Free Practice Questions for the VMware VCP-VCF Administrator 2V0-17.25 Exam (2026 Updated)

The Network Operations feature within VMware Cloud Foundation is powered by VCF Operations for Networks (formerly Aria Operations for Networks).

The VCF 9.0 documentation explains:

“VCF Operations for Networks provides application dependency mapping, network flow visibility, micro-segmentation validation, and network troubleshooting capabilities.”

Without this component, advanced network analytics and topology visualization are not available.

vDefend firewall (B) provides security enforcement but does not deliver analytics and visibility features.

NSX networking (C) provides networking services but does not itself deliver network operations insights and analytics.

VCF Operations collector (D) collects data but does not provide the network operations feature set.

Thus, to enable full Network Operations capability, the administrator must install and configure VCF Operations for Networks.

According to the VCF 9.0 Operations and Monitoring Guide:

Fleet Management: “VCF Operations Fleet Management enables cross-instance monitoring, unifying health and metrics across multiple VCF instances.”

Operations for Networks: “Provides application and network visibility, dependency mapping, and traffic analytics. Required to complete full-stack monitoring.”

Core VCF Operations is already deployed as part of the management stack and does not need to be added separately. Operations for Logs is optional for log aggregation, not mandatory for full-stack observability. The Management Pack Builder (C) is an add-on tool for custom packs, not a required component. Therefore, the correct two to add for full-stack monitoring are VCF Operations Fleet Management (A) and VCF Operations for Networks (E).

In VMware Cloud Foundation (VCF) 9.0, the VCF Service Broker is the component responsible for providing a self-service catalog of available services, blueprints, and content to end users in the VM Apps tenant. The documentation explains:

“Service Broker acts as the catalog service for VM-based and cloud-native applications, allowing organizations to expose curated content to end users while applying policies, constraints, and governance.”

VCF Operations Orchestrator (A) provides workflow automation but does not expose services directly in a self-service catalog.

VCF Assembler (B) is used for designing blueprints and application templates but not for publishing them to end users.

VCF Config (D) is responsible for infrastructure configuration management and desired state compliance, not catalog services.

Thus, the correct component for the catalog is the VCF Service Broker.

The VMware Cloud Foundation 9.0 networking design documentation specifies that container workloads running on VMware Kubernetes Service (VKS) with NSX networking require external connectivity via a Centralized Connectivity model. This is implemented using an NSX Tier-0 (T0) Gateway which provides north-south routing to the corporate physical network.

The guide states: “In VKS deployments backed by NSX networking, workloads achieve external reachability through a centralized Tier-0 Gateway, ensuring integration with corporate networking and enterprise services.” This model ensures traffic consolidation, policy enforcement, and simplified routing for Kubernetes workloads.

Round-robin Connectivity is not a supported NSX gateway connectivity model.

Distributed Connectivity refers to east-west NSX overlay communication, not north-south connectivity.

Physical Connectivity is not precise, as workloads do not connect directly to the physical network; instead, they use logical routing.

Centralized Connectivity is the correct model, where the T0 Gateway centralizes external routing for container workloads.

In VMware Cloud Foundation 9.0, pricing policies are configured within VCF Operations (Costing and Chargeback).

From the VCF 9.0 documentation under Cost and Chargeback Configuration:

“Base Settings define the default cost drivers for CPU, memory, and storage that apply across clusters unless overridden by a custom policy.”

To meet the requirement:

CPU, memory, and storage pricing must be identical across all clusters.

A new policy named Resources must be created and applied globally.

Thus:

1️⃣ Create a new policy under Base Settings for resource cost (Option A)

This satisfies:

Same CPU, memory, and storage cost across clusters.

From the documentation regarding policy hierarchy:

“When a custom cost policy is set as default, it applies to all objects that do not have a more specific policy assigned.”

2️⃣ Set “Resources” as the default policy (Option E)

This ensures:

All clusters inherit this pricing model.

Other unspecified settings fall back to default behavior.

From documentation regarding overrides:

“Specific object types such as clusters can have additional cost components defined through child policies that override parent policy settings.”

3️⃣ Create a child policy under “Resources” for SAP HANA cluster VM setup charges (Option F)

This satisfies:

VM setup charges applied only to SAP HANA cluster.

Other clusters remain unaffected.

All other settings remain default.

Why Other Options Are Incorrect

B – Setting Default Policy as default contradicts requirement to create a new named policy “Resources.”

C – VM setup charges should not be in Base Settings (would apply globally).

D – Incorrect hierarchy; policies are structured under custom policy trees, not under “Default Policy” in this context.

Document References (VCF 9.0):

VMware Cloud Foundation 9.0 → VCF Operations → Costing and Chargeback

VMware Cloud Foundation 9.0 → Policy Inheritance and Overrides

VMware Cloud Foundation 9.0 → Base Settings and Custom Cost Policies

The VMware Cloud Foundation 9.0 Operations deployment documentation describes multiple deployment models for VCF Operations, including Simple, High Availability, and Continuous Availability models.

The Simple deployment model is explicitly defined as a single-node deployment intended for environments that require minimal resource consumption. The documentation states:

“The Simple deployment model deploys a single VCF Operations node and is suitable for smaller environments or environments where high availability is not required.”

In contrast:

High Availability deploys three nodes for redundancy.

Continuous Availability is designed for zero-downtime upgrades and requires even more resources.

Stretched Cluster is not a VCF Operations deployment model but a vSAN cluster configuration.

Since the requirement is the smallest possible resource footprint, the correct model is Simple.

VCF 9.0 replaces legacy bring-up tooling with the VCF Installer, which provides a deployment wizard that validates configuration before bring-up. The guide describes: “The deployment wizard validates your inputs… and displays errors and warnings if any.” and that administrators “Download and complete the planning and preparation workbook and have the information ready for validating inputs in the deployment wizard.”

While the workbook is used to collect information, the validation of those inputs is performed by the VCF Installer wizard prior to deployment. SDDC Manager is used after bring-up for lifecycle operations, and Cloud Builder is not used in VCF 9.0 deployments. Therefore, VCF Installer is the correct tool for collecting (via wizard prompts) and validating initial deployment inputs.

===========

The VCF Automation Costing and Pricing Guide explains:

“Define core costs for CPU, memory, and storage under Base Settings to apply fleet-wide.” (A)

“Mark the created policy as the default to ensure it applies globally.” (B)

For SAP HANA, “Create an exception policy under Base Settings with VM setup charges assigned to the SAP HANA cluster.” (E)Default Policy (C, F) is system-reserved. Sub-policies under “Resources” (D) are not valid. Correct configuration steps: A, B, E.

According to the VCF 9.0 Container Registry Documentation, Harbor is defined as:

“Harbor is an open source registry that secures artifacts with policies and role-based access control, ensures images are scanned and free from vulnerabilities, and signs images as trusted.”

This description aligns exactly with option A. Harbor is not Bitnami (B), though it integrates with open-source images. It includes vulnerability scanning but is not only an image scanner (C). It does not require GitHub as a source (D); Harbor can integrate with multiple registries.

Therefore, Harbor’s primary role within VCF is to act as a secure image registry with RBAC, scanning, and signing capabilities.

A VM Class predefines hardware for Supervisor-managed VMs: “The VM class… defines such parameters as the number of virtual CPUs, memory capacity, and reservation settings.”

Administration steps show these are configurable: “You can configure hardware resources such as CPU, memory, and different devices” when editing a VM class.

Additionally, the DCLI/API specification underscores CPU and Memory fields: “--cpu-count … Required.” and “--memory-mb … Required.” for a VM class.

While network adapters, PCI devices, and instance storage can also be added via advanced config, the question asks for two; CPU and Memory are canonical, always-present VM Class resources per the core definition above.

===========

VCF Automation event subscriptions support Boolean conditions that determine whether the associated workflow runs. VCF 9.0 states that filters can be applied to subscriptions so that “the event and workflow only triggers if the Boolean expression is ‘true’.” Conditions can access event payload values through event.data, and the != operator is explicitly supported.

Because the stated requirement is specifically to create DNS records only when domainName has been provided, the subscription must test the corresponding custom property:

event.data.customProperties[ ' domainName ' ] != null

Option C checks hostname, which does not satisfy the stated condition. Option B addresses execution ordering: blocking subscriptions prevent another matching subscription from receiving the event until the current runnable item finishes. Option A is relevant to cleanup if the primary workflow fails because VCF supports recovery runnable items for blocking subscriptions, but it does not determine whether the DNS workflow should run based on the presence of the domain name.

To integrate VCF Automation with an external CMDB (such as ServiceNow) for compliance and tracking of Kubernetes or VM resources, the system utilizes a specific extensibility framework. According to the VCF 9.0 documentation on " Integrating VCF Automation for ITSM with ServiceNow " :

Event Subscriptions (D): These act as the trigger mechanism within the VCF Automation Event Broker Service. When a resource (such as a Kubernetes cluster or deployment) is provisioned, an event is published. An administrator creates a subscription to listen for these specific lifecycle events (e.g., Compute.PostProvision or Kubernetes-specific topics) to initiate the registration process.

VCF Operations orchestrator (B): This is the orchestration engine (formerly known as VMware Aria Automation Orchestrator or vRO). Documentation specifies that for CMDB and ITSM compliance, VCF Automation is integrated with VCF Operations orchestrator workflows. These workflows contain the complex technical logic required to:

Separate objects and feed inputs into technical integration tasks.

Handle API tokens and authentication for the external CMDB.

Execute the REST API calls to the CMDB (e.g., to the cmdb_ci_vmware_instance table).

Update custom properties (like serviceNowSysId) back into the deployment for future decommissioning lifecycle events.

Extract from VCF 9.0 Documentation:

" Enterprise users commonly integrate their Cloud Management Platform with an IT Service Management (ITSM) and Configuration Management Database (CMDB) platform for compliance. Following this example, you can integrate VCF Automation with ServiceNow for CMDB and ITSM using VCF Operations Orchestrator Client... This integration uses Event Subscriptions to trigger VCF Operations Orchestrator workflows. "

According to VMware Cloud Foundation 9.0 documentation for VCF Automation (Aria Automation integration):

To deploy workloads to specific NSX segments with VLAN-based selection and IPAM integration, the administrator must:

1️⃣ Configure Network IPAM Settings (Option C)

VCF Automation requires network segments to be associated with IPAM configuration:

“To enable automatic IP allocation for workloads, configure network profiles with gateway, subnet, and IP range details for the associated networks.”

This ensures automatic IP address allocation from the internal IPAM.

2️⃣ Create a Network Profile and Associate Segments (Option D)

VCF Automation uses Network Profiles to group NSX segments and associate them with projects:

“A network profile defines the networks available to a project and includes capability tags that are matched during workload deployment.”

Including all appdev segments in a dedicated network profile ensures logical isolation from other projects.

3️⃣ Use Capability Tags for VLAN Selection (Option F)

VCF Automation uses capability tags to match user input to infrastructure:

“Capability tags applied to networks can be matched in cloud templates to dynamically select networks based on user-defined inputs.”

By applying vlan: < number > tags to each segment, a self-service user can specify a VLAN number that determines which segment is selected during deployment.

Why Other Options Are Incorrect

A – Custom groups are not required for network selection.

B – Tagging segments alone is insufficient without associating them through a network profile.

E – Adding networks to the existing development project violates logical isolation requirements.

Document reference (VCF 9.0):

VMware Cloud Foundation 9.0 → VCF Automation → Projects and Network Profiles

VMware Cloud Foundation 9.0 → Network Profiles and IPAM Configuration

VMware Cloud Foundation 9.0 → Capability Tags and Network Selection

VCF Automation 9.0 defines Organizations for All Applications as the primary multi-tenancy model for environments that need both traditional VM workloads and modern Kubernetes-based workloads. The documentation states that an All Apps organization can run “a wide variety of applications, including virtual machines (VMs), Kubernetes, data services, and so on.”

The same documentation specifies that these organizations are created from the VCF Automation Provider Management Portal and use underlying vSphere Supervisor infrastructure. This directly satisfies the requirements for VKS and VM deployment.

By contrast, a VM Apps organization is primarily intended for customers continuing legacy Aria Automation-style VM application provisioning. The documentation states that it is most suitable for customers who want to continue “VM-based applications” without disrupting existing operations. It is not the correct choice when Kubernetes and modern integrations are required.

The VCF 9.0 Operations Guide – Metrics and Super Metrics explains that super metrics are used when administrators need to aggregate or compute new values from existing metrics. Super metrics can be applied across multiple objects, such as aggregating the health score of all VMs in a fleet.

The documentation states:

“A super metric is a user-defined formula that calculates a value derived from one or more existing metrics. Super metrics can be applied across objects to provide aggregate insights such as averages or totals.”

Dashboard (A): Dashboards can display metrics but cannot compute new aggregated values on their own.

Symptom (C): Used to define conditions that trigger alerts, not to compute average health values.

Alert (D): Alerts notify administrators of issues but do not calculate averages across many VMs.

Therefore, to display the average health score of all VMs across multiple clusters, the administrator must create a super metric and then visualize it in a dashboard.

In VMware vSphere with Supervisor (used within VCF), a vSphere Namespace allows administrators to define resource quotas for Kubernetes workloads.

The vSphere documentation specifies that administrators can configure limits on:

CPU resources

Memory resources

Storage capacity

These quotas control the maximum resources that workloads deployed within the namespace can consume.

Incorrect options:

The number of containers (A) is managed at the Kubernetes level, not directly as a namespace resource quota in vSphere.

The number of services (D) is a Kubernetes object count limit, not a vSphere namespace resource limit.

Thus, the three configurable resource limitations are CPU, Memory, and Storage.

VCF provides integrated automation and orchestration for Day 0–2 operations, including networking: VCF is a “full-stack IaaS” with “automation and orchestration to simplify Day 0, Day 1, and Day 2 tasks.” VCF supports modern apps: users can provision “VMs” and “Kubernetes workloads” from self-service services, proving both VM and container support. Multi-tenancy with strong isolation is native: Organizations are “secure and isolated” boundaries; All Apps organizations run “virtual machines (VMs), Kubernetes… multiple tenants with secure infrastructure isolation.”

Incorrect choices: VCF is not limited to vSAN only (supports VMFS/NFS/CNS as documented elsewhere) and does not rely on manual scalability—automation is core. Compliance is provided within the private cloud, not only by a CSP.

The VCF 9.0 Operations Access Control Guide describes how dashboard sharing and user access is managed:

Identity Broker Authentication (D):All external users must authenticate via the VCF Identity Broker, which integrates with Active Directory, LDAP, or other identity providers. Documentation states: “Identity Broker provides single sign-on and federation, ensuring users are authenticated consistently across VCF Operations and Automation services.”

Grant Access to Dashboard (E):After authentication, the administrator must explicitly grant access to the dashboard for the specified group. This ensures that only the intended users can view or interact with the dashboard.

Set Time-Bound Access (C):VCF Operations supports time-bound access policies. The documentation specifies: “Access can be granted with an expiration period, ensuring access is automatically revoked after the configured interval (for example, 90 days).” This aligns with the 3-month requirement.

Other options are not suitable:

Reports (A) only send static data, not interactive dashboard access.

Embedded code (B, F) bypasses access control and does not provide authentication or time-limited sharing, which violates the security requirement.

Thus, the correct three steps are: Use Identity Broker (D), Grant access to dashboard (E), and Configure 3-month access expiration (C).

In VMware Cloud Foundation 9.0, the construct of VM Applications Organizations was deprecated in favor of All Applications Organizations. The documentation highlights this change:

“Organizations for All Applications provide a unified model for managing both VM and Kubernetes workloads. They support third-party integrations such as Tanzu Salt and Active Directory, and enable deployments to Native Public Cloud endpoints.”

Since the customer upgraded from VCF 5.2, their first new Organization after the upgrade must use the All Applications model. VM Applications Organizations (Option A) are legacy and do not support the full feature set such as NPC or third-party integrations. Option C is incorrect because the Fleet Management API is for monitoring and operational insights, not for creating Organizations.

Therefore, the administrator must create the new Organization as an All Applications Organization in the VCF Automation Provider Management Portal.

The VCF 9.0 Architecture Guide outlines valid principal storage options for the management domain. It states: “The management domain must be deployed using vSAN, NFS, or Fibre Channel (FC). Supported protocols include NFSv3 and VMFS on FC.” vSAN (including OSA) is the default recommended option, but NFSv3 and VMFS on FC are also supported for environments where external storage arrays are required.

NVMe/TCP and vVols are not supported for the initial management domain’s principal storage. vVols may be used in workload domains after deployment, but they are not a supported foundation for the management domain. Therefore, the three correct storage solutions for the first management workload domain are: VMFS on FC, NFSv3, and vSAN OSA.

In VMware Cloud Foundation 9.0, the introduction of the Virtual Private Cloud (VPC) model within VCF Automation (formerly Aria Automation) simplifies multi-tenancy. When an administrator creates an organization and configures regional networking, the system automates the deployment of several high-level NSX objects to provide isolated networking for that organization ' s applications.

According to the VCF 9.0 Automation and Networking Guide:

A Provider Tier-0 Gateway (C): This is the top-level logical router in the VCF environment. During the regional networking setup, the system identifies or configures the Provider T0 to act as the primary exit point for North-South traffic for the organization.

A Virtual Private Cloud (VPC) connectivity profile (F): This profile defines the networking " flavor " (such as IP blocks, DNS, and security settings) that will be applied to the organization ' s VPCs. It acts as the template for how the VPC interacts with the provider ' s physical and logical infrastructure.

A Default Virtual Private Cloud (VPC) (B): Upon completing the organization setup, VCF Automation provisions a default VPC for that organization. This VPC serves as the logical container for the tenant ' s subnets, security groups, and routing.

An outbound Source Network Address Translation (SNAT) rule (A): To allow virtual machines within the newly created VPC to access external resources (the internet or corporate network) while using private IP space, the system automatically creates an outbound SNAT rule on the gateway associated with the VPC or the Provider T0.

Why other options are incorrect:

A Virtual Distributed Switch (VDS) (D): The VDS is a foundational component of the VCF VI Workload Domain created during Day 1 operations. It is not " automatically configured " during the high-level regional networking step of a VCF Automation organization; it must already exist.

An NSX Transit Gateway (E): While NSX uses Tier-0 and Tier-1 gateways for transit, " Transit Gateway " is a specific term often associated with public cloud (AWS) integrations. In the context of VCF 9.0 regional networking for a VPC, the core constructs are the T0/T1 and VPC profiles.

An outbound Destination Network Address Translation (DNAT) rule (G): DNAT is typically used for inbound traffic (mapping a public IP to a private internal IP). Outbound traffic uses SNAT to mask the internal IP as it leaves the organization.

Deleting an Organization in VCF Automation requires using the Provider Management Portal, not Fleet Management. Before deletion, dependent resources must be removed.

According to the VCF 9.0 Automation documentation:

Administrators must log into the VCF Automation Provider Management Portal (G).

The Organization must first be disabled (C) to prevent active usage.

All associated region quotas must be deleted (D), since Organizations cannot be removed while resource allocations exist.

Finally, the administrator can delete the Organization (A).

Deleting SSL certificates (B) and the embedded Orchestrator (F) are not required for Organization removal. Fleet Management (E) is unrelated to Organization lifecycle operations.

In VMware Cloud Foundation 9.0, network security and segment integrity are maintained through Segment Security Profiles. These profiles are applied to NSX segments to define what type of traffic is permitted to originate from or be received by the virtual machines attached to that segment.

According to the VCF 9.0 (NSX) Networking and Security Guide:

The Default Segment Security Profile is designed with a " Zero Trust " approach for foundational services. One of its key default settings is DHCP Server Block, which is set to Yes. This is a security measure to prevent " rogue " DHCP servers from being accidentally or maliciously connected to a segment and disrupting the network by handing out unauthorized IP addresses.

When an administrator intentionally places a legitimate DHCP server on a segment:

Segment Security Profile: The " DHCP Server Block " feature resides specifically within the Segment Security Profile, not the IP Discovery profile (which handles how NSX learns IP addresses via ARP/DHCP snooping).

Cloning vs. Editing: In VCF 9.0, the " Default " profiles are system-defined. While some default settings can be edited in certain versions, the architectural best practice and documented procedure for production environments is to Clone the default profile. This creates a custom profile where the DHCP Server Block can be set to No, allowing the DHCP server ' s " Offer " and " ACK " packets to pass through the segment.

Application: Once the cloned profile is modified, it must be manually applied to the specific segment where the virtual desktops and the DHCP server reside.

Comprehensive and Detailed Explanation:

The Istio integration in VCF 9.0 defines two main logical groupings for organizing workloads within a service mesh: Cluster groups and Service groups. The documentation notes: “Cluster groups allow you to organize and manage objects across different Kubernetes clusters. Service groups let you aggregate and manage services that share common policies, routing rules, or observability requirements.” .

These groups enable administrators to apply consistent service mesh policies across multiple deployments and clusters. They also simplify administration by centralizing traffic management, routing, and observability of workloads. Security, API, and Node are not Istio-specific grouping constructs but instead are other concepts used elsewhere (e.g., security policies, API endpoints, node objects in Kubernetes). Therefore, the correct group types used in Istio Service Mesh are Cluster and Service groups.

The VCF Operations Dashboards Guide describes the Storage Overview dashboard:

“The Storage Overview dashboard provides visibility into capacity, performance, and health across vSAN and non-vSAN datastores. Administrators can track datastore utilization, latency, throughput, and availability from a single pane of glass.”

Diagnostic Findings (B) shows troubleshooting insights, not full storage details. Data Protection & Recovery (C) covers backup/replication information. VCF Health (D) focuses on SDDC Manager, vCenter, NSX, and host health, not datastore metrics.

Therefore, the required datastore overview is accessed through the Storage Overview dashboard in VCF Operations.

The VCF Health feature “provides a central location for monitoring the health of your environment,” including the ability to track “vCenter Server instances,” “ESXi hosts,” and “NSX deployments.” Health monitoring includes connectivity, configuration, and critical services status, surfacing alerts for remediation. The documentation’s scope statements make clear that VCF Health targets the infrastructure components—vCenter, ESXi, and NSX—rather than the VCF Operations applications themselves (for example, Fleet Management or Logs). Therefore, the correct monitored components are ESX hosts, vCenter Server, and NSX.

In VMware Cloud Foundation 9.0, configuration drift detection is handled through VCF Operations Configuration Management integrated with vSphere Configuration Profiles.

According to the VCF 9.0 documentation:

vCenter Version Requirement (D):Configuration drift monitoring requires vCenter 8.0 Update 3 or later, as this introduces the enhanced configuration profile capabilities necessary for drift comparison.

Create a Configuration Template (E):VCF Operations requires a defined baseline configuration template to compare cluster states against.

Assign the Template to a Policy (F):Policies enforce and monitor configuration compliance. Assigning the template to a policy allows drift detection against the desired state.

Incorrect options:

vCenter 9.0 (A) is not required; 8.0 U3 is sufficient.

A collector (B) is not specifically required for drift detection.

Scheduling drift detection (C) is part of policy evaluation, not a standalone mandatory step.

Configuring vSphere Configuration Profiles (G) is beneficial but not mandatory for drift monitoring via VCF Operations.

Thus, the three required steps are: vCenter 8.0 U3 or later, create a configuration template, and assign it to a policy.

In VMware Cloud Foundation 9.0, certificate replacement procedures for components such as:

vCenter Server

NSX Manager

SDDC Manager

Aria Suite components

require certificates to be provided in PEM format.

From the VCF 9.0 documentation under Certificate Management:

“When replacing certificates with CA-signed certificates, provide the certificate and private key in PEM format.”

Additionally:

“The certificate file must include the full chain (server certificate and intermediate certificates) in PEM encoding.”

Why PEM?

PEM format:

Base64 encoded

Human-readable

Common format for VMware components

Required for SDDC Manager certificate import workflows

Why the Other Options Are Incorrect

A. PFX (PKCS#12)Contains private key and certificate bundled together; not the required format for VCF certificate replacement workflows.

B. DERBinary format; VMware Cloud Foundation certificate workflows require Base64 PEM format.

D. P7B (PKCS#7)Does not contain private key; unsuitable for certificate replacement.

Document References (VCF 9.0)

VMware Cloud Foundation 9.0 → Security and Certificate Management

VMware Cloud Foundation 9.0 → Replace Certificates with CA-Signed Certificates

VMware Cloud Foundation 9.0 → Certificate Requirements and Formats

According to the VCF 9.0 Operations and vSAN Integration Guide, performance metrics in the vSAN Cluster Performance widget are only available when the vSAN Performance Service is enabled. The documentation states:

“The vSAN Performance Service must be enabled in vCenter Server for each vSAN cluster to collect and visualize performance statistics in VCF Operations. Without this service, performance dashboards and widgets will not display data.”

Option A (Support Insight) relates to telemetry with VMware, not performance widgets.

Option B (Cloud proxy as Collector) is required for general collection but not specific to vSAN widget visibility.

Option C (SMART data collection) provides disk health analytics, not cluster-level performance stats.

Option D is correct, because enabling the vSAN Performance Service ensures that VCF Operations receives and displays data in the vSAN Performance dashboards.

Therefore, the administrator must enable the vSAN Performance Service for all vSAN clusters in vCenter.

The VCF Operations for Networks (formerly vRNI) enables Application Discovery and Network Visibility. According to VCF 9.0: “Operations for Networks provides flow-based application discovery, dependency mapping, and security planning. This allows administrators to visualize application topology and relationships across the VCF fleet.” By contrast, VCF Operations for Logs provides log aggregation, while the Collector provides integration for metrics, not discovery. The vSphere Supervisor enables Kubernetes workloads, not application discovery. Therefore, to achieve Service and Application Discovery, administrators must deploy VCF Operations for Networks.

Because this project must support a Kubernetes-based application, the applicable VCF Automation model is All Apps, where projects consume resources through vSphere Namespaces, not legacy VM Apps cloud zones. VCF 9.0 states that an Organization Administrator can create and delete projects, whereas the Project Administrator manages an existing project but does not create new projects.

The administrator therefore logs in as the Organization Administrator and creates the new project. The documentation states that when configuring a project, the administrator adds at least one namespace so users can start provisioning resources. Namespaces provide the resource envelope for workloads including VKS clusters.

To minimize ongoing membership administration, VCF explicitly recommends assigning roles using groups. The documentation explains that group-based roles allow users to “come and go from your identity provider rather than requiring the project administrator to constantly update the individual users.” Therefore, Active Directory groups should be assigned rather than individual users.