3V0-22.25 VMware Advanced VMware Cloud Foundation 9.0 Operations Free Practice Exam Questions (2026 Updated)

The administrator must configure a Webhook Notification plug-in. Action-based notifications in VCF Operations are tied to Workload Placement actions, where the notification is sent when a workload-placement action succeeds, fails, or times out. Broadcom’s documentation for creating notification rules for notification type Action identifies this workflow as Workload Placement action-based notification. ( TechDocs ) For outbound delivery, the required plug-in type is the Webhook Notification plug-in, which is the supported outbound mechanism for sending action notification payloads to an external endpoint. Broadcom’s outbound plug-in documentation describes adding a Webhook Notification plug-in instance so alert or event data can be sent outside the operations platform. ( TechDocs ) A Log File plug-in is not used for action-based notification delivery. “SMTP Trap” is not the correct VCF Operations outbound plug-in type; email uses Standard Email, and trap delivery would be SNMP-oriented. Standard Email is valid for alert-style notification workflows, but WLP action-based notification requires Webhook. Reference topic: Objective 4.9 – Notifications / Outbound Plugins / WLP Action-Based Notifications / Webhook Notification Plugin .

The next required step is to download and run the helper script from the cloud proxy, then restart Telegraf . Installing Telegraf and defining OS or application input plug-ins is only part of the configuration. To send data to VCF Operations, Telegraf must also be configured with the correct output plug-in that targets the VCF Operations cloud proxy. The documentation states that after installing open source Telegraf, the administrator must run the helper script to configure Telegraf to send data to the cloud proxy. Running the helper script creates the cloudproxy-http.conf file and adds the output plug-in properties required for sending data; it also updates input plug-ins for OS metrics . The same workflow then requires the Telegraf service to be started or restarted so the new configuration is loaded . Direct communication to the VCF Operations load balancer is not the collection path; Telegraf sends to the cloud proxy or collector group. Operator rights do not control the Telegraf service runtime, and rebooting cloud proxies is unnecessary. Reference topic: Objective 4.7 – Managed/Open Source Telegraf / OS and Application Monitoring / Cloud Proxy Output Configuration .

The correct setting is ssl_accept_any_trusted=yes in the agent configuration. VCF Operations for Logs agent SSL communication is controlled from the agent configuration file under the [server] section. A secure agent configuration uses proto=cfapi, ssl=yes, and the secure ingestion port, and then defines how the agent validates the server certificate. Broadcom documentation examples for secure Operations for Logs agent communication show the agent configuration using ssl_accept_any_trusted=yes, with ssl=yes and the certificate trust settings, to allow the agent to establish encrypted communication while accepting the trusted certificate presented by the server . Broadcom’s Operations for Logs SSL parameter documentation also states that ssl_accept_any accepts any certificate when set to yes or 1, but that is broader and less controlled than accepting the trusted self-signed certificate path . Port 9000 is not the SSL ingestion setting, and proto=syslog is not the Log Insight agent CFAPI configuration. Copying the certificate alone is not the requested agent.ini modification. Reference topic: Objective 4.12 – VCF Operations for Logs / Agent SSL Parameters / Encrypted Agent Communication .

The correct troubleshooting sources are the Request Log , the Management Pack Builder Adapter log , and the Integration Designer Controller log . Management Pack Builder troubleshooting is centered on validating the API requests, collection execution, adapter behavior, and server-side design processing. The VCF 9.0 documentation states that every test request or test collection in Management Pack Builder exposes request tabs showing the body, headers, and logs; these are used to diagnose response-code errors and request/response issues . For collection problems after installation, the administrator should review Management Pack Builder Adapter logs , located under $VCOPS_BASE/user/log/adapters/MPBAdapter on the selected node or cloud proxy, because these logs show adapter-side warnings and errors during collection . If the issue appears to be with Management Pack Builder itself, the official guidance identifies /usr/lib/vmware-vcops/user/log/integration-designer-controller.log as the server-side log to review . The Design Screen is used to build and verify definitions, but it is not one of the listed troubleshooting data sources. Observability Workbench is for infrastructure troubleshooting, not Management Pack Builder design diagnostics. Reference topic: Objective 4.8 – Management Pack Builder / Troubleshooting a Design .

The administrator must deregister the second VCF Instance from the existing Single Sign-On configuration . In this scenario, the second VCF Instance is currently attached to an SSO configuration whose identity source is managed by the first VCF Instance. The requirement is not merely to change the LDAP provider on the existing shared configuration; it is to connect the second instance to a new SAML 2.0 Identity Provider and a new VCF Single Sign-On configuration . The VCF 9.0 documentation provides a specific workflow for this condition: when a VCF Instance must be removed from an existing SSO configuration, the administrator navigates to the VCF Instance, opens Component Configuration , filters configured components, selects all configured components, and clicks Deregister Component . After all registered components are deregistered, the page reloads and allows the administrator to either connect to an existing SSO configuration or create a new SSO configuration for that VCF Instance . Resetting the first instance would disrupt the controlling SSO configuration. Resetting the second instance is used for changing identity-source details within its own SSO lifecycle, not for detaching it from an SSO configuration managed by another instance. Reference topic: Objective 4.14 – Fleet Management / Identity and Access Management / VCF Single Sign-On / Deregister VCF Instance from SSO .

The correct view type is Distribution View . The requirement is not simply to list VMs or plot a time-series trend; it is to group VM metric values into defined ranges or “buckets” so the administrator can visualize how many VMs fall into each CPU Ready % band. VCF Operations documentation defines Distribution Views as views that provide aggregated data about resource distribution in the monitored environment. When used in dashboards, the administrator can click a section of a pie chart, bar chart, or donut chart to view the list of objects filtered by that selected segment . This directly fits the requested CPU Ready % spread visualization. The same configuration supports Manual Distribution , where the administrator specifies the number of buckets and the minimum and maximum values of each bucket . That is the exact model required for ranges such as 0–2%, 2–5%, 5–10%, and greater than 10%. List View is tabular, Trend View is time-based, and Summary View is not intended for bucketed metric distribution. Reference topic: Objective 4.10 – Creating Custom Dashboards, Views and Reports / Distribution Views / Manual Distribution Buckets .

The correct mapping is based on the monitoring method and discovery scope. Service Discovery identifies services running in each VM and builds relationships or dependencies between services running on different VMs, allowing administrators to understand service impact, outage dependency, and escalation paths . Application Discovery builds on service relationships by identifying predefined and custom applications when services are connected to and communicating with one another; VCF Operations can show the VMs connected to those services and how those services interact . Product-Managed Telegraf is managed directly by VCF Operations and is used to monitor supported operating systems and application services on vCenter-managed VMs, unmanaged VMs, and physical servers categorized as endpoints . Open Source Telegraf is user-managed and can monitor operating systems plus both supported and unsupported application services, although lifecycle actions such as start, stop, upgrade, and plugin activation are not managed by VCF Operations . Reference topic: Objective 4.7 – Monitor Applications with VCF Operations / Service Discovery, Application Discovery, Product-Managed Telegraf, and Open Source Telegraf .

The administrator must create the scheduled action directly from the Rightsize feature. VCF Operations Rightsize is the capacity-optimization workflow used to adjust CPU and memory allocations for oversized and undersized virtual machines. For oversized VMs, the administrator selects the target VM, opens the resize workflow, reviews the recommended vCPU and memory reduction, and can use the edit controls to modify the recommendation before execution. In this scenario, the default recommendation is a 4 vCPU reduction, but the agreed action is only 50 percent of that value, so the administrator adjusts the reduction to 2 vCPU . The Rightsize page also provides SCHEDULE ACTION , which opens a scheduling dialog so the resize action can run later during the maintenance window; scheduled jobs are then managed through Automation Central . Automation Central is used to manage scheduled jobs, but the rightsizing task is initiated from Rightsize. Reclaim is used for powered-off VMs, idle VMs, snapshots, and orphaned disks, not vCPU rightsizing. vSphere scheduled tasks bypass VCF Operations recommendations. Reference topic: Objective 4.2 – Manage VCF Capacity / Rightsize Workloads / Oversized VMs / Scheduled Actions .

The minimum requirements are to register VCF Operations in Connected Mode with the VCF Business Services console and activate Log Assist on a Unified Cloud Proxy . Log Assist is designed to generate support bundles, link them to Broadcom support cases, and attach diagnostic findings for troubleshooting. The official VCF 9.0 guidance states that before using Log Assist, the environment must be in Connected Mode , Log Assist must be activated on a unified collector, and inventory objects must be assigned to Log Assist . The setup workflow specifically instructs the administrator to go to License Management > Registration and register licenses in Connected Mode, then go to Administration > Control Panel > Cloud Proxies , select the collector, and choose Activate Log Assist . Log Assist uses the unified collector to collect and upload support bundles to the Broadcom Support Portal; legacy or Classic collectors do not support this capability . Disconnected mode cannot satisfy automatic support upload. Enabling vCenter log collection is a separate logging function and is not the minimum requirement for Log Assist. Reference topic: Objective 4.9 – Log Assist / Unified Collector / Connected Licensing / Support Case Uploads .

The administrator should model the phased migration by using What-If Analysis workload planning, not migration execution workflows. Because the target workload domain uses vSAN , the correct planning model is the hyperconverged workload-planning workflow, where VCF Operations lets the administrator add or remove VM workloads in a vSAN environment and evaluate the capacity effect on the selected cluster . Each migration phase should be represented as a separate scenario: small VMs, medium VMs, and large VMs. In each scenario, the administrator configures an Application Profile to represent the t-shirt size by defining vCPU, memory, and disk space, then adds the corresponding number of VM workloads for that phase . Since the source vCenter is unmanaged, importing profiles or VM templates directly from the source environment is not the correct method. After the scenarios are created, VCF Operations allows compatible saved scenarios that target the same object to be selected and run together, so the administrator can evaluate the cumulative impact of all planned phases on the target cluster . Reference topic: Objective 4.3 – Forecast VCF Capacity Growth / What-If Analysis / Add VM Workloads / Run Multiple Scenarios Cumulatively .

The warnings persist because the issuing certificate chain , not the renewed leaf certificates, is approaching expiration. VCF Operations Fleet Management can view certificate details and certificate alerts across VCF Management and VCF Instance components, including vCenter, NSX Manager, SDDC Manager, ESX, and VCF Operations components . Auto-renewal only renews supported component TLS certificates and occurs 60 days before certificate expiration; it does not renew root certificates . When certificates are issued by an enterprise Microsoft CA, the validity of endpoint certificates is constrained by the validity of the issuing chain. vSphere documentation states that a certificate cannot be renewed with an expiration date beyond the expiration of the trusted root certificate . Therefore, even if the component certificates were recently rotated and the template is configured for one year, the generated certificates may still inherit a shorter effective validity period if the Microsoft CA root or intermediate certificate is expiring soon. The correct remediation is to renew or replace the CA chain, not repeatedly clear alerts or manually renew endpoint certificates. Reference topic: Objective 4.14 – Fleet Management / Certificate Management / Auto-Renewal / CA Chain Validity .

Business Applications in VCF Operations are application-centric container objects used to model and monitor the services that support the business. The documentation defines a Business Application as a set of interconnected applications, services, and hosts configured to offer a service to the organization, and also as a collection of interdependent hardware and software components that deliver a specific business capability . Therefore, monitoring the overall health of multiple objects that represent an application and collecting interdependent components together are direct use cases. The Business Applications page displays health in a sortable table, with the application health determined by the aggregated health of underlying objects . VCF Operations also states that after adding a Business Application, administrators can track object health and optimize capacity, cost, and run What-If Analysis on Business Applications . Cost and price analysis also supports container objects such as Business Apps and Custom Groups . Keeping VM cost as low as possible is a general FinOps goal, and unsupported service monitoring with open source Telegraf is an application-monitoring function, not a Business Application use case. Reference topic: Objective 4.7 – Monitor Applications with VCF Operations / Business Applications / Application Health, Cost, and Capacity .

The minimum count is 12 collectors , because the requirement is stated at the domain level and each VCF instance contains three domains: one Management Domain and two Workload Domains. The calculation is: 2 Fleets × 2 VCF Instances per Fleet × 3 Domains per VCF Instance = 12 dedicated domain collectors . VCF 9.0 defines a VCF private cloud as containing one or more VCF fleets, a VCF fleet as containing one or more VCF instances, and a VCF instance as consisting of a management domain and optional workload domains . VCF Operations collector architecture also supports scaling collection by adding collector nodes and assigning them through collector groups; collector groups are used to increase resiliency when a collector becomes unavailable and redistribute collection work across remaining collectors . Because the question states that each domain requires dedicated collectors, the administrator cannot satisfy the design by sharing a single collector across multiple domains or counting only the VCF instances. Options 4, 6, and 10 undercount the total number of managed domains. Reference topic: Objective 4.1 – Day 2 Tasks / Unified Cloud Proxies / Collector Groups / Scaling VCF Operations Collection .

The correct administrative action is to clone the predefined dashboard and then modify the cloned copy. “Live! Heavy Hitters” is a predefined dashboard used to analyze shared infrastructure misuse and identify virtual machines with high activity against shared resources. Because it is delivered as predefined content, the supported customization pattern is not to directly edit the original dashboard, but to clone it and make changes to the copy. Broadcom’s dashboard documentation states that administrators can clone and edit predefined dashboards or create new dashboards from scratch. This preserves vendor-provided content while allowing operational teams to add site-specific widgets or metrics such as Cost | VM Cost Trend . Option A is not the best answer because changing ownership is used for ownership/sharing administration, not the preferred method for altering predefined dashboard content. Options B and C imply direct editing of the original dashboard, which is not the expected process for built-in dashboards. Option D is incorrect because exporting is used for portability or backup, not live customization. Reference topic: Objective 4.10 – Creating Custom Dashboards, Views and Reports in VCF Operations / predefined dashboards / clone and customize dashboard workflow .

Payment Card Industry Data Security Standard, PCI DSS, Compliance Standards

Defense Information Systems Agency, DISA, Security Standards

Center for Internet Security, CIS, Security Standards

The supported benchmarks from the provided list are PCI DSS , DISA , and CIS . VCF Operations compliance monitoring is accessed from Security > Compliance , where compliance scorecards are based on alert definitions with the Compliance subtype. The official VCF 9.0 documentation states that Regulatory Benchmarks display benchmarks for industry-standard regulatory compliance requirements and explicitly lists Defense Information Systems Agency (DISA) Security Standards , Payment Card Industry Data Security Standard (PCI DSS) Compliance Standards , and CIS Security Standards as supported regulatory benchmark options. DISA is available as a native pack, PCI DSS is listed as a regulatory compliance standard, and CIS is supported through a compliance pack from VMware Marketplace . FedRAMP and GDPR are not listed in the VCF Operations regulatory benchmark set shown in the guide. NIST is supported only as specific NIST SP 800-171 and NIST SP 800-53 R5 packs, not as the generic “NIST CyberSecurity Framework Security Baseline Standards” option shown in the question . Reference topic: Objective 4.16 – Monitor Security, Compliance and Configuration / Compliance Benchmarks / Regulatory Benchmarks .

The administrator must change the custom group object type to Edge Transport Node . The tag criteria are already expressed correctly: nsx is the tag category and edge is the tag value. In VCF Operations custom groups, dynamic membership is calculated by matching the selected Object Type and the defined membership criteria. The documentation states that custom group membership criteria require selecting the object type first, then applying criteria such as metrics, relationships, properties, object name, or tag; VCF Operations then keeps dynamic group membership current based on those rules . The failure occurs because the objects that were tagged are NSX Edge nodes, while the group is filtering for Edge Cluster objects. NSX documentation identifies NSX Edge nodes as Edge Transport Nodes , and Edge nodes are configured and managed under System > Fabric > Nodes > Edge Transport Nodes . An Edge Cluster is a grouping construct and does not match the tagged edge-node objects. Changing the tag value to nsx:edge would incorrectly collapse category and value into one field. Reference topic: Objective 4.5 – VCF Policy / Custom Groups / Dynamic Tag-Based Membership .

The correct answer is SDDC Manager . In VCF 9.0 password management, VCF Operations can manage many component credentials from Fleet Management > Passwords , including update and remediate operations for supported accounts. However, SDDC Manager is a special case. The documentation lists the VCF Instance/domain components managed from the VCF Operations console as ESX , NSX Manager , vCenter , and SDDC Manager backup password only . The SDDC Manager root and vcf accounts are not updated through the VCF Operations UI password workflow. Instead, the documented SDDC Manager account table shows that the vcf and root accounts are manually managed by using the operating system, while only the backup account is updated or remediated by using the VCF Operations UI or API . By contrast, the vCenter root account, NSX Local Manager root account, and ESX root account are listed as accounts that can be updated or remediated using the VCF Operations UI or API . Reference topic: Objective 4.14 – Complete Fleet Management activities in VCF Operations / Password Management / component account lifecycle management .