5V0-31.22 VMware Cloud Foundation Specialist (v2) Questions and Answers

If you want to replace an existing license with a newly added license, you must add and assign the new license in the management UI (for example, vSphere Client or NSX Manager) of the component whose license you are replacing. https://docs.vmware.com/en/VMware-Cloud-Foundation/4.5/vcf-admin/GUID-FD3B1D45-AC70-45CC-A507-944D1A476EB9.html

This is because according to VMware documentation45, VCF supports two architecture models - standard and consolidated. The standard architecture model separates management workloads and user workloads into different domains, while the consolidated architecture model combines them into one domain. For a hybrid model that coexists with VMware on AWS cloud DR solution, the standard architecture model is recommended as it provides workload isolation and mobility across VCF instances6. The minimum requirement for creating a management domain or a VI workload domain is three hosts45.

https://docs.vmware.com/en/VMware-Cloud-Foundation/4.5/vcf-lifecycle/GUID-3B41CF79-C721-4AFC-A263-0672143DF41E.html

This is because according to VMware documentation1, a VI workload domain consists of one or more vSphere clusters that run customer workloads. To enable workload management for a VI workload domain, you need to have an NSX-T edge cluster that provides north-south connectivity and load balancing for Kubernetes clusters2. The minimum requirement for creating an NSX-T edge cluster is two edge nodes34. The size of the edge nodes depends on the throughput and features required, but for high availability, large size is recommended5.

https://docs.vmware.com/en/VMware-Cloud-Foundation/4.5/vcf-getting-started/GUID-C68FD810-D270-43F2-AEBF-D522BA1F402B.html

The SDDC Manager UI provides a single point of control for managing and monitoring your VMware Cloud Foundation instance and for provisioning workload domains. You use the navigation bar to move between the main areas of the user interface 1. The SDDC Manager UI provides an integrated view of the physical and virtual infrastructure and centralized access to manage the physical and logical resources 2.

The REST API can also be used to create a new VI workload domain using VMware Cloud Foundation. The VMware Cloud Foundation API Reference Guide provides information on available operations 3.

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/vcf-admin/GUID-6904A34A-1F67-4BBA-ACE8-12F039EC97E9.html

To provide identity and access management services to the cross-instance SDDC components, you create a global environment in vRealize Suite Lifecycle Manager in which you deploy a 3-node clustered Workspace ONE Access instance.

Workspace ONE Access is a service that provides identity and access management for the VMware Cloud Foundation environment. It enables single sign-on, multi-factor authentication, conditional access policies, and user lifecycle management for the SDDC components and workloads12

vRealize Suite Lifecycle Manager is a service that provides lifecycle management for the vRealize Suite products, such as vRealize Automation, vRealize Operations Manager, vRealize Log Insight, and Workspace ONE Access. It automates the deployment, configuration, patching, upgrading, and scaling of these products34

When you deploy a 3-node clustered Workspace ONE Access instance using vRealize Suite Lifecycle Manager, you are creating a highly available identity and access management service for your VMware Cloud Foundation environment.

References: 1: Workspace ONE Access Overview 2: VMware Cloud Foundation Design for vRealize Suite Lifecycle and Access Management 3: vRealize Suite Lifecycle Manager Overview 4: vRealize Suite Lifecycle Manager Installation, Upgrade, and Management Guide : Deploy Clustered Workspace ONE Access Instance Using vRealize Suite Lifecycle Manager

This is because according to VMware documentation34, vSphere with Tanzu uses storage policies to integrate with shared datastores available in your environment, including VMFS, NFS, vSAN, or vVols datastores. The storage policies represent datastores and manage the storage placement of such objects as persistent volumes (PVs). Storage Policy Based Management (SPBM) is a framework that provides a single unified control plane across different types of datastores and enables administrators to define policies based on storage capabilities and requirements5.

The Cloud Native Storage for vSphere with Tanzu workflow is as follows: 1. A developer deploys a pod using the kubectl CLI. 2. The vSphere with Tanzu Cloud Native Storage-Container Storage Interface (CNS-CSI) reads this request from the control plane API server. 3. CNS-CSI informs the vCenter Server CNS that a disk with gold storage class is required. 4. CNS interfaces with SPBM for a suitable datastore that satisfies the gold storage class (storage policy). 5. SPBM decides on a suitable datastore and interfaces with DRS for a suitable ESXi host. 6. Hostd on the ESXi host creates a first class disk (VMDK) on the datastore. 7. Spherelet on the ESXi host takes the VMDK. 8. Spherelet mounts the VMDK to the vSphere pod. 9. Spherelet reports the mount as a successful event to the control plane API server.

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/vcf-admin/GUID-F8398C84-2CBC-417D-944B-FA492009B072.html

https://docs.vmware.com/en/VMware-Cloud-Foundation/4.5/vcf-admin/GUID-77C40307-8466-4331-A510-9334C0F6CF32.html

https://docs.vmware.com/en/VMware-vSphere/7.0/vmware-vsphere-with-tanzu/GUID-1B136277-E46C-41FC-9C8C-3E78E9B97F5C.html

• vSphere with Tanzu uses the First Class Disk (FCD) type of virtual disks to back persistent volumes. FCD, also known as Improved Virtual Disk, is a named virtual disk not associated with a VM. FCDs are identified by UUID and can be managed independently of VMs.
• Thick provisioned VMDK, Raw Device Mapping (RDM), and Virtual Volumes (vVOLs) are not used as the backing disks for persistent volumes in vSphere with Tanzu.

The references are:

• Using Persistent Storage in vSphere with Tanzu, section “Persistent Volume”
• vSphere with Tanzu Storage, section “First Class Disk”

This is because vSphere Lifecycle Manager images can include firmware updates and third-party software components that can be applied to all hosts in a cluster12. These options are only available when using vSphere Lifecycle Manager images, not when using vSphere Lifecycle Manager baselines2.

https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere-lifecycle-manager.doc/GUID-9A112231-AD7C-4EF5-AB6A-A8DAA704D307.html

https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere-lifecycle-manager.doc/GUID-9A20C2DA-F45F-4C9B-9D17-A89BCB62E6EF.html

"In the vSphere Client, browse to the vCenter cluster where Workload Management is enabled. Select Configure. Select Supervisor Cluster. Select Image Registry. Click Enable Harbor. Select the Storage Policy for placement of container images. Click OK to complete the process" https://docs.vmware.com/en/VMware-vSphere/7.0/vmware-vsphere-with-tanzu/GUID-AE24CF79-3C74-4CCD-B7C7-757AD082D86A.html

12-29 vSphere Lifecycle Manager Baselines and Images

You use vSphere Lifecycle Manager baselines and baseline groups to perform the following tasks:

• Upgrade and patch ESXi hosts. •

Install and update third-party software on ESXi hosts.

You use vSphere Lifecycle Manager images to perform the following tasks: •

Install the desired ESXi version. • Install and update third-party software on ESXi hosts in a cluster.

• Update and upgrade the ESXi version in a cluster. • Update ESXi host firmware in a cluster. • Generate and use a recommended image for your cluster. • Check the hardware compatibility of hosts and clusters.

https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-lifecycle-manager/GUID-8883AEB4-F740-4B6B-8A44-55AA999B4089.html

A supported function of the vSphere Lifecycle Manager (LCM) in VMware Cloud Foundation (VCF) is to check hardware compatibility of hosts and clusters. This function allows you to verify that the hosts and clusters in your VCF environment meet the requirements for the desired state image that you want to apply. You can also view the compatibility status and details of each host and cluster in the SDDC Manager dashboard1.

According to About Architecture and Design for a vSphere with Tanzu Workload Domain4, two of the functionalities that a NSX Tier-0 Gateway provides to a vSphere with Tanzu deployment are:

• Connectivity to all Tier-1 Gateways: A Tier-0 Gateway connects to one or more Tier-1 Gateways that provide routing services for each namespace in vSphere with Tanzu.
• Connectivity to physical networks and routers: A Tier-0 Gateway connects to external networks via uplink interfaces that can use static routing or dynamic routing protocols such as BGP.

https://docs.vmware.com/en/VMware-vSphere/7.0/vmware-vsphere-with-tanzu/GUID-B1388E77-2EEC-41E2-8681-5AE549D50C77.html#:~:text=Only%20one%20egress%20IP%20address%20is%20assigned%20for%20each%20namespace%20in%20the%20Supervisor%20Cluster

This is because according to VMware documentation6, when integrating Microsoft Certificate Authority with SDDC Manager, you need to configure basic authentication on the Microsoft Certificate Authority Server and provide valid credentials when establishing a connection from SDDC Manager.

The three NSX components that are automated during the deployment of an edge cluster in a VMware Cloud Foundation environment are:

• Edge VM deployment: SDDC Manager deploys the NSX Edge node virtual appliances on the vSphere cluster that backs the workload domain1.
• Edge Uplink Profile configuration: SDDC Manager configures the edge uplink profile with the MTU, teaming policy, and transport VLAN settings for the edge nodes1.
• Tier-0 and Tier-1 gateway configuration: SDDC Manager creates a tier-0 gateway and a tier-1 gateway for the edge cluster, and configures the routing, NAT, and firewall rules for them1.

To expand storage capacity in a vSAN cluster with one disk group, you can either add more drives to hosts in the cluster, which is commonly referred to as scaling up, or add capacity drives to existing disk groups 

Option B: Add an additional disk group - According to search result [1], adding additional drives to a host will increase both capacity and performance [1], and each disk group contains one flash cache device and one or multiple capacity devices for persistent storage [2]. Therefore, adding an additional disk group to each host would increase the storage capacity of the vSAN cluster.

Option D: Increase the number of capacity disks in the existing disk group - Search result [1] explains that vSAN clusters require capacity and cache devices to function, and each disk group can contain multiple capacity devices for persistent storage [2]. Thus, an additional way to expand storage capacity in the vSAN cluster would be to increase the number of capacity disks in the existing disk group.

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/vcf-admin/GUID-2674DA5A-8DF7-4212-A4A9-88CD798DC303.html

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/vcf-admin/GUID-1B9AAE1E-7C55-4A7A-A921-9F84F248AF68.html

According to Networking Requirements for vSAN1, the maximum network latency between the two main sites for stretched clusters is 5 ms RTT (round-trip time). This means that the latency between any two nodes in different availability zones should not exceed 5 ms.

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/vcf-design/GUID-11177D00-C8BE-4CEC-B997-659CC03B6D12.html

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/vcf-admin/GUID-45A77DE0-A38D-4655-85E2-BB8969C6993F.html

According to the VMware Cloud Foundation documentation1, the host you are adding must have the same type of principal storage as the existing hosts in the vSphere cluster. For VI workload domains, the host can use vSAN, NFS, VMFS on FC, or vVols for principal storage. A host using VMFS on FC will automatically use the same VMFS on FC configuration as the other hosts in the vSphere cluster.

Hosts with vSAN storage can be added to vSAN-based VI Workload domains, but not to VMFS on FC-based VI Workload domains. Hosts with vVols storage can be added to vVols-based VI Workload domains, but not to NFS-based VI Workload domains. Hosts with NFS storage can be added to NFS-based VI Workload domains, but not to VMFS on FC-based VI Workload domains.

References: 1: Add a Host to a vSphere Cluster Using the SDDC Manager UI - VMware Docs

A. Generate Certificate Signing Requests from SDDC Manager - In order to replace the self-signed certificates with third-party signed certificates, the Certificate Signing Requests (CSRs) need to be generated. This can be done from the SDDC Manager UI.

C. Create and package the certificates in a domain_name.tar.gz file - After the CSRs are generated, they can be used to obtain third-party signed certificates from a certificate authority. Once the certificates are obtained, they need to be packaged in a domain_name.tar.gz file and uploaded to SDDC Manager.

• Generate Certificate Signing Requests (CSRs) from SDDC Manager for each component that requires a certificate1. You can do this from the SDDC Manager UI or using an API call1.
• Have the CSRs signed by a third-party Certificate Authority of your choice1. You can use any external provider that meets your security policy requirements.
• Create and package the certificates in a domain_name.tar.gz file according to the naming convention and folder structure specified by SDDC Manager1. You can use any compression tool that supports gzip format.
• Upload and install the certificates using SDDC Manager UI or API1. You can also verify and troubleshoot the certificate installation using SDDC Manager.

https://docs.vmware.com/en/VMware-Cloud-Foundation/4.5/vcf-admin/GUID-80431626-B9CD-4F21-B681-A8F5024D2375.html

The NSX Manager is a standalone appliance that hosts the API services, the management plane, control plane, and policy management. As a result of this combined format, you no longer need to install the manager and controllers as separate VMs. The NSX Manager has three built-in roles: policy, manager, and controller 1.

B. Policy: NSX Manager is responsible for the creation and management of NSX-T policies, which are used to define networking and security configurations and rules.

C. Controller: NSX Manager also serves as a central management point for NSX-T controllers, which are responsible for implementing and enforcing networking and security policies across the NSX-T environment.

References:

• VMware Cloud Foundation Specialist (v2) Exam Guide, section 2.2
• NSX-T Data Center Administration Guide, section "NSX Manager and NSX-T Controllers"

https://shuttletitan.com/nsx-t/nsx-t-management-cluster-benefits-roles-ccp-sharding-and-failure-handling/

The vSphere Lifecycle Manager (LCM) function that is supported in VMware Cloud Foundation (VCF) is D. Install and update third-party software on ESXi hosts. According to the VMware Cloud Foundation documentation1, vSphere Lifecycle Manager images can include components that are created and published by third-party software vendors, such as drivers, patches, and solutions. These components can be added to the image to install and update the third-party software on the ESXi hosts in a cluster. VMware Cloud Foundation allows you to manage all images in a single place and re-use them for clusters across workload domains2

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/vcf-admin/GUID-A56D8E59-A549-4624-BC61-4A92710F9FA1.html

According to VMware Cloud Foundation Planning and Preparation Workbook, a statement that is true regarding NSX Manager configuration in a VMware Cloud Foundation environment is:

• The cluster virtual IP address (VIP) address must be used for API and GUI access to NSX Managers

https://docs.vmware.com/en/VMware-Cloud-Foundation/4.5/vcf-management-domain-design/GUID-B0C6B2C7-E778-4CD1-BBAD-986A8AF5B930.html

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/vcf-admin/GUID-80431626-B9CD-4F21-B681-A8F5024D2375.html

According to NSX Manager VM and Host Transport Node System Requirements23, an NSX-T management cluster formed using a medium-sized appliance can support up to 128 hypervisors. Since each VI Workload Domain has 36 hosts (18 x 2), and there are three VI Workload Domains, the total number of hosts is 108 (36 x 3), which is within the limit of a medium-sized NSX-T Manager cluster.

According to the VMware Cloud Foundation documentation on network requirements, vSAN requires only the vMotion and NFS networks to be configured in the network pool. This is because vSAN traffic can be carried over the vMotion network, and the NFS network is needed to support the use of NFS datastores [1].

NFS is a file-based storage protocol that can be accessed over IP networks. It does not require any special hardware or software, and can be accessed by any device that supports the NFS protocol [2]. As such, it only requires the NFS network to be configured in the network pool.

Therefore, the correct answers are B. NFS and E. vSAN.

This is because according to VMware documentation2, these are some of the components that are configured as part of the Supervisor Cluster control plane after enabling Workload Management on a VMware Cloud Foundation Workload Domain:

• Tanzu Kubernetes Grid Service: This service enables you to create and manage Tanzu Kubernetes clusters on vSphere with Tanzu.
• Kubernetes Grid Orchestrator: This component manages the lifecycle of Tanzu Kubernetes clusters on vSphere with Tanzu.
• Spherelet: This component runs on each ESXi host and acts as a kubelet agent that communicates with the Supervisor Cluster control plane.