Free Practice Questions for the VMware VCAP-Storage 3V0-23.25 Exam (2026 Updated)

vSAN datastores are not managed through datastore clusters and Storage DRS in the same way as traditional VMFS or NFS datastore collections. A vSAN cluster exposes a distributed vSAN datastore, and VM placement, resilience, space efficiency, and compliance are controlled through vSAN Storage Policy Based Management rather than Storage DRS. The scenario also includes mixed vSAN OSA and vSAN ESA storage across clusters, which introduces an additional compatibility concern. vSAN OSA and vSAN ESA datastores are different architectures and are not combined into a single datastore-cluster construct for uniform Storage DRS placement. A datastore cluster should not combine different storage architectures such as vSAN, Fibre Channel, and NFS because Storage DRS assumes similar, interchangeable datastore resources. Creating a datastore cluster through APIs does not make vSAN datastores supported in this model. Therefore, the administrator should consider that vSAN datastores are not supported in datastore clusters and should use vSAN storage policies and appropriate datastore selection instead. Reference topics: vSAN Datastores, Storage Policy Based Management, Datastore Cluster Requirements, vSAN OSA and ESA Compatibility.

The design requires four hardware corrections. First, RAID-6 with FTT=2 requires six fault domains or hosts because RAID-6 erasure coding must place data and parity components across enough independent hosts to tolerate two failures. Therefore, four hosts are insufficient and the host count must increase to at least six. Second, Storage Traffic Separation requires sufficient physical NICs to support separate storage and non-storage traffic paths. With two distributed switches and redundant uplinks, the design must increase to four 25 GbE NICs per host. Third, vSAN ESA requires at least 128 GB of host memory; the provided 96 GB is below the minimum. Fourth, NVMe devices attached to a SATA/SAS/NVMe Tri-mode controller are not supported for vSAN storage pools. The documentation states that vSAN supports SAS and SATA devices on Tri-mode controllers, but NVMe devices must be directly connected to PCIe or use a supported NVMe design. The CPU count does not need to increase because 24 cores satisfies the stated vSAN ESA minimum in the referenced design guidance. Reference topics: vSAN ESA Hardware Requirements, RAID-6 FTT=2, Storage Traffic Separation, NVMe Controller Support.

Assigning different vSAN Storage Policies to each file share during creation satisfies the requirement because vSAN File Service allows each file share to be created with its own storage policy. The Create File Share workflow includes a Storage Policy selection, which controls how the file share’s underlying vSAN objects are protected and placed. This is the correct mechanism when each department requires distinct protection levels or placement rules. IP pools and file server bindings provide network endpoint capacity and service placement, but they do not define the protection level of file share data. Creating separate File Service clusters per department is unnecessary and operationally inefficient because file shares can be differentiated by policy within the same File Service deployment. vSphere Compute Policies influence compute placement, not vSAN object protection or file-share resilience. Therefore, the department-specific requirement is fulfilled directly by assigning the appropriate vSAN Storage Policy to each file share at creation time. Reference topics: vSAN File Service, Create File Share, Storage Policy, Placement and Protection Rules.

The workload domain should use Fibre Channel as principal storage because the existing five hosts already have resilient HBAs and are connected to a dedicated, highly resilient storage area network. The third-party block storage is also stated to have sufficient scale, capacity, and IOPS for the new workload requirements only, so it should be reused where it directly fits: the VI workload domain. VMware Cloud Foundation supports Fibre Channel as both principal and supplemental storage for VI workload domains. The management domain should use VMware vSAN as principal storage because the four new servers are being purchased for the management domain, and the existing block storage is not sized for management workloads. vSAN is a native VCF principal storage model for management domains and provides automated deployment, policy-based management, lifecycle integration, and integrated operations. iSCSI is not the right answer because the scenario describes Fibre Channel SAN connectivity and HBAs, not an iSCSI design. vSAN for the workload domain would also fail the reuse requirement because it would ignore the existing block storage investment. Reference topics: Principal Storage, Fibre Channel Storage Model, vSAN Storage Model, Management Domain Storage.

The correct process is to present the Fibre Channel LUNs from the storage array, rescan HBAs on each ESX host, create the VMFS datastore once, verify that the datastore is visible on all hosts, and confirm the result in vCenter. Fibre Channel storage requires correct SAN fabric zoning, LUN masking, host registration, and HBA discovery so that all hosts in the workload domain cluster can see the same shared LUN. After the array presents the LUN, each host must rescan its HBAs to discover the new storage device. VMFS is a clustered file system, so the datastore is created only once on the shared LUN. The datastore then becomes available to all hosts that have access to that device; it must not be independently formatted on each host. Creating the VMFS datastore separately on each host would risk datastore corruption or duplicate formatting. The final validation step is confirming datastore visibility and accessibility for all cluster hosts in vCenter. Reference topics: Fibre Channel Storage Model, HBA Rescan, Create VMFS Datastore, Shared VMFS Datastore Visibility.

NFS v3 is the best recommendation because the scenario provides only Ethernet-based host connectivity and no budget for additional hardware. Fibre Channel would require appropriate FC HBAs, SAN zoning, and array presentation to all hosts. The provided hosts only have Ethernet NICs and local boot/storage devices, so they are not prepared for FC without additional hardware. VMware Cloud Foundation supports NFS as principal storage for VI workload domains, but the supported principal NFS protocol version is NFS v3. NFS v4.1 is supported as supplemental storage, not as principal storage for this use case. The documentation also states that when NFS is used as principal storage with vSphere Lifecycle Manager images, only two hosts are required, matching this two-host scenario. Fibre Channel over Ethernet is not the appropriate supported principal storage option in this VCF storage model. Therefore, NFS v3 uses the existing network capability, avoids new hardware spend, and aligns with the supported VCF principal storage model. Reference topics: Principal Storage, NFS Storage Model, VI Workload Domain Storage, Fibre Channel Prerequisites.

Windows Server Failover Cluster shared disks require coordinated access to shared block storage. vSAN supports Windows Server Failover Clusters by providing SCSI-3 Persistent Reservation support at the virtual disk level, which allows cluster nodes to arbitrate access to a shared disk resource. One supported approach is to use the vSAN iSCSI Target Service, which presents vSAN-backed LUNs to initiators and can be used for clustered workloads that require shared block access. Another supported approach is to configure a shared virtual disk using a VMware Paravirtual SCSI controller with physical bus sharing. Physical bus sharing allows multiple VMs to access the same shared virtual disk in a WSFC configuration where supported. Raw Device Mapping is not the vSAN ESA-native solution for this requirement. NFS v4.1 is a file datastore protocol, not a WSFC shared block disk mechanism. “LSI SCSI controller per disk” does not satisfy the required shared-disk bus sharing configuration. Reference topics: vSAN Support for Windows Server Failover Clusters, SCSI-3 Persistent Reservations, vSAN iSCSI Target Service, Shared VMDK Configuration.

The correct steps are to create an NFS export on the storage array and mount the NFS datastore on each ESX host in the cluster. NFS datastore creation begins on the storage system, where the storage administrator creates and exports the NFS volume or directory with the required access permissions for the ESX hosts. After the export exists, vSphere mounts that export as a datastore. For a clustered VCF workload domain, the datastore must be mounted consistently across all ESX hosts in the cluster so that HA, DRS, vMotion, and VM placement can operate correctly. Mounting the datastore on only one host would create inconsistent datastore accessibility and could prevent workloads from moving or restarting on other hosts. “Attach NFS as a secondary datastore” is not the correct procedural step; the datastore is created and mounted as a vSphere datastore. Configuring vSAN is irrelevant because the workload domain already uses NFS storage and the task is to add another NFS datastore. Reference topics: NFS Datastore Creation, NFS Export, Host Accessibility, VCF Workload Domain Storage Administration.

A shallow rekey operation rotates only the Key Encryption Key (KEK). In vSAN Data-at-Rest Encryption, vCenter obtains or generates the KEK through the configured key provider, while ESX hosts use Data Encryption Keys (DEKs) to encrypt the actual disk or object data. The KEK is used to protect, or wrap, those DEKs. When a shallow rekey is performed, the underlying encrypted data does not need to be rewritten because the DEKs remain the same; only the KEK changes, and the existing DEKs are re-encrypted with the new KEK. This is why shallow rekey is faster and less disruptive than a deep rekey. A deep rekey generates both a new KEK and new DEKs, requiring re-encryption of data. The Host Key is used for encrypted core dumps, not datastore data encryption. Key Derivation Key is not the key rotated in this vSAN shallow rekey workflow. Reference topics: vSAN Data-at-Rest Encryption, Generate New Encryption Keys, Shallow Rekey, Deep Rekey, KEK and DEK lifecycle.

A witness host for a 2-node vSAN cluster must be external to the 2-node vSAN-enabled data cluster. The witness provides quorum and must be placed outside the protected data-node pair so that it can arbitrate availability during host or site failure. If the proposed witness host resides inside the 2-node vSAN enabled cluster, it is not eligible and therefore does not appear as an available selection during the replacement workflow. Having a VMkernel adapter configured with vSAN traffic enabled is required for witness communication, so that is not the cause of the issue. Connectivity to the data hosts is also expected and does not make the witness invalid. A witness host already assigned to another 2-node vSAN cluster is not necessarily disqualified because shared witness configurations are supported within scale and sizing limits. The core eligibility issue is that the witness host cannot be a member of the same 2-node vSAN cluster that it is intended to witness. Reference topics: 2-Node vSAN Cluster, Witness Host Placement, Replace Witness Host, Shared Witness Support.

Option B satisfies every requirement because it separates management and workload storage onto dedicated Fibre Channel-backed VMFS datastores while relying on array-based encryption at rest. This avoids VMware native encryption and vSAN-specific encryption mechanisms, matching the regulatory requirement. Fibre Channel is a supported non-vSAN storage architecture for VCF and provides enterprise block storage with multipathing, LUN masking, zoning, and consistent datastore presentation. SPBM storage policies allow storage placement and compliance to align with array and LUN characteristics, supporting automated placement and operational consistency. For scalable file-based workloads, NFS v4.1 is appropriate as supplemental file storage, and Kerberos privacy mode provides authentication, integrity, and encryption in transit for NFS traffic. Restricting cross-domain datastore access preserves strict management/workload segregation. Option A does not properly address file workload scaling or NFS encryption. Option C violates the requirement for array-based encryption by using VMware VM encryption. Option D violates segregation by sharing one NAS platform across domains and relies on application-level encryption instead of the mandated storage architecture. Reference topics: Fibre Channel Storage Model, SPBM, Array-Based Encryption, NFS v4.1 Kerberos, Workload Domain Storage Segregation.

With “Ensure Accessibility,” vSAN migrates only the minimum amount of data required to keep objects accessible while the host enters maintenance mode. This mode is faster than Full Data Migration, but it does not fully reprotect all objects. The documentation states that objects might no longer be fully compliant with their storage policy during this evacuation mode, meaning they might not have access to all replicas. Because the default policy is RAID-1 with FTT=1, each object can tolerate only one failure. While the first host is in maintenance mode, some VM objects are already running in a reduced-availability state. If a second host loses network connectivity during this window, affected objects can lose quorum or access to required components. vSAN does not immediately rebalance or fully rebuild objects simply because Ensure Accessibility was selected, and permanent data loss is not the expected result from a temporary network loss. The likely impact is that some VMs become inaccessible until either the maintenance host returns or the isolated host reconnects. Reference topics: vSAN Maintenance Mode, Ensure Accessibility, Default Storage Policy, RAID-1 FTT=1, Network Partition Handling.

Run the Python reboot helper script only on one ESXi host to recover the cluster.

Enable cluster member updates from vCenter Server on all ESXi hosts.

Exit all hosts from maintenance mode.

During a manual vSAN cluster restart after a planned outage, the hosts must first be brought back and exited from maintenance mode so the cluster can begin recovery. The vSAN reboot helper recovery script must then be run on only one ESXi host. Running the script on multiple hosts can create race conditions and unexpected cluster state. After the recovery script completes, cluster member updates from vCenter Server must be enabled on all ESXi hosts so that normal membership updates resume across the cluster. Enabling updates on only one host is incomplete because all hosts must return to normal cluster-member update behavior. Running the Python reboot helper script on all ESXi hosts is explicitly incorrect because the recovery operation must be initiated from a single host only. Disabling cluster member updates is a shutdown-side activity, not the required restart-side recovery action in this question. Reference topics: Manual vSAN Cluster Restart, Reboot Helper Script, Maintenance Mode Exit, Cluster Member Updates.

The available custom recovery steps are top-level commands, message prompts, and per-machine commands. VMware Live Site Recovery recovery plans operate like automated runbooks, and administrators can insert custom steps to match business continuity requirements. Broadcom TechDocs states that custom recovery steps can run commands or present messages to the user during a recovery. Command recovery steps are divided into two categories: top-level commands and per-virtual-machine commands. Top-level commands are inserted directly into the recovery plan and run on the VMware Live Site Recovery server. Per-machine commands are associated with individual recovered VMs and run before or after that VM is powered on, depending on placement in the workflow. Message prompts are interactive steps that pause the plan until an operator acknowledges the message, making them useful for manual validation, external approvals, or runbook checkpoints. IP reconfiguration is handled through recovery plan networking and guest customization, not as a custom step type. Writable storage snapshots are part of test recovery/storage behavior, not a custom recovery step. Reference topics: VMware Live Site Recovery Recovery Plans, Creating Custom Recovery Steps, Top-Level Commands, Message Prompts, Per-VM Commands.

Run the esxcli storage nfs list command.

Use vCenter Datastore Performance view to monitor NFS datastore latency, IOPS and throughput.

Create a vCenter performance alarm for “Datastore Latency (NFS)” to trigger when thresholds are exceeded.

The correct monitoring workflow is to verify NFS datastore presentation at the host layer, then use vCenter performance views and alarms for operational monitoring. The esxcli storage nfs list command confirms that the NFS datastore is mounted and visible to the ESX host, which is the first validation point before any performance assessment. vCenter Datastore Performance views provide the correct datastore-level telemetry for latency, IOPS, and throughput, including NFS-backed datastores. Creating a vCenter performance alarm for NFS datastore latency allows proactive alerting when the datastore exceeds the required latency threshold. The esxcli storage core device list command is intended for block storage devices and paths, not NFS datastores. The --verbose NFS option listed here is not the required method for collecting detailed performance metrics in this scenario. VCF Operations Logs is log-focused, not the correct graph source for NFS throughput validation. vSAN Performance Service applies to vSAN performance, not external NFS datastore monitoring. Reference topics: NFS Datastore Monitoring, vCenter Datastore Performance, NFS Host Validation, vCenter Performance Alarms.

Supplemental storage is intended for adding storage capacity to an existing workload domain or cluster after the principal storage has already been deployed. Principal storage is the datastore used during workload domain or cluster creation and is normally used for live workload placement. Supplemental storage can be added later for additional workloads, templates, ISO images, backup data, or other data-at-rest requirements. In this scenario, the administrator specifically needs additional capacity for backup data and ISO images without changing or impacting the principal storage used for production workloads. Attaching additional NFS volumes or iSCSI datastores satisfies this requirement because both can be used as supplemental storage options in VCF. Migrating the Management Domain storage is unrelated and unnecessary. Increasing the existing VMFS principal storage allocation does not provide the requested separation between production and backup or ISO storage. Replacing all existing datastores with NVMe devices would be disruptive and does not match the supplemental-storage use case. Reference topics: Principal Storage, Supplemental Storage, NFS Supplemental Storage, iSCSI Supplemental Storage, Day-2 Storage Expansion.

Because the vSAN cluster uses vSphere Lifecycle Manager images, the least disruptive remediation method from the provided choices is to enable Quick Boot in the host remediation settings for images. Quick Boot reduces host remediation time by skipping the full hardware reboot, including the BIOS or UEFI firmware reboot. This reduces the amount of time each ESX host spends in maintenance mode and lowers operational disruption during patching. The documentation states that Quick Boot can be configured for clusters or standalone hosts managed with vSphere Lifecycle Manager images, and that it reduces reboot time during remediation. The baseline options are incorrect because the cluster is explicitly managed by images, not baselines. Disabling Quick Boot would increase disruption because hosts would require a full reboot path. Disabling HA admission control is not the least-disruption patching mechanism and is listed for baseline-oriented remediation behavior in the offered answer. In a vSAN cluster, hosts enter maintenance mode one at a time, so reducing each host’s maintenance window through Quick Boot is the appropriate method. Reference topics: vSphere Lifecycle Manager Images, Host Remediation Settings, Quick Boot, vSAN Cluster Remediation.

The two major contributors are RAID overhead and Operational Reserve. With the default policy set to FTT=1 using RAID-1 mirroring, vSAN stores two copies of protected data. The capacity planning guidance states that when Failures to tolerate is set to 1 failure with RAID-1 mirroring, virtual machines can use about 50 percent of raw capacity because each object consumes mirrored space. This is the largest capacity-impacting factor. The second contributor is Operational Reserve, which reserves capacity for vSAN internal operations such as policy changes, rebalancing, object movement, and other transient storage activities. Even when Host Rebuild Reserve is not activated, vSAN capacity monitoring still accounts for the operations threshold/reserve needed to keep the cluster functional during internal activity. Encryption overhead is typically not the primary reason for a 20% capacity difference. Host upgrade overhead is not a vSAN capacity category. VM swap can consume capacity, but it does not normally account for most unavailable raw capacity compared with RAID mirroring and operational reservation. Reference topics: vSAN Capacity Planning, RAID-1 FTT=1 Capacity Impact, Operations Reserve, Reserved Capacity.

In vSAN Original Storage Architecture, a disk group consists of one flash cache device and one or more capacity devices. The cache device is a required component of the disk group, so a failed cache device cannot be replaced as an isolated drive while preserving the same disk group. The supported operational approach is to remove the affected disk group, physically replace the failed cache device, verify that ESX detects the new device, and then manually recreate the disk group using the replacement cache device and the appropriate capacity devices. The scenario states that vSAN has already completed resynchronization and that all objects are healthy and compliant, so removing the failed disk group no longer risks object noncompliance. Selecting Full Data Migration on a failed cache device is not the correct workflow because the cache failure affects the entire disk group. Simply inserting a replacement drive does not cause vSAN OSA to automatically rebuild the disk group. Reference topics: vSAN OSA Disk Groups, Replace a Cache Device, Remove Disk Group, Recreate Disk Group.

Site A = Data Site; Site B = Witness Site; Site C = Data Site; Site A ↔ Site C = Layer 3, RTT <</b> 5 ms; Site A ↔ Site B = Layer 3, RTT <</b> 200 ms; Site B ↔ Site C = Layer 3, RTT <</b> 200 ms

Site A and Site C should be the data sites because Site A hosts production services and Site C has been commissioned to replace the capacity-constrained Site B. Site B should be used as the witness site because it has no space for additional physical hosts, and a vSAN witness appliance does not run workload VMs. A vSAN Stretched Cluster requires two availability zones for data nodes and a third site for the witness appliance. The data-site-to-data-site connection carries synchronous vSAN data traffic and must meet less than 5 ms RTT. The witness site carries metadata traffic only, so the data-site-to-witness links support higher latency, with less than 200 ms RTT for up to 10 hosts per site. Because the requirement specifically calls out minimizing disruption from STP, Layer 3 is the preferred network type between sites. VMware states that Layer 3 helps avoid STP redirecting traffic across undesirable links, such as constrained witness links. Reference topics: vSAN Stretched Cluster Network Design, Data Site and Witness Site Placement, Layer 3 Recommendation, RTT Requirements.