VMware 3V0-23.25 - Advanced VMware Cloud Foundation 9.0 Storage

The approximate expected usable capacity is 40 TB. The cluster contains six hosts, each with two 4 TB NVMe disks, giving 48 TB of raw capacity. Because the policy uses FTT=1 with RAID-5 erasure coding, vSAN provides better capacity efficiency than mirroring. RAID-5 with FTT=1 typically uses approximately 1.33x overhead, leaving roughly 75% of raw capacity before additional reserves and data-reduction assumptions. The design also requires Host Rebuild Reservation, which reserves enough capacity to rebuild data after a host failure, and an Operational Reserve of 10% to support internal operations such as resynchronization and policy changes. The expected filesystem and object overhead of 25% further reduces available capacity, while the deduplication/compression ratio of 2 increases the effective usable capacity. After accounting for protection overhead, capacity reserves, operational overhead, and the stated data-reduction assumption, the closest expected usable value from the available choices is 40 TB. Reference topics: vSAN Capacity Sizing, RAID-5 Erasure Coding, Deduplication and Compression, Host Rebuild Reserve, Operational Reserve.

When vSAN Data-at-Rest Encryption uses an external KMS, vCenter requests a Key Encryption Key (KEK) from the KMS and stores only the key ID, not the key itself. ESX hosts use the KEK to decrypt the Data Encryption Keys that protect the encrypted vSAN disk data. If a host reboots, it must retrieve the KEK from the KMS before its encrypted vSAN disk groups can be mounted. The guide states that when a host reboots, it does not mount its disk groups until it receives the KEK. Key persistence can allow continued operation when the key server is unavailable, but the documented persistence mechanism relies on TPM-backed key persistence across reboots. In this scenario, the host does not have a Trusted Platform Module and the KMS is temporarily unavailable. Therefore, the ESX host can boot, but the encrypted storage remains unavailable and unmounted until communication with the KMS is restored. Reference topics: vSAN Data-at-Rest Encryption, External KMS, Key Encryption Key, Encryption Key Persistence.

Four hosts are required to meet the 12 TB usable-capacity requirement after applying the protection policy, data reduction, reserves, and overhead. Each host contributes 8 TB raw capacity from two 4 TB NVMe devices. Three hosts provide 24 TB raw capacity, but once host rebuild reservation, 10% operational reserve, RAID-5 protection overhead, and 25% filesystem/object overhead are considered, the remaining effective usable capacity falls below the required 12 TB target. Four hosts provide 32 TB raw capacity. With vSAN ESA and FTT=1/RAID-5, vSAN uses erasure coding to improve capacity efficiency compared with mirroring. The vSAN sizing guidance states that RAID-5 with FTT=1 provides approximately 75% usable capacity before other reserves and overhead. Host Rebuild Reserve must also be planned so the cluster has enough free capacity to rebuild components after a host failure. After applying the expected 1.5 data reduction ratio and the required reserves, four hosts provide enough usable capacity while three hosts do not. Reference topics: vSAN ESA Capacity Sizing, RAID-5 Erasure Coding, Host Rebuild Reserve, Operations Reserve, vSAN Object Overhead.

The two major contributors are RAID overhead and Operational Reserve. With the default policy set to FTT=1 using RAID-1 mirroring, vSAN stores two copies of protected data. The capacity planning guidance states that when Failures to tolerate is set to 1 failure with RAID-1 mirroring, virtual machines can use about 50 percent of raw capacity because each object consumes mirrored space. This is the largest capacity-impacting factor. The second contributor is Operational Reserve, which reserves capacity for vSAN internal operations such as policy changes, rebalancing, object movement, and other transient storage activities. Even when Host Rebuild Reserve is not activated, vSAN capacity monitoring still accounts for the operations threshold/reserve needed to keep the cluster functional during internal activity. Encryption overhead is typically not the primary reason for a 20% capacity difference. Host upgrade overhead is not a vSAN capacity category. VM swap can consume capacity, but it does not normally account for most unavailable raw capacity compared with RAID mirroring and operational reservation. Reference topics: vSAN Capacity Planning, RAID-1 FTT=1 Capacity Impact, Operations Reserve, Reserved Capacity.

Assigning different vSAN Storage Policies to each file share during creation satisfies the requirement because vSAN File Service allows each file share to be created with its own storage policy. The Create File Share workflow includes a Storage Policy selection, which controls how the file share’s underlying vSAN objects are protected and placed. This is the correct mechanism when each department requires distinct protection levels or placement rules. IP pools and file server bindings provide network endpoint capacity and service placement, but they do not define the protection level of file share data. Creating separate File Service clusters per department is unnecessary and operationally inefficient because file shares can be differentiated by policy within the same File Service deployment. vSphere Compute Policies influence compute placement, not vSAN object protection or file-share resilience. Therefore, the department-specific requirement is fulfilled directly by assigning the appropriate vSAN Storage Policy to each file share at creation time. Reference topics: vSAN File Service, Create File Share, Storage Policy, Placement and Protection Rules.

Because the vSAN cluster uses vSphere Lifecycle Manager images, the least disruptive remediation method from the provided choices is to enable Quick Boot in the host remediation settings for images. Quick Boot reduces host remediation time by skipping the full hardware reboot, including the BIOS or UEFI firmware reboot. This reduces the amount of time each ESX host spends in maintenance mode and lowers operational disruption during patching. The documentation states that Quick Boot can be configured for clusters or standalone hosts managed with vSphere Lifecycle Manager images, and that it reduces reboot time during remediation. The baseline options are incorrect because the cluster is explicitly managed by images, not baselines. Disabling Quick Boot would increase disruption because hosts would require a full reboot path. Disabling HA admission control is not the least-disruption patching mechanism and is listed for baseline-oriented remediation behavior in the offered answer. In a vSAN cluster, hosts enter maintenance mode one at a time, so reducing each host’s maintenance window through Quick Boot is the appropriate method. Reference topics: vSphere Lifecycle Manager Images, Host Remediation Settings, Quick Boot, vSAN Cluster Remediation.

Immutable snapshots are intended to provide hardened recovery points for cyber-recovery scenarios. In vSAN Data Protection, immutability is enabled at the protection group level. Once enabled, snapshots are read-only recovery points that cannot be modified or deleted, even by an attacker with administrative privileges. This immutability model imposes operational restrictions. A VM with immutable snapshots should not have its virtual hardware changed because hardware changes can alter the VM configuration state associated with protected recovery points. In addition, a protection group cannot be configured as both replicated and immutable, because replication and immutable local snapshot protection are separate protection behaviors with different lifecycle and retention handling. The statement that a VM cannot be part of multiple protection groups is not the specific limitation tested here. The number of snapshot schedules is not limited to seven by this requirement. Virtual hardware version 10 is also not the controlling condition for immutable snapshot configuration in this context. Reference topics: vSAN Data Protection, Immutable Snapshots, Protection Groups, Cyber-Recovery Snapshot Restrictions.

The minimum total number of nested fault domains is six. In a two-node vSAN design, site disaster tolerance is provided through host mirroring between the two data hosts, with a witness maintaining quorum. The requirement adds another layer: the solution must also survive a disk group or local storage failure in addition to a host failure. vSAN’s two-node host mirroring rule states that each data host must have at least three disk groups, or three disks in a storage pool, to use the rule. In ESA, the equivalent construct is disks in the storage pool rather than OSA-style disk groups. Because there are two data hosts, and each data host requires three nested placement units, the minimum total is 3 + 3 = 6 nested fault domains. Four would not meet the host-mirroring rule requirement, and two would only represent the two hosts without local storage fault isolation. Reference topics: vSAN Two-Node Cluster, Host Mirroring, Nested Fault Domains, vSAN ESA Storage Pool Placement.

The Live! vSphere Heavy Hitter VM dashboard is the correct place to identify which virtual machines are driving storage IOPS and disk throughput problems. In VCF Operations, heavy hitter dashboards are designed to isolate the consumers creating the highest demand on shared infrastructure resources. For storage troubleshooting, this dashboard identifies VMs producing significant I/O load, including IOPS and throughput. This is especially useful when a Fibre Channel datastore is reporting performance alerts because the datastore itself may show contention, but the root cause is often one or more high-demand VMs consuming disproportionate backend storage resources. The vSAN Health dashboard is not correct because the affected datastore is Fibre Channel, not vSAN. The vSphere Storage Inventory dashboard is useful for topology and inventory visibility, but it is not the best view for identifying the VM-level consumers causing IOPS and throughput pressure. The Storage Operations page is broader and less targeted than the Live heavy hitter view. Reference topics: VCF Operations Performance Dashboards, Storage Heavy Hitters, VM IOPS and Throughput Troubleshooting.