VMware 3V0-23.25 - Advanced VMware Cloud Foundation 9.0 Storage

The requirement is to alternate the primary site every six months, which requires a disaster recovery design that can reverse protection direction after failover. Inventory mappings define how resources such as compute resources, folders, networks, and datastores map between the protected and recovery sites. Using “Prepare reverse mappings” during inventory mapping creation ensures that the same mapping structure can be used when the recovery site later becomes the protected site. After a failover or planned migration succeeds, VMware Live Site Recovery uses the re-protect operation to reverse the protection relationship. This makes the formerly recovered site the new protected source and prepares replication and recovery plans for failback or for the next scheduled site rotation. A test recovery plan validates recovery without changing the primary site. Extending the network can simplify workload mobility but is not required for reprotection. Reconfiguring vSAN Data Protection manually is not the Live Site Recovery workflow for reversing protected and recovery site roles. Reference topics: VMware Live Site Recovery, Inventory Mappings, Reverse Mappings, Recovery Plans, Reprotect.

The support status is based on the VCF 9.0 Principal and Supplemental Storage model. vSAN ESA is supported as principal storage for the Management Domain default cluster, Management Domain additional clusters, and Virtual Infrastructure Workload Domains. A vSAN Storage Cluster is not supported for the Management Domain default cluster, but it is supported as principal storage for Management Domain additional clusters and VI Workload Domains. NFS storage supports principal and supplemental usage when the protocol is NFS v3; the table states “Principal (NFS v3)” and “Supplemental (NFSv3 and NFSv4.1)” across all three domain categories, so NFS v3 maps to Both. iSCSI is supported only as supplemental storage across the Management Domain default cluster, Management Domain additional clusters, and VI Workload Domains. This follows the VCF distinction where principal storage is used during workload domain or cluster creation, while supplemental storage is added after creation for workloads or data-at-rest use cases such as templates, backups, and ISO images. Reference topics: Storage Models, Principal Storage, Supplemental Storage, vSAN ESA, vSAN Storage Cluster, NFS, iSCSI.

In vSAN ESA, each host uses a storage pool instead of the older OSA disk- group model. The question asks what percentage of that host’s local capacity is impacted by the failure of one storage device. Each host has 12 equal-capacity storage devices, and all 12 devices participate in one storage pool. Therefore, one failed device represents one-twelfth of that host’s local pool capacity. One divided by twelve equals approximately 8.3%. RAID-6 with FTT=2 determines object resilience across hosts and fault domains, but it does not change the simple local-capacity fraction represented by a single failed disk on one host. With sufficient cluster resources and policy compliance, vSAN ESA can continue serving data and begin repair or reprotection using remaining capacity. However, the impacted local host capacity is still the failed device’s share of the host storage pool. The correct percentage is therefore 8.3%, not 25%, 50%, or 0%. Reference topics: vSAN ESA Storage Pools, Storage Device Failure, RAID-6 FTT=2, Capacity Impact Calculation.

The workload domain should use Fibre Channel as principal storage because the existing five hosts already have resilient HBAs and are connected to a dedicated, highly resilient storage area network. The third-party block storage is also stated to have sufficient scale, capacity, and IOPS for the new workload requirements only, so it should be reused where it directly fits: the VI workload domain. VMware Cloud Foundation supports Fibre Channel as both principal and supplemental storage for VI workload domains. The management domain should use VMware vSAN as principal storage because the four new servers are being purchased for the management domain, and the existing block storage is not sized for management workloads. vSAN is a native VCF principal storage model for management domains and provides automated deployment, policy-based management, lifecycle integration, and integrated operations. iSCSI is not the right answer because the scenario describes Fibre Channel SAN connectivity and HBAs, not an iSCSI design. vSAN for the workload domain would also fail the reuse requirement because it would ignore the existing block storage investment. Reference topics: Principal Storage, Fibre Channel Storage Model, vSAN Storage Model, Management Domain Storage.

Supplemental storage is intended for adding storage capacity to an existing workload domain or cluster after the principal storage has already been deployed. Principal storage is the datastore used during workload domain or cluster creation and is normally used for live workload placement. Supplemental storage can be added later for additional workloads, templates, ISO images, backup data, or other data-at-rest requirements. In this scenario, the administrator specifically needs additional capacity for backup data and ISO images without changing or impacting the principal storage used for production workloads. Attaching additional NFS volumes or iSCSI datastores satisfies this requirement because both can be used as supplemental storage options in VCF. Migrating the Management Domain storage is unrelated and unnecessary. Increasing the existing VMFS principal storage allocation does not provide the requested separation between production and backup or ISO storage. Replacing all existing datastores with NVMe devices would be disruptive and does not match the supplemental-storage use case. Reference topics: Principal Storage, Supplemental Storage, NFS Supplemental Storage, iSCSI Supplemental Storage, Day-2 Storage Expansion.

With vSAN ESA and Failures to tolerate set to 1 using RAID-5/6 Erasure Coding, vSAN creates an optimized RAID-5 format based on the number of available fault domains. The documentation states that if five or fewer fault domains are available, ESA lists three components for RAID-5. This corresponds to a 2+1 erasure-coded layout, where two data components and one parity component are created. The stretched-cluster setting affects the site disaster tolerance rule, while the stated Failures to tolerate rule with erasure coding defines the local object protection method. The policy note also states that in a vSAN stretched cluster, the RAID-5/6 erasure coding failure tolerance method applies to the Site disaster tolerance setting. Given the answer choices, the ESA optimized RAID-5 component layout that matches FTT=1 erasure coding is three components. One or two components would not provide erasure-coded protection, and four components represents a generic RAID-5 fault-domain requirement rather than the ESA optimized component count shown in placement details. Reference topics: vSAN ESA RAID-5, Failures to Tolerate, Erasure Coding, Stretched Cluster Storage Policy.

A witness host for a 2-node vSAN cluster must be external to the 2-node vSAN-enabled data cluster. The witness provides quorum and must be placed outside the protected data-node pair so that it can arbitrate availability during host or site failure. If the proposed witness host resides inside the 2-node vSAN enabled cluster, it is not eligible and therefore does not appear as an available selection during the replacement workflow. Having a VMkernel adapter configured with vSAN traffic enabled is required for witness communication, so that is not the cause of the issue. Connectivity to the data hosts is also expected and does not make the witness invalid. A witness host already assigned to another 2-node vSAN cluster is not necessarily disqualified because shared witness configurations are supported within scale and sizing limits. The core eligibility issue is that the witness host cannot be a member of the same 2-node vSAN cluster that it is intended to witness. Reference topics: 2-Node vSAN Cluster, Witness Host Placement, Replace Witness Host, Shared Witness Support.

The correct configuration is to create distinct SPBM storage policies mapped to supported shared NFS datastore resources and assign them to the matching Supervisor storage functions. Supervisor uses storage policies to represent datastores and to manage placement of components and workload storage. The documentation states that storage policies support shared datastores such as VMFS, NFS, vSAN, and vSAN ESA. At the Supervisor level, administrators configure storage policies for control plane VMs and, when vSphere Pods are used, assign policies for ephemeral disks and container image disks. Persistent storage for workloads is also made available through storage policies assigned at namespace level. Option A is too narrow because it forces all policies to reference one datastore merely for logical isolation, while the supported model allows distinct policies mapped to one or more shared NFS datastores. Option B is incorrect because DRS is compute placement, and datastore clusters are not the Supervisor mechanism for persistent volume policy assignment. Option D is incorrect because the Supervisor does not automatically create these storage policies. Reference topics: Supervisor Storage Policies, SPBM, NFS Shared Datastores, Ephemeral Disks, Container Images, Persistent Volumes.

The user account used by the application.

The Active Directory used by the application.

The password used by the application.

NFSv4.1 with Kerberos requires identity integration through Active Directory and a valid Kerberos-capable user credential. In vSphere, Kerberos authentication for NFS 4.1 uses Active Directory credentials so ESX can authenticate securely when mounting Kerberos-protected NFS datastores. The required inputs are the Active Directory domain, the user account, and the password associated with that account. The storage guide also states that when several ESX hosts access the same NFS 4.1 datastore, all hosts must use the same Active Directory credentials to ensure consistent access. The Organizational Unit is not the required credential element for datastore mounting. The DNS name of a Kerberos server may be resolved through Active Directory and DNS infrastructure, but it is not one of the required configuration values selected here. A “Kerberos Key Management Server” is not part of the vSphere NFSv4.1 Kerberos datastore configuration model. Therefore, the required options are the application’s user account, its Active Directory, and the account password. Reference topics: NFSv4.1 Datastores, Kerberos Authentication, Active Directory Credentials, Kerberos Security for NFS.

Seven hosts per availability zone is required for this design. In a vSAN ESA stretched cluster, data components are distributed across two data sites, while a witness site provides quorum. The first requirement is a secondary level of resilience of FTT=2 using RAID-6 erasure coding. RAID-6 requires enough fault domains to place data and parity components while tolerating two failures. The second requirement is more restrictive: vSAN must be able to regain its prescribed level of resilience after a sustained host outage. This means the site must have enough remaining placement capacity to rebuild components and return objects to policy compliance after a host is lost. A six-host site can satisfy the RAID-6 placement minimum, but it does not provide the additional host needed to rebuild cleanly after a sustained host outage. Therefore, the design requires seven hosts in each availability zone. This produces fourteen data hosts across the stretched cluster, plus the witness. Reference topics: vSAN ESA Stretched Cluster Design, Secondary Level of Resilience, RAID-6 Erasure Coding, Availability Zone Host Count.