Free Practice Questions for the VMware Professional Level Exams 6V0-22.25 Exam (2026 Updated)

VMware Avi Load Balancer supports HTTP-to-HTTPS redirection in more than one way. The HTTP application profile can perform a general HTTP-to-HTTPS redirect, but an HTTP Policy provides more granular control because policies can match on specific conditions and then apply actions. Avi documentation states that Virtual Service policies are more specific than general-purpose profiles and that policy rules take precedence over profile behavior. This makes HTTP Policy redirection more flexible than using only the HTTP profile, because administrators can build conditional redirect logic based on host, path, headers, or other HTTP match criteria. It is not incompatible with WAF, and it is not described as less efficient than DataScript for this purpose.

Avi Load Balancer health score is a composite metric that considers several dimensions, including performance, resources, anomalies, and security. VMware Avi documentation for the Analytics Profile states that constrained resources increase the resource penalty score, and examples include CPU, memory, or disk utilization of a Service Engine or a server. In this scenario, users are not experiencing application issues, so the performance score may remain normal. However, the Service Engine hosting the Virtual Service has high memory utilization, which is explicitly a resource constraint. Because resource constraints are reflected as a resource penalty, the Virtual Service health score can be affected even when users have not yet noticed symptoms. Therefore, the correct impact is that the Resource Penalty will be increased.

A Service Engine Group defines how Service Engines are created, placed, scaled, and managed for Virtual Services. Properties such as high availability mode, Service Engine sizing, placement rules, scale-out behavior, and rebalance behavior are configured at the Service Engine Group level. Avi documentation includes the Auto Rebalance option as part of Service Engine Group behavior, allowing Avi to redistribute Virtual Services across Service Engines when appropriate. SSL Profiles and Analytics Profiles are normally applied to Virtual Services or associated profiles, not configured as core Service Engine Group properties. The Service Engine management network is normally part of the cloud or infrastructure networking setup rather than the SE Group property asked here. Therefore, the Service Engine Group property listed is Auto Rebalance Policy .

Avi Load Balancer supports sharing a single VIP across multiple Virtual Services when each Virtual Service uses a different service port. This is useful when multiple applications or protocols must use the same IP address but separate listener ports, profiles, pools, and policies. Broadcom documentation for sharing a single VIP across multiple Virtual Services describes selecting an existing VS VIP while creating another Virtual Service. This avoids manually typing the same IP address as a separate allocation, which could create duplicate or inconsistent VIP configuration. Creating a child Virtual Service is used for other use cases, such as SNI or parent-child designs, not simply reusing the same VIP on a different port. Therefore, the correct method is to use Advanced Setup and select the existing VS VIP.

Avi WAF supports several inspection methods, including signature-based protection, allow-list style controls, and Positive Security. Positive Security is more computationally expensive because it validates application behavior against learned or configured rules that define what is explicitly allowed. This requires deeper inspection and more rule evaluation than simply matching known attack signatures. Signature inspection generally compares requests against known malicious patterns, while Positive Security evaluates whether requests conform to permitted application behavior. VMware Avi WAF documentation describes Positive Security and learning as a deeper application security method. Because it performs more detailed validation of acceptable behavior, it consumes more processing resources than the other listed methods. Therefore, the most computationally expensive inspection method is Positive Security.

Applications that cannot be SNATed require preservation of the original client IP address. In Avi Load Balancer, preserving client IP is mutually exclusive with SNAT, because the Service Engine must forward traffic without replacing the source address. VMware Avi documentation for Preserve Client IP describes specific requirements and caveats for non-SNAT traffic handling. For this model, the Service Engine Group must use Legacy Active-Standby behavior, where the Virtual Service is active on one Service Engine and failover behavior is predictable. Elastic Active-Active mode generally relies on distributed placement and typically uses SNAT for symmetric return traffic handling. Therefore, when an application cannot use SNAT and must preserve the client IP address, the correct HA mode is Legacy Active-Standby .

WAF-related application traffic events are exposed through Virtual Service logs. In Avi Load Balancer, client application logs provide per-request visibility, including security-relevant events and WAF match details when WAF is enabled. The Logs tab on the Virtual Service detail screen is the operational location used to inspect these request-level entries. Alerts are used for alert conditions and system events, not for viewing each application traffic log. Analytics provides charts and performance summaries, while the Security tab is used for configuration or summarized security context depending on the UI view. Because the question asks where WAF-specific application traffic log messages are found for a Virtual Service, the correct operational location is the Logs tab of the Virtual Service detail screen.

Avi Load Balancer collects analytics metrics at different frequencies depending on whether real- time metrics are enabled. VMware Avi documentation explains that a newly created Virtual Service captures analytics aggressively for the first 30 minutes, but after that period the update frequency slows down unless real-time metrics are enabled. This behavior commonly appears as graph data updating every five minutes instead of continuously or near real time. The issue is not caused by the GUI refresh interval, and selecting “Average Values” is not the root cause. The timeframe of “Past 30 Minutes” can show recent data, but it does not automatically enable real-time collection. Therefore, the correct explanation is that, by default, the Real Time Metrics option is not enabled for the Virtual Service.

Avi provides several places to troubleshoot why a pool server is marked down by a health monitor. VMware Avi documentation describes server health-monitor troubleshooting through pool and server health information, including the Health Score icon, server analytics, and system events such as server-down events. These views are intended to expose health monitor state and the reason a server failed the monitor. However, Virtual Service client logs are application traffic logs; Avi documentation specifically notes that health monitor transactions are not included when recording client traffic logs for a Virtual Service. Therefore, looking in Virtual Service > Logs does not identify why a server was marked down by a health monitor. The correct answer is Virtual Service Logs.

The HTTP Application Profile contains HTTP-specific behavior for a Virtual Service. VMware Avi documentation describes the HTTP profile as providing HTTP proxy functionality, including features such as redirects. Other HTTP profile capabilities include compression behavior and HTTP header handling such as X-Forwarded-For insertion. Web Application Firewall, however, is not configured inside the HTTP profile. WAF is configured using WAF profiles and WAF policies, and a WAF policy is then associated with the Virtual Service. This separation is important because an HTTP profile controls HTTP proxy behavior, while WAF controls application-layer security inspection. Therefore, among the listed options, the functionality that is not configured in the HTTP profile is Web Application Firewall .

In Avi Elastic HA N+M mode, the N value represents the minimum active scale required for a Virtual Service, while M represents additional capacity maintained for resiliency. Broadcom’s Avi documentation explains that in N+M Elastic HA, M is the number of additional or buffer Service Engines that the Avi Load Balancer Controller maintains in the Service Engine Group. These buffer Service Engines provide spare capacity for failover, scale-out, and placement flexibility. This is separate from the maximum number of Service Engines in the group, which defines the upper limit of SEs that can exist. It is also separate from the maximum number of Virtual Services per Service Engine. Therefore, the “M” in N+M Elastic HA refers to the number of buffer Service Engines .

Avi Load Balancer health score includes multiple penalty categories, including security penalties. VMware Avi documentation for SSL certificate expiration explains that a certificate approaching expiry can reduce the Virtual Service health score. Specifically, when a certificate is within 30 days of expiration, Avi applies a 20-point security penalty to the Virtual Service, which caps the maximum health score at 80. This exactly matches the question’s stated Security Penalty of -20 . CPU utilization on the Service Engine would align more closely with a resource or performance impact, not a certificate-related security penalty. A health monitor protocol mismatch could mark servers down, but it does not correspond to the documented -20 SSL certificate security penalty.

Avi Virtual Services need a valid traffic-forwarding path. A default pool, pool group, or valid scripted pool-selection logic is required so the Service Engine can determine where to send matching application traffic. Broadcom’s DataScript documentation includes pool functions such as forwarding a request to the default pool and selecting pools by script, which shows that DataScript pool handling depends on valid pool references. If a DataScript is attached without an appropriate default pool or pool-selection path, the Service Engine cannot correctly process traffic for that Virtual Service, which can result in the Virtual Service being marked down. A wrong health monitor marks pool members down, not necessarily the Virtual Service itself. A local response or redirect policy can still respond without forwarding to a pool.

Connection Multiplexing is most valuable when client behavior would otherwise create many short-lived server-side TCP connections. HTTP/1.0 is the best fit for this benefit because HTTP/1.0 commonly opens a separate TCP connection for each request unless keepalive behavior is specifically used. Avi Connection Multiplexing decouples the client-side connection from the server-side connection and allows the Service Engine to reuse server-side TCP connections for multiple HTTP requests. This reduces connection setup and teardown load on backend servers. HTTP/1.1 already introduced persistent connections as a standard behavior, so the relative benefit is smaller than with HTTP/1.0. HTTP/2 has its own multiplexing model at the protocol level. Therefore, Connection Multiplexing is most valuable for HTTP v1.0 .

The backend web servers accept only TLS connections on port 443, but the configured monitor is an HTTP health monitor. A plain HTTP monitor sends unencrypted HTTP checks, which the TLS-only backend servers will reject or fail to answer correctly. Broadcom’s Avi documentation provides a specific HTTPS Health Monitor type for monitoring servers over SSL/TLS. Using an HTTPS monitor allows the Service Engine to perform the health check using TLS and then validate the HTTP response over the encrypted connection. Changing the Virtual Service to a secure HTTP application profile is unnecessary because the Virtual Service is intentionally operating as L4. Enabling SSL in the pool is not the most precise fix for the failed health monitor. Therefore, the correct change is to configure a Health Monitor of Type HTTPS .