Free Practice Questions for the VMware VCAP-VCF Architect 3V0-12.26 Exam (2026 Updated)

B is the technical requirement because it specifies a concrete, verifiable technical security condition that the deployed solution must satisfy: the environment must undergo third-party penetration testing at least annually . This can be directly incorporated into security architecture, operational validation, and design acceptance criteria.

The other statements belong to different conceptual-design categories. A is primarily a business requirement/objective because reducing administrator effort describes the organizational outcome that the VCF solution should enable, typically through automation and simplified lifecycle management.

D is a constraint because the existing procurement agreement restricts the architect ' s technology choices by mandating use of specific existing server hardware.

C establishes a regulatory/compliance context . DORA and SOX influence technical and operational requirements, but simply stating that the organization is subject to those regulations does not itself define a specific technical capability that the VCF architecture must implement.

Broadcom ' s VCF Architect exam guide explicitly requires candidates to differentiate business and technical requirements and separately identify requirements, assumptions, constraints, and risks when producing a VCF design. ( Broadcom Docs )

Study Guide References/Topics: Conceptual Design; Business vs. Technical Requirements; Requirements and Constraints; Security Requirements; Compliance; Design Validation and Acceptance Criteria.

A and D are requirements because they describe capabilities or outcomes that the completed architecture must deliver . VMware ' s architectural methodology distinguishes requirements from constraints, assumptions, and risks, and the current VCF Architect exam specifically expects architects to identify and document these categories independently. ( Broadcom Docs )

A defines an availability requirement: the architecture must provide a resilient multi-site topology . This states the desired behavior of the solution rather than prescribing a particular implementation technology.

D is also a requirement because it establishes a specific, measurable scalability target—20% growth over three years . It directly influences capacity planning and the logical and physical architecture.

B represents a risk/finding . An existing network single point of failure could adversely affect availability and should be documented and mitigated.

C is a constraint , because mandatory reuse of the existing storage array restricts the architect ' s available design choices. VMware defines constraints as limiting factors that affect or restrict a design. ( VMware )

E is an assumption or discovered condition regarding available storage capacity. It should be validated before relying on it for sizing because assumptions used in design decisions must be confirmed.

Study Guide References/Topics: Conceptual Design; Business and Technical Requirements; Requirements, Constraints, Assumptions and Risks; AMPRS; Capacity and Scalability Planning.

The design requires a scalable routed fabric, high bandwidth, redundant host connectivity, jumbo frames, and no physical multicast dependency .

A satisfies the end-to-end jumbo-frame requirement. VCF guidance requires consistent MTU configuration throughout the complete path; Broadcom specifically notes that jumbo frames increase throughput and that the physical and virtual path must support the configured MTU. Geneve encapsulation also adds overhead, making sufficient MTU headroom essential.

B is correct because NSX head-end replication replicates BUM frames in software from the originating transport node and therefore does not require multicast support in the physical underlay.

C best satisfies the high-throughput and redundancy requirements. Dual 25-GbE NICs provide substantial bandwidth for consolidated vSAN, vMotion, management, and overlay traffic while allowing redundant attachment to separate ToR switches. Broadcom specifically recommends higher-speed networking for demanding vSAN environments.

F provides the required scalable physical fabric. A Layer-3 leaf-spine/CLOS topology using BGP and ECMP delivers predictable latency, multiple equal-cost paths, horizontal rack expansion, and eliminates dependence on large Layer-2 failure domains.

D conflicts directly with the no-multicast constraint, E provides less bandwidth than the design target, and G introduces unnecessary Layer-2 extension rather than a scalable routed underlay.

Study Guide References/Topics: VCF Physical Network Design; Leaf-Spine/CLOS Architecture; BGP and ECMP; NSX Geneve Overlay; BUM Replication; Jumbo Frames; vSAN Network Design; ESX Host Uplink Redundancy.

B and E are correct because the customer has supplied VM counts and service-level objectives, but has not supplied the actual workload resource profile required to translate those VM counts into physical compute and storage capacity.

E establishes the average VM footprint—principally vCPU, RAM, and storage . Without these values, an architect cannot calculate aggregate capacity for either the initial 2,000-VM state or the projected 8,000-VM state. VMware capacity-management metrics explicitly account for allocated vCPU, memory, and VM disk consumption when evaluating cluster capacity.

B is equally important because provisioned resources are not the same as actual demand. Average utilization determines realistic CPU and memory consumption, consolidation ratios, oversubscription assumptions, and required growth headroom. Broadcom ' s guidance states that VM CPU and memory should be sized against real workload demand measured over representative periods , while VCF Operations uses utilization/demand information for capacity planning.

A may affect individual application compatibility but is not the primary aggregate sizing assumption. C is a configuration/design decision rather than a workload-sizing input. D is relevant to achieving the two-hour RPO, but the specific backup product does not establish the core compute, memory, and storage capacity required for 2,000–8,000 VMs.

The official VCF Architect exam guide explicitly includes capacity planning, scalability, and documenting assumptions as core architect competencies. ( Broadcom Docs )

Study Guide References/Topics: Capacity Planning; Workload Profiling; Assumptions and Constraints; VM Resource Sizing; Scalability; VCF Physical Design.

The scenario maps directly to Availability, Manageability, and Recoverability , three of VMware ' s core AMPRS design qualities. VMware defines availability as the ability of a system to continue operating without interruption, recoverability as its ability to recover following failure or disaster, and manageability as how easily the environment can be deployed, configured, and controlled. ( VMware )

Recoverability (D) is central because the environment can enter a corrupted state and must be restored to a known reliable condition without damaging historical data. Recovery sequencing, backups, recovery points, and dependency-aware restoration therefore become critical design considerations.

Manageability (C) is required because restoration involves a complex and sensitive dependency chain. The design should reduce operational complexity through standardized procedures, automation, orchestration, configuration control, and repeatable recovery workflows. A recovery process that depends heavily on error-prone manual sequencing represents a manageability risk.

Availability (A) is required because stakeholders want some services to remain operational while the broader environment is being restored. The architecture therefore needs mechanisms that preserve service continuity or degraded-but-functional operation during recovery.

Performance and Scalability are not stated concerns. Security remains important generally, but the audit-data issue here concerns preserving recoverable state rather than an explicit confidentiality, access-control, or threat-protection requirement.

Study Guide References/Topics: AMPRS Design Qualities; Availability; Manageability; Recoverability; Business Continuity; Dependency-Aware Recovery; Operational Resilience.

C is correct. Because CON001 explicitly prohibits Internet connectivity anywhere within the VCF solution , the VCF Installer cannot connect directly to Broadcom ' s online software depot. The appropriate architectural design is therefore to configure the VCF Installer to connect to an internal/offline depot containing the required installation binaries and metadata.

Broadcom ' s current VCF 9 guidance distinguishes the two workflows clearly: when Internet connectivity is available, VCF Installer can connect to the online depot; for an air-gapped environment , the required VCF binaries and manifests are downloaded on an external Internet-connected system and transferred to an offline repository that is then made accessible to VCF Installer.

This also aligns with DEP001 , because the customer is responsible for ensuring that the binaries are accessible to the Installer during deployment.

A and D are incorrect because the Offline Bundle Transfer Utility or VCF Download Tool would normally be used on a separate Internet-connected staging system to populate or prepare the offline depot. Running either on the VCF Installer would conflict with the Internet-access restriction and does not represent the required architectural decision. B directly violates CON001.

The offline-depot approach also supports tighter credential handling because the VCF environment itself does not need to store credentials for direct Internet depot access.

Study Guide References/Topics: VCF Installer; Online vs. Offline Depot; Air-Gapped VCF Deployment; VCF Binary Management; VCF Download Tool; Offline Bundle Transfer Utility; Installation Dependencies and Constraints.

B and E provide the required physical-network redundancy without introducing common single points of failure.

B is essential because NIC teaming should use uplinks located on different physical NIC cards . If both teamed ports reside on the same adapter, failure of that adapter, PCIe device, or associated hardware path can remove both uplinks simultaneously. Using separate physical adapters preserves connectivity when one NIC card fails. vSphere NIC teaming provides passive failover when one network adapter or network path becomes unavailable.

E is correct because each rack should contain redundant Top-of-Rack switches , with every ESX host connected to both switches. Loss or maintenance of one ToR therefore leaves the host connected through the surviving uplink and switch. Broadcom ' s operational guidance specifically validates redundant ToR designs by requiring each ESX host to have active uplinks to both ToR switches and confirming that traffic continues when either uplink is disabled.

C retains a NIC-card-level single point of failure. D creates a rack-level network failure domain. A requires cross-rack host cabling and is not the standard ToR redundancy pattern; rack resilience is achieved by distributing cluster hosts across racks while providing redundant ToRs within each rack.

Study Guide References/Topics: VCF Physical Network Design; NIC-Level Redundancy; NIC Teaming; Dual ToR Design; Rack Fault Domains; vSphere HA; Elimination of Single Points of Failure.

The determining constraint is the supported network latency between VCF Operations and the VCF instances belonging to its Fleet . Broadcom ' s VCF 9 architecture guidance specifies 100 ms round-trip latency between VCF Operations and VCF instances, together with a 10 Mbps network-bandwidth consideration.

Data center A has 90 ms RTT , which falls within that design threshold. Its new VCF instance can therefore be incorporated into the existing VCF Fleet , allowing it to consume the Fleet ' s centralized services. VCF 9 specifically supports expanding an existing Fleet by deploying additional VCF instances, with Fleet-level VCF Operations and VCF Automation shared across those instances . ( VMware Blogs )

Data center B has 120 ms RTT , exceeding the 100 ms Fleet design guideline. It should therefore receive a separate VCF Fleet , avoiding excessive latency between that VCF instance and the existing Fleet ' s management services.

This arrangement also satisfies the requirement for the minimum additional footprint : only the site that exceeds the latency boundary receives another Fleet. Creating separate Fleets at both sites would add unnecessary management infrastructure, while adding both instances to the existing Fleet would place the 120 ms site outside the recommended latency design.

Study Guide References/Topics: VCF Fleet Design; Fleet Network Connectivity; 100 ms RTT Requirement; Expanding an Existing VCF Fleet; VCF Operations and Automation Placement; Multi-Site VCF Architecture.

D and E are correct because VM Apps and All Apps organizations use different consumption and networking models within VCF Automation.

A VM Apps Organization follows the traditional VM-centric automation model. Its projects consume infrastructure through cloud accounts and use the networks exposed by the underlying vSphere and/or NSX infrastructure for virtual machine connectivity. Broadcom documentation for mixed tenancy specifically describes VM Apps organizations as being configured by mapping vCenter and NSX Manager cloud accounts , which reflects this classic infrastructure-consumption model.

An All Apps Organization , by contrast, uses the modern VCF consumption architecture built around Regions, Namespaces, Supervisor services, and Virtual Private Clouds (VPCs) . Broadcom ' s All Apps guidance explicitly states that organization administrators configure and consume networking constructs such as VPCs, transit gateways, and external IP blocks . This is why a Development project in an All Apps organization presents different network choices from a Sales project using VM Apps. ( VMware Blogs )

A is incorrect because All Apps networking is not limited to ephemeral Kubernetes ingress networks; persistent routed VPC networking is a core capability. B is incorrect because the difference is architectural, not simply whether DHCP has been enabled. C reverses the models: Supervisor- and VPC-based networking is associated with the All Apps model rather than being the defining network model for VM Apps.

Study Guide References/Topics: VCF Automation Organization Types; VM Apps Organizations; All Apps Organizations; VPC Networking; vCenter/NSX Cloud Accounts; Regions and Namespaces; VCF Automation Project Networking.

B is correct. Deploying a dedicated NSX instance for each workload domain creates an independent networking and security management boundary for each domain. VCF supports workload domains either sharing an NSX Manager cluster or using their own NSX instance; Broadcom ' s VCF API documentation explicitly states that subsequent workload domains can share the existing NSX Manager cluster or create their own . ( Broadcom Developer )

A dedicated NSX instance best satisfies all three requirements. First, it provides stronger logical and administrative isolation , because NSX objects, policies, transport configuration, gateways, and tenant-specific networking remain associated with that workload domain ' s network stack. Second, separate NSX instances provide distinct lifecycle boundaries, reducing coupling when network components must be maintained or upgraded. Third, tenant-specific customization can be performed without introducing configuration dependencies or policy conflicts in another workload domain.

D reduces infrastructure footprint but creates a shared NSX management and lifecycle dependency between the workload domains. C is designed for consistent multi-site/global networking and policy synchronization, which works against the requirement for independent tenant network stacks. A removes the NSX capabilities needed for tenant-specific software-defined networking and security.

Broadcom ' s current VCF documentation confirms that isolated workload domains may be deployed with either dedicated or shared NSX, making the dedicated model the appropriate choice when stronger tenancy isolation is required . ( VMware )

Study Guide References/Topics: VCF Workload Domain Network Design; Dedicated vs. Shared NSX Instances; Workload Domain Isolation; NSX Lifecycle Boundaries; Tenant-Specific Network Configuration.

The correct limit is up to five Private Transit Gateway (TGW) IP blocks per VPC Connectivity Profile .

In the VCF 9 Virtual Networking Technical Reference, the IPAM model defines how address pools are exposed to VPCs. A VPC Connectivity Profile can contain both External IP Blocks and Private TGW IP Blocks , with each category supporting up to five IP blocks . The guide states that Private TGW blocks are assigned through the connectivity profile and are then used to allocate address space for Private-TGW subnets. ( Higher Logic Download )

Private-TGW addressing is scoped to the Transit Gateway and is particularly useful when multiple VPCs within the same NSX Project need routed communication with each other while keeping that address space private from external networks. The block is shared at the project/TGW level, and individual VPC subnets consume CIDRs from the available Private TGW blocks.

Therefore, an architect must account for the five-block maximum when planning IP address hierarchy, future subnet growth, aggregation strategy, and multi-tenant VPC expansion. If more address space is anticipated, the architect should choose sufficiently large, non-overlapping blocks from the outset rather than assuming an unlimited number of blocks can later be attached.

Study Guide References/Topics: VCF VPC IPAM; VPC Connectivity Profiles; Private Transit Gateway IP Blocks; Transit Gateway Networking; NSX VPC Address Management; IP Block Scalability.

A homogeneous cluster (A) is the appropriate VCF design because equivalent host configurations across both availability zones provide predictable compute, memory, and storage capacity during normal operation and site failure. Broadcom specifically recommends uniform host configurations because they provide predictable performance and minimize the impact of rebuild and resynchronization operations.

C reflects the stretched-cluster requirement to maintain substantial compute failover capacity. A two-availability-zone design must be capable of running the affected workloads on the surviving site. VCF stretched designs therefore reserve approximately 50% CPU and memory capacity for availability-zone failure. Of the supplied choices, maintaining peak compute utilization below 45% is the correct design choice. With an absolute corporate ceiling of 85%, a conservative implementation would actually target approximately 42.5% or lower where workload demand can effectively double after site loss; however, C is the intended and only valid failover-oriented option provided.

F is correct because vSAN requires operational slack capacity for rebalancing, rebuilds, policy changes, and failures. Broadcom recommends approximately 25–30% free capacity , making 70% maximum utilization an appropriate design target.

B introduces unpredictable capacity symmetry. D leaves insufficient vSAN operational reserve, while E cannot provide adequate compute headroom following loss of an availability zone.

Study Guide References/Topics: VCF Stretched Cluster Design; Management Domain Capacity Planning; Availability Zone Failure; Homogeneous Host Configuration; vSAN Reserved/Slack Capacity; vSphere HA Capacity Planning.

D is correct. A dedicated Supervisor Cluster for each tenant establishes the strongest infrastructure and Kubernetes control-plane isolation. Each Supervisor has its own Kubernetes control plane and underlying vSphere infrastructure boundary, avoiding the shared control-plane dependency that would exist if multiple tenants used namespaces on the same Supervisor.

This design also addresses the requirement for independent failure domains . A Supervisor deployed on separate workload-domain infrastructure can be associated with distinct vSphere clusters, networking, storage, and lifecycle boundaries. Consequently, failure or maintenance affecting one tenant ' s Supervisor does not inherently affect another tenant ' s Kubernetes control plane.

The independent-upgrade requirement is also significant. Broadcom documents Supervisor and VKS lifecycle operations at the Supervisor level , including compatibility validation between the Supervisor, VKS service, and workload-cluster Kubernetes releases. VKS service upgrades are activated on the relevant Supervisor, reinforcing the Supervisor as an important lifecycle boundary.

A and B are useful security controls but do not isolate Kubernetes control planes or infrastructure failure domains. C provides namespace-level tenancy, but all namespaces still depend on the same Supervisor control plane and its lifecycle , so it cannot satisfy the stated isolation and independent-upgrade requirements.

Study Guide References/Topics: VCF VKS Architecture; Supervisor Clusters; Workload Domains; Tenant Isolation; Kubernetes Control-Plane Isolation; Failure Domains; Supervisor and VKS Lifecycle Management.

A and C match the VCF Edge pattern of centralized management with dedicated remote workload domains .

A is correct because the VCF management infrastructure can reside centrally at DC1 , providing lifecycle management and centralized operations for remote edge locations. Broadcom ' s documented VCF Edge architecture describes a central data center containing the management workload domain, with remote edge workload domains managed centrally through the VCF management plane. This avoids deploying a complete VCF instance at every branch and substantially reduces footprint and operational complexity. The stated minimum 10 Mbps bandwidth and maximum 100 ms latency also correspond directly to the documented connectivity requirements for centrally managed remote VCF edge sites. ( VMware Blogs )

C is correct because each branch must operate independently and have compute resources dedicated to that location. A dedicated workload domain for each branch creates an appropriate infrastructure and lifecycle boundary while retaining centralized VCF management. Broadcom explicitly identifies the pattern of deploying a dedicated workload domain for each edge site. ( VMware Blogs )

B and E would cause workload domains to span geographically separate branches, conflicting with the requirement for branch-specific dedicated resources and introducing WAN dependencies. D unnecessarily deploys a full VCF instance at every location, increasing resource consumption and management overhead.

Study Guide References/Topics: VCF Edge Design Patterns; Remote Workload Domains; Centralized Management; Edge Site Connectivity Requirements; Workload Domain Isolation; Remote Cluster Architecture; NFS Storage for Edge Sites.

A Super Metric is the appropriate VCF Operations mechanism when an architect needs to derive a new metric by mathematically combining existing metrics. Broadcom documents Super Metrics as custom metrics created from formulas referencing one or more collected metrics. For this requirement, the architect can define a VM-level Super Metric representing:

Utilization = (CPU Usage % + Network Usage %) / 2

VCF Operations can then evaluate that resulting Super Metric against a threshold through an Alert Definition . Alert definitions are specifically used to identify conditions on monitored objects and generate alerts when the configured symptoms or metric conditions become true. Broadcom ' s current VCF Operations API separately exposes creation and management functions for both Super Metrics and Alert Definitions , reflecting these distinct functions. ( Broadcom Developer )

Therefore, C is correct : create the calculated utilization value as a Super Metric and use it as the condition for an Alert Definition.

A is incorrect because a Notification Definition controls how an existing alert is delivered; it does not perform the monitoring logic itself. B has the same notification-versus-alert problem. D is not the appropriate mechanism for this custom cross-metric formula; Super Metrics are specifically designed to create formula-based derived metrics. Broadcom documentation also demonstrates Super Metrics being created through formulas referencing existing metric keys.

Study Guide References/Topics: VCF Operations; Super Metrics; Custom Metric Formulas; Alert Definitions; Symptom Definitions; Notifications and Outbound Alerting.