitoring, and capacity.

Organizational structure (C) affects how the VCF environment must support departments, tenants, administrative boundaries, operational responsibilities, chargeback models, and access controls. A centralized IT organization can require a different VCF operating model from one where business units operate independently.

Regulatory Compliance (F) can impose mandatory business obligations involving data location, retention, security, auditing, resiliency, and access governance. These obligations must be identified during requirements gathering because they can fundamentally constrain the resulting architecture.

By contrast, storage capacity (A) , average VM size (D) , and existing software product versions (E) are primarily technical discovery and sizing inputs. They are important to the physical and logical design, but they do not themselves represent the principal business-context factors requested here.

Broadcom ' s VCF Architect blueprint specifically expects architects to translate stakeholder business objectives into technical designs while distinguishing business requirements from technical requirements and identifying constraints, risks, assumptions, and dependencies. ( docs.broadcom.com )

Study Guide References/Topics: Requirements Gathering; Business Requirements; Stakeholder Analysis; Service-Level Agreements; Organizational Structure; Regulatory and Compliance Requirements; Conceptual Design.

C and D are the primary factors that directly determine the required vSAN storage capacity and its performance/redundancy characteristics.

C is correct because the selected vSAN storage policy determines how VM objects are placed and how much physical capacity they consume. Broadcom documents that Failures to Tolerate (FTT) controls redundancy, while the RAID method determines capacity efficiency and performance. For example, RAID-1 with FTT=1 creates mirrored data and consumes approximately 2× the logical data size, while FTT=2 mirroring consumes approximately 3× . Stripe width can also affect performance and component consumption.

D is correct because workload quantity and sizing establish the fundamental storage demand. The proposed 725 VMs (475 + 250) at an average 275 GB each represent approximately 199.4 TB of logical VM disk capacity before applying redundancy, metadata, operational reserve, and growth allowances. Storage policies then multiply or otherwise alter that physical-capacity requirement.

E affects cluster architecture and determines whether certain policies can be supported—for example, RAID-6 FTT=2 requires at least six hosts—but with 15 hosts already specified , host count is not the principal sizing factor among the choices. A concerns management-network redundancy, while B addresses workload networking rather than vSAN capacity design.

Study Guide References/Topics: vSAN Storage Policy-Based Management; Failures to Tolerate; RAID-1/5/6; Stripe Width; Workload Profiling; Storage Capacity Planning; VCF Workload Domain Storage Design.

C is correct. Secure communication between VCF components depends heavily on trusted certificates and cryptographically strong signing algorithms. VMware Cloud Foundation design guidance explicitly recommends using SHA-2 or higher for signed certificates . The official VCF design documentation states: “Use a SHA-2 algorithm or higher for signed certificates.” It further explains that SHA-1 is considered less secure and has been deprecated. ( Adobe Tech Docs )

This directly maps to the stated requirement because certificates are used to establish authenticated and encrypted TLS communication between VCF management and workload-domain components. A sufficiently strong certificate-signing algorithm protects certificate integrity and reduces exposure to cryptographic weaknesses associated with legacy algorithms.

A concerns hardware compatibility and supportability rather than secure communications. B provides hardware-rooted security capabilities such as measured boot and attestation but does not directly implement secure component-to-component communication. D is a valid Layer 2 security hardening setting that prevents unauthorized traffic inspection, but it addresses virtual-switch security rather than the broader requirement for authenticated secure communications throughout the VCF platform.

The VMware Cloud Foundation Architect exam guide explicitly includes workload-domain logical-design decisions within the Plan and Design objective. ( Broadcom Docs )

Study Guide References/Topics: VCF Workload Domain Logical Design; Certificate Management Design Recommendations; SHA-2 Certificate Signing; TLS/SSL Security; Security Architecture.

Deploying a separate Workload Domain for each department most directly satisfies the stated requirements for scalability, flexibility, future expansion, and infrastructure independence.

A VCF Workload Domain is an administrative and lifecycle boundary containing its associated vSphere infrastructure and related configuration. New workload domains can be added to the VCF environment as organizational or application requirements grow. Current VCF workflows explicitly support creating additional workload domains through VCF Operations, including assigning a unique workload-domain identity and configuring the associated vCenter and NSX resources.

D therefore provides the strongest fit because each department can scale its compute, storage, networking, policies, and lifecycle requirements without forcing unrelated departments into the same infrastructure boundary.

A and B scale only one workload domain and therefore reduce organizational and infrastructure separation. They may increase raw capacity, but they do not meet the requirement for independent workload-domain growth.

C is architecturally inconsistent. Multiple workload domains cannot simply be combined into one common vSphere cluster; the cluster is managed within the context of its workload domain. VCF operational workflows also treat workload domains as distinct management entities—for example, synchronization operations are executed independently for each workload domain.

Study Guide References/Topics: VCF Workload Domain Architecture; Workload Domain Scalability; Administrative and Lifecycle Boundaries; VCF Operations; Adding Workload Domains; Infrastructure Isolation and Growth Planning.