Which Container Network Interface (CNI) is selected by default in a VMware Kubernetes Service (VKS) workload cluster?
Answer(s): D
The VCF 9.0 Kubernetes Service documentation confirms that Antrea is the default CNI used for VMware Kubernetes Service (VKS) workload clusters.“When deploying a new VKS workload cluster, the Antrea Container Networking Interface is automatically enabled by default to provide pod-to-pod and pod-to-service networking. Antrea is fully integrated with NSX-T for advanced policy control.”Flannel, Calico, and Cilium are widely used CNIs in upstream Kubernetes but are not the default in VCF. Administrators can optionally integrate with third-party CNIs, but the supported default choice is Antrea.
An administrator is responsible for managing a VMware Cloud Foundation (VCF) fleet. The administrator has been tasked with creating a solution that allows Kubernetes development teams to complete the self-service creation of Active Directory (AD) accounts with the following requirements:Only users within the Development tenant should be able to create user accounts.Users must be able to create and destroy user accounts in the development AD only.The administrator has already deployed a dedicated VCF Operations Orchestrator for the Development tenant.What four additional tasks must the administrator complete to meet the stated objective? (Choose four.)
Answer(s): B,C,E,F
The VCF 9.0 Automation and Orchestration Guide explains how Orchestrator integrates with VCF Automation to provide workflow-driven services such as Active Directory management.Orchestrator Integration (B):The tenant must be connected to the dedicated Orchestrator instance rather than the embedded one. Documentation notes: “Each tenant can integrate with its own Orchestrator endpoint for workflow execution.”AD Plugin Configuration (E):The Orchestrator Active Directory plugin must be configured against the development AD only, ensuring that the development team does not impact the production directory.Publish Workflow (C):The AD user creation workflow must be published to the VCF Automation catalog using the Content Hub. Actions alone are insufficient; workflows are the full automation logic exposed to end users.Custom Resource Object (F):To enable developers to create and destroy AD accounts, a Custom Resource object must be created in VCF Automation and mapped to the Orchestrator workflows. This provides lifecycle capabilities (create/destroy) in the self-service catalog.Options A and D are incorrect because publishing only the “action” is not sufficient (workflows are required), and the plugin must not point to production AD. Option G is incorrect because the dedicated Orchestrator has already been deployed, so the embedded Orchestrator is not used.
VMware Cloud Foundation 9.0 – Automation Guide (Custom Resources, Content Hub, Orchestrator integrations, AD plugin usage).
Before creating an Organization for All Applications in VCF Automation to support Kubernetes workloads, which two prerequisites must be completed? (Choose two.)
Answer(s): A,C
Per the VCF 9.0 Automation Provider Management Guide:Supervisor Activation: “Kubernetes-based workloads require Supervisor to be enabled in the Management Domain before deploying organizations.”Region Configuration: “Organizations for All Applications must be deployed into a preconfigured Region, defined in the Provider Management Portal.”NSX Federation (D) is optional for multi-site deployments. Supervisor is not activated in workload domains (B) but centrally in the management domain. VMware Kubernetes Service (E) is enabled per tenant but not required before Organization creation. Thus, correct prerequisites are A and C.
An administrator configures a new NSX overlay segment for virtual desktops using default segment policies. Desktops must obtain IPv4 leases from a DHCP server on the same segment. What must the administrator do?
Answer(s): A
In NSX 4.x integrated with VCF 9.0, default segment security profiles block DHCP servers by default. The NSX Admin Guide states: “To allow DHCP servers on a segment, edit the applied segment security profile and set the DHCP Server Block option to NO.”Cloning profiles (B, C) is an optional best practice but not required for functionality. The DHCP server block resides in the security profile, not the IP discovery profile, making C and D incorrect. Therefore, the required step is to edit the default segment security profile, set DHCP Server Block = NO, and apply it.
An administrator must create different pricing information for clusters in a VCF fleet.Requirements:CPU, memory, storage costs same across clusters.VM setup charges only for SAP HANA cluster.All other settings remain default.Name new policy “Resources.”Which three settings must be configured? (Choose three.)
Answer(s): A,B,E
The VCF Automation Costing and Pricing Guide explains:“Define core costs for CPU, memory, and storage under Base Settings to apply fleet-wide.” (A)“Mark the created policy as the default to ensure it applies globally.” (B)For SAP HANA, “Create an exception policy under Base Settings with VM setup charges assigned to the SAP HANA cluster.” (E)Default Policy (C, F) is system-reserved. Sub-policies under “Resources” (D) are not valid. Correct configuration steps: A, B, E.
An administrator must replace a component’s certificate in VCF with an external CA-signed certificate. What format must be used when creating the certificate?
The VCF 9.0 Security and Certificates Guide states: “VCF supports only certificates in PEM format when replacing system component certificates with those signed by an external Certificate Authority.”PEM is the standard Base64 format with .crt and .key files. PFX (PKCS#12) is used for Windows stores but not supported in VCF automation. P7B is for certificate chains, while DER is binary encoding. Thus, the required format for certificates in VCF is PEM.
An administrator is responsible for a vSAN Express Storage Architecture (ESA) cluster running workloads with a RAID-6 policy. The administrator must enable auto-policy management in vSAN ESA. What is the minimum number of hosts required for workloads with RAID-6?
The vSAN ESA documentation in VCF 9.0 explains that auto-policy management dynamically selects the most efficient data placement policy based on cluster size. For RAID-6 (erasure coding with double parity), the minimum required host count is 6. The docs state:“RAID-6 (Erasure Coding with FTT=2) requires a minimum of six hosts in a vSAN ESA cluster. This ensures that data and parity components can be distributed across unique failure domains.”With fewer than six hosts, RAID-6 cannot be enforced and auto-policy management will fall back to RAID-1 mirroring. RAID-6 in vSAN ESA provides higher storage efficiency but comes with stricter host count requirements. Options 2 and 4 are far below requirements, while 8 provides more redundancy but is not the minimum. Therefore, the correct minimum number of hosts for RAID-6 with ESA is 6.
An administrator is deploying a VCF fleet with two VCF instances and wants a full-stack monitoring solution. Which two components must be installed after initial deployment? (Choose two.)
Answer(s): A,E
According to the VCF 9.0 Operations and Monitoring Guide:Fleet Management: “VCF Operations Fleet Management enables cross-instance monitoring, unifying health and metrics across multiple VCF instances.”Operations for Networks: “Provides application and network visibility, dependency mapping, and traffic analytics. Required to complete full-stack monitoring.”Core VCF Operations is already deployed as part of the management stack and does not need to be added separately. Operations for Logs is optional for log aggregation, not mandatory for full-stack observability. The Management Pack Builder (C) is an add-on tool for custom packs, not a required component. Therefore, the correct two to add for full-stack monitoring are VCF Operations Fleet Management (A) and VCF Operations for Networks (E).
Post your Comments and Discuss VMware 2V0-17.25 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the 2V0-17.25 content, but please register or login to continue.