VMware 2V0-17.25 Online Practice Questions and Exam Preparation

VMware 2V0-17.25 Online Questions & Answers

• Question 1:

  A security team informed an administrator that a VMware vCenter root password was compromised. As a precaution, the password was changed directly in vCenter. What should an administrator do to regain management capability of this vCenter by VCF Operations?

  A. Enter the new root password using the Reset password function in VCF Operations.
  B. Use the Rotate password function in VCF Operations.
  C. Enter the new root password using the Update password function in VCF Operations.
  D. Enter the new root password using the Remediate password function in VCF Operations.
  D. Enter the new root password using the Remediate password function in VCF Operations.

  ---

  Explanation

  The documentation clarifies the scenario when a password is changedoutsideof VCF Operations: “When an error occurs, for example after a password expires, you must manually reset the password in the component product. After you reset the password in a component, you must remediate the password in VCF Operations.” “Password Rotation” is different—it “allows you to orchestrate the rotation” of stored credentials (a planned, VCF-driven change), not reconcile an externally altered password. Therefore, after the direct password change in vCenter, the correct recovery step in VCF Operations is to useRemediate password to synchronize credentials and restore management from VCF Operations.

• Question 2:

  An administrator needs to scale out the VMware Cloud Foundation (VCF) Automation node from a small to a medium form factor. The environment is currently deployed using the Simple VCF Automation Model. Which action should the administrator take to achieve this?

  A. Deploy a separate VCF Automation instance in the environment.
  B. Redeploy the VCF Automation node as a single medium form factor using the VCF Operations Console.
  C. Scale up the VCF Automation node to medium form factor using the VCF Operations Console.
  D. Scale out the VCF Automation deployment to a High Availability model with medium form factor.
  D. Scale out the VCF Automation deployment to a High Availability model with medium form factor.

  ---

  Explanation

  VCF 9.0 states for the Simple Automation model: “Single node… Applies to Small…Can be scaled out to the high availability model by resizing the node to Medium or Large, which also forces the scale out to 3 nodes.” In addition, the Day-N procedure confirms the action is aScale(scale-out) operation: “Scale VCF Automation… choose a larger target deployment type such as Medium or Large…” and provide “ Additional VIPs” and a “Cluster Node IP Pool” (Medium requires a minimum offour IPs), then submit the scale out request. Therefore, moving from Small (Simple) to Medium necessarily transitions to theHigh Availability(3-node) model rather than remaining a single medium node. This aligns the form factor with the documented model behavior and the fleet management workflow.

• Question 3:

  An administrator must configure a new Project in the Development tenant of VCF Automation. The requirement is to minimize ongoing management overhead as new developers onboard. Which four steps should be taken? (Choose four.)

  A. Log in to the Development tenant as a Project Administrator.
  B. Assign at least one Cloud Zone to the Project.
  C. Assign both Project Administrators and Project Members to the Project using Active Directory Users.
  D. Create a new Project.
  E. Assign at least one Namespace to the Project.
  F. Log in to the Development tenant as an Organization Administrator.
  G. Assign both Project Administrators and Project Members to the Project using Active Directory Groups.
  A. Log in to the Development tenant as a Project Administrator.
  B. Assign at least one Cloud Zone to the Project.
  D. Create a new Project.
  G. Assign both Project Administrators and Project Members to the Project using Active Directory Groups.

  ---

  Explanation

  Comprehensive and Detailed Explanation:

  According to the VCF Automation 9.0 Guide, project creation requires administrative login at the tenant level: “To create a new project, log in as a Project Administrator of that tenant.” . After creation, projects must be mapped to Cloud Zones

  to determine compute placement. The document also emphasizes: “For scalable user management, assign groups from Active Directory to roles within projects rather than individual users.” This reduces management overhead as new

  members join. Namespaces are not mandatory unless Kubernetes Supervisor is being integrated, which is not required in this scenario. Likewise, logging in as an Organization Administrator (F) is not needed for tenant-level project creation.

  Therefore, the correct steps are: Log in as Project Admin (A), Create a Project (D), Assign a Cloud Zone (B), and Use Active Directory Groups for membership (G). This ensures minimal ongoing administrative effort.

• Question 4:

  An administrator must replace a component’s certificate in VCF with an external CA-signed certificate. What format must be used when creating the certificate?

  A. DER
  B. PFX
  C. P7B
  D. PEM
  D. PEM

  ---

  Explanation

  TheVCF 9.0 Security and Certificates Guidestates: “VCF supports only certificates in PEM format when replacing system component certificates with those signed by an external Certificate Authority.”

  PEM is the standard Base64 format with .crt and .key files. PFX (PKCS#12) is used for Windows stores but not supported in VCF automation. P7B is for certificate chains, while DER is binary encoding. Thus, the required format for

  certificates in VCF isPEM.

• Question 5:

  An administrator is deciding on a storage solution to create the first management workload domain for a new VMware Cloud Foundation (VCF) instance. Which three storage solutions can be used asprincipal storage? (Choose three.)

  A. NVMe/TCP
  B. Virtual Volumes (vVols)
  C. VMFS on Fibre Channel (FC)
  D. NFSv3
  E. vSAN OSA
  C. VMFS on Fibre Channel (FC)
  D. NFSv3
  E. vSAN OSA

  ---

  Explanation

  TheVCF 9.0 Architecture Guideoutlines validprincipal storage optionsfor the management domain. It states: “The management domain must be deployed using vSAN, NFS, or Fibre Channel (FC). Supported protocols include NFSv3 and

  VMFS on FC.” vSAN (including OSA) is the default recommended option, but NFSv3 and VMFS on FC are also supported for environments where external storage arrays are required.

  NVMe/TCP and vVols arenot supportedfor the initial management domain’s principal storage. vVols may be used in workload domains after deployment, but they are not a supported foundation for the management domain. Therefore, the

  three correct storage solutions for the first management workload domain are:VMFS on FC, NFSv3, and vSAN OSA.

• Question 6:

  An administrator is responsible for managing a VMware Cloud Foundation (VCF) fleet. The administrator has been tasked with creating a solution that allows Kubernetes development teams to complete the self-service creation of Active

  Directory (AD) accounts with the following requirements:

  Only users within the Development tenant should be able to create user accounts.

  Users must be able to create and destroy user accounts in the development AD only.The administrator has already deployed a dedicated VCF Operations Orchestrator for the Development tenant.

  What four additional tasks must the administrator complete to meet the stated objective? (Choose four.)

  A. Publish the Active Directory User creation action to the self-service catalog in VCF Automation through the Content Hub.
  B. Configure the VCF Operations Orchestrator integration to connect to the dedicated VCF Operations Orchestrator.
  C. Publish the Active Directory User creation workflow to the self-service catalog in VCF Automation through the Content Hub.
  D. Configure the VCF Operations Orchestrator Active Directory plugin to connect to the production Active Directory.
  E. Configure the VCF Operations Orchestrator Active Directory plugin to connect to the development Active Directory.
  F. Create a Custom Resource object and select the appropriate VCF Operations Orchestrator workflows for object creation and destruction.
  G. Configure the VCF Operations Orchestrator integration to utilize the embedded VCF Operations Orchestrator.
  B. Configure the VCF Operations Orchestrator integration to connect to the dedicated VCF Operations Orchestrator.
  C. Publish the Active Directory User creation workflow to the self-service catalog in VCF Automation through the Content Hub.
  E. Configure the VCF Operations Orchestrator Active Directory plugin to connect to the development Active Directory.
  F. Create a Custom Resource object and select the appropriate VCF Operations Orchestrator workflows for object creation and destruction.

  ---

  Explanation

  The VCF 9.0 Automation and Orchestration Guide explains how Orchestrator integrates with VCF Automation to provide workflow-driven services such as Active Directory management.

  Orchestrator Integration (B):The tenant must be connected to the dedicated Orchestrator instance rather than the embedded one. Documentation notes:“Each tenant can integrate with its own Orchestrator endpoint for workflow execution.”

  AD Plugin Configuration (E):The Orchestrator Active Directory plugin must be configured against the development AD only, ensuring that the development team does not impact the production directory.

  Publish Workflow (C):The AD user creation workflow must be published to the VCF Automation catalog using the Content Hub. Actions alone are insufficient; workflows are the full automation logic exposed to end users.

  Custom Resource Object (F):To enable developers to create and destroy AD accounts, a Custom Resource object must be created in VCF Automation and mapped to the Orchestrator workflows. This provides lifecycle capabilities (create/

  destroy) in the self-service catalog.

  Options A and D are incorrect because publishing only the “action” is not sufficient (workflows are required), and the plugin must not point to production AD. Option G is incorrect because the dedicated Orchestrator has already been

  deployed, so the embedded Orchestrator is not used.

  References: VMware Cloud Foundation 9.0 - Automation Guide (Custom Resources, Content Hub, Orchestrator integrations, AD plugin usage).

• Question 7:

  An administrator must create different pricing information for clusters in a VCF fleet.

  Requirements:

  CPU, memory, storage costs same across clusters.

  VM setup charges only for SAP HANA cluster.

  All other settings remain default.

  Name new policy “Resources.”

  Which three settings must be configured? (Choose three.)

  A. Create new policy “Resources” under Base Settings and define CPU, memory, storage costs.
  B. Set “Resources” policy as default.
  C. Set “Default Policy” as default.
  D. Create new policy under “Resources” for SAP HANA VM setup charges.
  E. Create new policy under “Base Settings” for SAP HANA VM setup charges.
  F. Create new policy under “Default Policy” for SAP HANA VM setup charges.
  A. Create new policy “Resources” under Base Settings and define CPU, memory, storage costs.
  B. Set “Resources” policy as default.
  E. Create new policy under “Base Settings” for SAP HANA VM setup charges.

  ---

  Explanation

  TheVCF Automation Costing and Pricing Guideexplains:

  “Define core costs for CPU, memory, and storage under Base Settings to apply fleet-wide.” (A)

  “Mark the created policy as the default to ensure it applies globally.” (B)

  For SAP HANA, “Create an exception policy under Base Settings with VM setup charges assigned to the SAP HANA cluster.” (E)Default Policy (C, F) is system-reserved. Sub-policies under “Resources” (D) are not valid. Correct configuration

  steps:A, B,

  E.

• Question 8:

  What is the purpose ofIstio Service Mesh?

  A. Provides service discovery across multiple clusters.
  B. Provides an infrastructure layer that makes communication between applications possible, structured, and observable.
  C. Provides dynamic application load balancing and autoscaling across multiple clusters and sites.
  D. Provides a centralized, global routing table to simplify and optimize traffic management.
  B. Provides an infrastructure layer that makes communication between applications possible, structured, and observable.

  ---

  Explanation

  TheVCF 9.0 Service Mesh Integration Guidedefines Istio as: “Istio Service Mesh provides an infrastructure layer that transparently handles service-to-service communication, securing, observing, and controlling traffic between microservices.” The key purpose is enabling structured and observable communication between applications. While Istio includes discovery and load balancing, those are features, not the overarching purpose. A centralized routing table (Option D) is not the core definition. VMware documentation highlights Istio’s role inservice-to-service communication, observability, and policy enforcementwithin the service mesh. Therefore, the correct answer isB.

• Question 9:

  An administrator has deployed a VMware Cloud Foundation (VCF) environment and needs to monitor the health of the environment. Which three components can be monitored using VCF Health in VCF Operations? (Choose three.)

  A. VCF Operations
  B. ESX hosts
  C. vCenter Server
  D. VCF Operations Fleet Management
  E. VCF Operations for Logs
  F. NSX
  B. ESX hosts
  C. vCenter Server
  F. NSX

  ---

  Explanation

  TheVCF Healthfeature “provides a central location for monitoring the health of your environment,” including the ability to track “vCenter Server instances,” “ESXi hosts,” and “NSX deployments.” Health monitoring includes connectivity,

  configuration, and critical services status, surfacing alerts for remediation. The documentation’s scope statements make clear that VCF Health targets theinfrastructure components— vCenter, ESXi, and NSX—rather than the VCF Operations

  applications themselves (for example, Fleet Management or Logs). Therefore, the correct monitored components are , , andNSX.

  ESX hosts vCenter Server

• Question 10:

  An administrator has been tasked with configuring the external connectivity for a Virtual Private Cloud (VPC) within a new VMware NSX project. The Transit Gateway (TGW) associated with the project will use VLAN(s) and external subnets to

  connect the VPC to the physical routers.

  What prerequisite must the administrator ensure is completed before starting the configuration of the external connection?

  A. TWO BGP Peers must be set up on the Distributed TGW for dynamic routing.
  B. The vSphere cluster must have a Transport Node Profile (TNP) attached to it.
  C. All the hosts running VPC workloads must have access to the VLAN(s) used by the Distributed TGW.
  D. All the hosts running VPC workloads must have access to the Edge TEP network.
  C. All the hosts running VPC workloads must have access to the VLAN(s) used by the Distributed TGW.

  ---

  Explanation

  The VMware Cloud Foundation 9.0 NSX Projects and VPC Guide outlines the prerequisites for configuring external connectivity using a Transit Gateway (TGW). When VLAN-backed external connectivity is used, the documentation specifies:

  “For VLAN-backed external connectivity, ensure that all hosts in the workload cluster where VPC workloads run have physical access to the VLAN(s) used by the Transit Gateway. This ensures end-to-end packet reachability between VPC

  segments and the physical router.”

  Analysis of options:

  A (TWO BGP Peers): BGP can be configured later to enable dynamic routing but is not a prerequisite for establishing VLAN-backed connectivity.

  B (TNP attached): A Transport Node Profile is required for NSX host preparation, but it is part of the general NSX setup, not the specific prerequisite for TGW VLAN external connectivity.

  C (Access to VLANs): This is the critical prerequisite—hosts running workloads must have access to the external VLANs. Without this, connectivity to the physical routers will fail.

  D (Access to Edge TEP network): TEP networks are used for overlay traffic (Geneve

  encapsulation), not for VLAN-backed TGW external connectivity.

  Therefore, the correct prerequisite is ensuring all VPC workload hosts have access to the VLAN(s) used by the Distributed TGW.

  References:

  VMware Cloud Foundation 9.0 NSX Networking Guide - VPC External Connectivity (Transit

  Gateway VLAN-backed requirements).

  NSX Project/VPC documentation: VLAN access prerequisites for external connectivity.