2V0-17.25 VMware Cloud Foundation 9.0 Administrator Questions and Answers

The documentation clarifies the scenario when a password is changedoutsideof VCF Operations: “When an error occurs, for example after a password expires, you must manually reset the password in the component product. After you reset the password in a component, you must remediate the password in VCF Operations.” “Password Rotation” is different—it “allows you to orchestrate the rotation” of stored credentials (a planned, VCF-driven change), not reconcile an externally altered password. Therefore, after the direct password change in vCenter, the correct recovery step in VCF Operations is to useRemediate passwordto synchronize credentials and restore management from VCF Operations.

===========

VCF provides integrated automation and orchestration for Day 0–2 operations, including networking: VCF is a “full-stack IaaS” with “automation and orchestration to simplify Day 0, Day 1, and Day 2 tasks.” VCF supports modern apps: users can provision “VMs” and “Kubernetes workloads” from self-service services, proving both VM and container support. Multi-tenancy with strong isolation is native: Organizations are “secure and isolated” boundaries; All Apps organizations run “virtual machines (VMs), Kubernetes… multiple tenants with secure infrastructure isolation.”

Incorrect choices: VCF is not limited to vSAN only (supports VMFS/NFS/CNS as documented elsewhere) and does not rely on manual scalability—automation is core. Compliance is provided within the private cloud, not only by a CSP.

VCF 9.0 introducesLog Data Transferinitiatedfrom VCF Operations. The docs say: “You can transfer log data for up to 90 days from Aria Operations for Logs 8.x… The migrated logs are stored in VCF Operations for logs.” and “To transfer logs… navigate to the Logs Data Transfer card in Administration > Control Panel… click the INITIATE TRANSFER button… You can select the duration of logs to transfer…” (emphasis added).

They further clarify that simple forwardingdoes not transfer already ingested logs: “Forward logs… does not transfer already ingested logs. Transfer historical logs up to 90 days… using the Log Data Transfer feature in VCF Operations.”

Hence, the correct action is toinitiate the transfer in VCF Operations (Administration > Control Panel > Logs Data Transfer).

===========

TheVCF 9.0 Installation Guidedescribes theVCF Download Toolfor dark sites:

“For environments without Internet access, use the VCF Download Tool on a connected machine to download required bundles and transfer them to the air-gapped VCF environment.”

Broadcom Downloads (B) is the source but not the workflow for dark sites. The VCF Installer (C) consumes binaries but does not fetch them. SDDC Manager (D) manages bundles in connected mode but cannot download in disconnected environments.

Thus, the correct method for dark sites isA. Use the VCF Download Tool.

TheVCF 9.0 Automation Guidedetails the use ofProperty Groupsto standardize blueprint inputs and constants across projects. Property Groups allow administrators to define sets of inputs (like size, os, location) and constants (like salt master id) centrally, ensuring consistency across deployments.

The correct actions are:

Create a new Property Group for input properties (C)to capture the standard inputs (size, os, location).

Create a new Property Group for constant properties (E)to include items like the salt master id.

Update all existing blueprints in the production project with the new Property Groups (F)to enforce standardization across new and existing workloads.

Options A and B are incorrect because changes are not required in theappdevproject or across the entire organization—only theproductionproject. Option D is redundant since inputs and constants should be separated into distinct groups.

TheVCF Automation Provider Networking Guidestates:

“Before you can configure Provider Networking, an active Tier-0 (T0) Gateway must be created in NSX Manager and associated with the Provider region.”

This gateway provides external routing and forms the foundation for VPC and tenant networking. Creating a T0 at the Organization level (A) is not correct—organizations consume Provider networking but do not create T0s. vDS in Provider Management (C) or vCenter (D) is unrelated to NSX-based provider networking.

Thus, the required prerequisite is:Create a T0 Gateway in NSX Manager.

TheVCF 9.0 Operations Access Control Guidedescribes how dashboard sharing and user access is managed:

Identity Broker Authentication (D):All external users must authenticate via theVCF Identity Broker, which integrates with Active Directory, LDAP, or other identity providers. Documentation states:“Identity Broker provides single sign-on and federation, ensuring users are authenticated consistently across VCF Operations and Automation services.”

Grant Access to Dashboard (E):After authentication, the administrator must explicitlygrant accessto the dashboard for the specified group. This ensures that only the intended users can view or interact with the dashboard.

Set Time-Bound Access (C):VCF Operations supports time-bound access policies. The documentation specifies:“Access can be granted with an expiration period, ensuring access is automatically revoked after the configured interval (for example, 90 days).”This aligns with the 3-month requirement.

Other options are not suitable:

Reports (A)only send static data, not interactive dashboard access.

Embedded code (B, F)bypasses access control and does not provide authentication or time-limited sharing, which violates the security requirement.

Thus, the correct three steps are:Use Identity Broker (D), Grant access to dashboard (E), and Configure 3-month access expiration (C).

TheVMware Cloud Foundation 9.0 and vSphere with Tanzu documentationdescribes the Container Storage Interface (CSI) as follows:

“The vSphere CSI driver allows vSphere storage to be exposed as persistent storage to containerized applications running on Kubernetes clusters. The driver implements the Kubernetes CSI specification and enables dynamic provisioning, attach/detach, and snapshot operations for persistent volumes.”

Key points from the documentation:

CSI is not limited tovSphere object storage(A). It works with vSAN, VMFS, NFS, and other vSphere-supported datastores.

Its purpose is to providepersistent storage(B), so containerized workloads have data that outlives pod lifecycles.

CSI is not restricted to “cloud native storage only” (C); it is the standard interface for Kubernetes persistent storage.

CSI is not used forephemeral storage(D); ephemeral storage is provided by local container runtimes and does not require CSI.

Therefore, the correct description is that CSI is aplug-in that allows providers to expose storage as persistent storageto Kubernetes workloads running in vSphere Supervisor clusters.

According to theVCF 9.0 Container Registry Documentation, Harbor is defined as:

“Harbor is an open source registry that secures artifacts with policies and role-based access control, ensures images are scanned and free from vulnerabilities, and signs images as trusted.”

This description aligns exactly with option A. Harbor is not Bitnami (B), though it integrates with open-source images. It includes vulnerability scanning but is not only an image scanner (C). It does not require GitHub as a source (D); Harbor can integrate with multiple registries.

Therefore, Harbor’s primary role within VCF is to act as asecure image registry with RBAC, scanning, and signing capabilities.

In Kubernetes RBAC,ClusterRoleBindingis the mechanism for granting permissions to resources that are not namespace-scoped. The documentation integrated into VCF 9.0 explains: “ClusterRoleBinding binds a user, group, or service account to a ClusterRole, granting cluster-wide permissions to non-namespaced resources such as nodes, storage classes, or persistent volumes.”

A RoleBinding grants access to namespace-scoped resources. RoleReference is a field within a RoleBinding/ClusterRoleBinding object, not a standalone object. ClusterRoleAccess is not a valid Kubernetes construct.

Thus, to assign permissions at a cluster-wide level, the correct object isClusterRoleBinding.

TheVCF 9.0 Logging and Auditing Guideexplains that audit information—includinguser logins, configuration changes, and API requests—is collected and made searchable throughVCF Operations for Logs. The extract states:

“VCF Operations for Logs provides centralized log aggregation and auditing for all VCF services, including audit trails of logins and configuration changes.”

Option A (audit logs per instance) is unnecessary because auditing is centralized. Option C (Enable Audit Events) is not a standalone step; it is a capability surfaced through Logs. Option D (Event logs in vCenter) covers only vCenter, not fleet-wide audit trails. Therefore, the correct step is tointegrate VCF Operations for Logs.

AVM Classpredefines hardware for Supervisor-managed VMs: “The VM class… defines such parameters as the number of virtual CPUs, memory capacity, and reservation settings.”

Administration steps show these are configurable: “You can configure hardware resources such as CPU, memory, and different devices” when editing a VM class.

Additionally, the DCLI/API specification underscores CPU and Memory fields: “--cpu-count … Required.” and “--memory-mb … Required.” for a VM class.

While network adapters, PCI devices, and instance storage can also be added via advanced config, the question asks for two;CPUandMemoryare canonical, always-present VM Class resources per the core definition above.

===========

The vSphere 9.0 Resource Management Guide describes Enhanced vMotion Compatibility (EVC) as the mechanism that masks CPU instruction set differences across ESXi hosts, presenting a consistent baseline to VMs.

The documentation states:

“EVC ensures vMotion compatibility across hosts with different CPU generations by exposing a uniform set of CPU features to all virtual machines in the cluster.”

vSphere Fault Tolerance (A): Provides continuous availability for individual VMs but does not address CPU instruction compatibility.

vSphere Availability (B): Refers to HA (High Availability) which handles VM failover, not CPU feature alignment.

Host Affinity Rules (C): Control placement of VMs but cannot solve compatibility between mixed CPU generations.

Enhanced vMotion Compatibility (D): Specifically addresses the requirement for vMotion and DRS across mixed CPU generations, making it the correct answer.

TheVCF Automation documentationdefines its primary use cases as:

Self-Service Catalog– “VCF Automation Service Broker provides a catalog for developers and operators to request services and blueprints.”

Application Dependency Mapping– achieved through integration with VCF Operations for Networks. The guide highlights: “Developers can discover application relationships and map dependencies through automated workflows in VCF Automation.”Alerting (A) is handled by VCF Operations, not Automation. VPC implementation (B) and Private AI (D) are supported solutions but not direct Automation use cases. Therefore, the correct answers areC (Self-Service Catalog)andE (Application Dependency Mapping).

TheVCF 9.0 Deployment Guidenotes: “All ESXi hosts must be installed with a supported ESXi version using a VMware ISO before they are commissioned into SDDC Manager. Commissioning is always performed via the management domain vCenter.” The new workload domain vCenter does not exist until the domain is deployed, ruling out option A. The VCF Installer is used for initial bring-up, not workload domain expansion (E). Therefore, the two required steps are:install ESXi using a valid ISO (D)andcommission hosts via the management domain vCenter (B).