5V0-31.22 VMware Cloud Foundation Specialist (v2) Free Practice Exam Questions (2025 Updated)

The next step the systems administrator should take is to prepare and configure the ESXi hosts to be used in the deployment. According to the VMware Cloud Foundation documentation1, before you can deploy the management domain using VMware Cloud Builder, you must prepare the ESXi hosts that will be part of the management domain and the VI workload domains. You need to install ESXi on the hosts, configure the network settings, claim disks for vSAN, and optionally configure certificates for the hosts. You can use different methods to prepare the ESXi hosts, such as using a custom ISO image, using the VMware Imaging Appliance, or installing ESXi interactively1

Uploading the Deployment Parameter Workbook is not the next step, because it is done after preparing the ESXi hosts. The Deployment Parameter Workbook is a spreadsheet that contains all the parameters required for deploying VMware Cloud Foundation, such as IP addresses, host names, passwords, and license keys. You need to download and complete the workbook before uploading it to VMware Cloud Builder1

Configuring the Management Domain using custom certificates is not the next step, because it is an optional step that can be done after deploying the management domain. Custom certificates are used to secure the communication between the components of VMware Cloud Foundation, such as SDDC Manager, vCenter Server, and NSX-T Manager. You can use either self-signed certificates or certificates signed by a certificate authority (CA)1

Deploying the Management Domain using VMware Cloud Builder is not the next step, because it is done after preparing the ESXi hosts and uploading the Deployment Parameter Workbook. The management domain is the first domain that is deployed in VMware Cloud Foundation, and it contains the components for managing and operating the SDDC platform, such as SDDC Manager, vCenter Server, NSX-T Manager, and NSX Edge nodes. You use VMware Cloud Builder to deploy the management domain by following a guided workflow on its UI1

At the Permissions setting, add the DevOps group and assign the “Editor” permission. This is the recommended way to grant the DevOps team permissions to a vSphere Namespace in a VMware Cloud Foundation (VCF) developer-ready workload domain while following the principle of least privilege access. According to the VMware Cloud Foundation documentation1, the Editor permission allows users to create, modify, and delete objects within a vSphere Namespace, such as vSphere Pods, Tanzu Kubernetes clusters, and stand-alone VMs. The Editor permission also allows users to view and manage storage policies, VM classes, and content libraries for the namespace1

B. At the Global Permissions setting, add the DevOps group and assign the vSphere Kubernetes Manager role is not a correct option, because it will grant more privileges than necessary to the DevOps team. The vSphere Kubernetes Manager role is a global role that allows users to manage all aspects of vSphere with Tanzu, such as enabling Workload Management on clusters, creating and configuring vSphere Namespaces, and managing storage policies and VM classes. This role should be assigned only to vSphere administrators who are responsible for configuring and maintaining the VCF developer-ready workload domain1

C. At the Global Permissions setting, add the DevOps group and assign the SupervisorService Cluster Operator role is not a correct option, because it will also grant more privileges than necessary to the DevOps team. The SupervisorService Cluster Operator role is a global role that allows users to manage all aspects of Supervisor Services on clusters, such as creating and configuring Supervisor Service namespaces, managing service accounts and roles, and deploying service instances. This role should be assigned only to vSphere administrators who are responsible for enabling and managing Supervisor Services on VCF developer-ready workload domains1

D. At the Permissions setting, add the DevOps group and assign the “Can edit” permission is not a correct option, because there is no such permission in vSphere with Tanzu. The available permissions for vSphere Namespaces are Viewer, Editor, and Admin. The Viewer permission allows users to view objects within a vSphere Namespace, but not create or modify them. The Admin permission allows users to perform all actions within a vSphere Namespace, as well as manage permissions for other users or groups1

References: 1: Configure vSphere Namespace Permissions for vCenter Single Sign-On Users or Groups - VMware Docs

This is because according to VMware documentation1, SDDC Manager is responsible for checking and downloading the online bundles for VCF upgrades from depot.vmware.com. The administrator can access SDDC Manager and download the bundles from Inventory > Workload Domains > MGMT > Update/Patches.

https://via.vmw.com/tchzcoreno28482843

According to About Architecture and Design for a vSphere with Tanzu Workload Domain4, two of the functionalities that a NSX Tier-0 Gateway provides to a vSphere with Tanzu deployment are:

Connectivity to all Tier-1 Gateways: A Tier-0 Gateway connects to one or more Tier-1 Gateways that provide routing services for each namespace in vSphere with Tanzu.

Connectivity to physical networks and routers: A Tier-0 Gateway connects to external networks via uplink interfaces that can use static routing or dynamic routing protocols such as BGP.

https://docs.vmware.com/en/VMware-vSphere/7.0/vmware-vsphere-with-tanzu/GUID-EC79A6DE-477A-40C1-A90C-9DF96465CDA6.html

This is because vSphere Lifecycle Manager images can include firmware updates and third-party software components that can be applied to all hosts in a cluster12. These options are only available when using vSphere Lifecycle Manager images, not when using vSphere Lifecycle Manager baselines2.

https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere-lifecycle-manager.doc/GUID-9A112231-AD7C-4EF5-AB6A-A8DAA704D307.html

https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere-lifecycle-manager.doc/GUID-9A20C2DA-F45F-4C9B-9D17-A89BCB62E6EF.html

These are valid use cases for multiple clusters in a workload domain according to VMware documentation. A workload domain with multiple availability zones each containing clusters can provide high availability and disaster recovery by distributing workloads across different physical locations within a region. A workload domain with multiple clusters in one rack can provide scalability and flexibility by allowing different configurations and policies for different clusters within a single logical unit. Two clusters forming one stretched workload domain can provide resiliency and fault tolerance by synchronizing data across two sites within a region.

erasure coding vSAN storage policy with the ability to tolerate two host failures requires at least six fault domains (hosts) in a cluster. Therefore, an 8-hosts cluster can meet this requirement for DEV/UAT workloads. Additionally, creating separate workload domains for DEV/UAT and DMZ can provide full management and network isolation between these two zones.

https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.virtualsan.doc/GUID-AD408FA8-5898-4541-9F82-FE72E6CD6227.html

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vsphere.vmc-aws-manage-data-center-vms.doc/GUID-EDBB551B-51B0-421B-9C44-6ECB66ED660B.html

This configuration will support two host failures by using RAID-6 (Erasure Coding), which creates two parity segments for each data segment. It will use the least amount of hosts among the options, because RAID-6 requires a minimum of six hosts for FTT=2. It will also minimize storage capacity usage, because RAID-6 uses less disk space than RAID-1 (Mirroring), which creates a full copy of each data segment12

A. 6 Hosts, FTT=2, RAID 1 is not a correct option, because it will not minimize storage capacity usage. RAID-1 will use more disk space than RAID-6, because it will create three copies of each data segment for FTT=212

C. 5 Hosts, FTT=2, RAID 5/6 is not a correct option, because it will not support two host failures. RAID-5 requires a minimum of four hosts for FTT=1, and RAID-6 requires a minimum of six hosts for FTT=2. With five hosts, neither RAID-5 nor RAID-6 can tolerate two host failures12

D. 5 Hosts, FTT=2, RAID 1 is not a correct option, because it will not support two host failures or minimize storage capacity usage. RAID-1 requires a minimum of five hosts for FTT=2, but it also requires an additional host as a witness to maintain quorum. Therefore, with five hosts, RAID-1 can only tolerate one host failure. Moreover, RAID-1 will use more disk space than RAID-6, because it will create three copies of each data segment for FTT=212

References: 1: Availability Attributes for vSAN VM Storage Policies - VMware Docs 2: Planning Capacity in vSAN - VMware Docs

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/com.vmware.vcf.vxrail.doc/GUID-E8D0A432-8573-4DF5-9330-A4FE15F74128.html

Prerequisites

A VI workload domain must be deployed.

An Workload Management ready NSX Edge cluster must be deployed on the workload domain.

You must select Workload Management on the Use Case page of the Add Edge Cluster wizard. See step 6 in Deploy an NSX Edge Cluster.

All hosts in the vSphere cluster for which you enable Workload Management must have a vSphere with Tanzu license.

Workload Management requires a vSphere cluster with a minimum of three ESXi hosts.

The following IP address subnets must be defined:

A non-routable subnet for pod networking, minimum of a /22 subnet.

A non-routable subnet for Service IP addresses, minimum of a /24 subnet

A routable subnet for ingress, minimum of a /27 subnet

A routable subnet for egress, minimum of a /27 subnet

This is because according to VMware documentation2, these are some of the components that are configured as part of the Supervisor Cluster control plane after enabling Workload Management on a VMware Cloud Foundation Workload Domain:

Tanzu Kubernetes Grid Service: This service enables you to create and manage Tanzu Kubernetes clusters on vSphere with Tanzu.

Kubernetes Grid Orchestrator: This component manages the lifecycle of Tanzu Kubernetes clusters on vSphere with Tanzu.

Spherelet: This component runs on each ESXi host and acts as a kubelet agent that communicates with the Supervisor Cluster control plane.

This is because according to VMware documentation1, the VMware Cloud Foundation Upgrade bundle upgrades the SDDC Manager appliance and Lifecycle Management, which are components of VMware Cloud Builder.

A quote from reference [1] states that, "To add permissions to users or groups from vCenter Single Sign-On identity sources, the Tanzu Kubernetes cluster administrator can use either the vSphere Client or kubectl."

Another quote from reference [1] states that, "By default, a Tanzu Kubernetes cluster includes a set of predefined roles that provides granular permission control for Kubernetes objects. The predefined roles enable cluster groups to be created with specific permissions across the Kubernetes namespace hierarchy. Administrators can also create custom roles to provide more granular permission control that is specific to their organization's requirements."

References: [1] Tanzu Kubernetes Cluster or Supervisor Cluster [1]: Which do I choose? - https://blogs.vmware.com/virtualblocks/2022/06/23/tanzu-kubernetes-cluster-or-supervisor-cluster-which-do-i-choose/

This is because according to VMware documentation34, vSphere with Tanzu uses storage policies to integrate with shared datastores available in your environment, including VMFS, NFS, vSAN, or vVols datastores. The storage policies represent datastores and manage the storage placement of such objects as persistent volumes (PVs). Storage Policy Based Management (SPBM) is a framework that provides a single unified control plane across different types of datastores and enables administrators to define policies based on storage capabilities and requirements5.

The Cloud Native Storage for vSphere with Tanzu workflow is as follows: 1. A developer deploys a pod using the kubectl CLI. 2. The vSphere with Tanzu Cloud Native Storage-Container Storage Interface (CNS-CSI) reads this request from the control plane API server. 3. CNS-CSI informs the vCenter Server CNS that a disk with gold storage class is required. 4. CNS interfaces with SPBM for a suitable datastore that satisfies the gold storage class (storage policy). 5. SPBM decides on a suitable datastore and interfaces with DRS for a suitable ESXi host. 6. Hostd on the ESXi host creates a first class disk (VMDK) on the datastore. 7. Spherelet on the ESXi host takes the VMDK. 8. Spherelet mounts the VMDK to the vSphere pod. 9. Spherelet reports the mount as a successful event to the control plane API server.

https://docs.vmware.com/en/VMware-vSphere/7.0/vmware-vsphere-with-tanzu/GUID-177C23C4-ED81-4ADD-89A2-61654C18201B.html#:~:text=be%20in%20a-,DNS%2Dcompliant,-format .

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/com.vmware.vcf.vxrail.doc/GUID-D6271E5A-05E9-4AE1-A3CE-87820DC3001B.html

https://docs.vmware.com/en/VMware-Cloud-Foundation/5.0/vcf-admin/GUID-80431626-B9CD-4F21-B681-A8F5024D2375.html

https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-F3A0A27E-88C0-4A64-8754-33CED93985D3.html

a valid procedure to replace an expired vSAN license in a VMware Cloud Foundation environment is Option A. You can add a new vSAN license to both the SDDC Manager and vCenter Server. Then reassign the vSAN license to the cluster in the vCenter Server 1. Finally, remove the expired vSAN license from both SDDC Manager and vCenter Server 2.

https://my-cloudy-world.com/2022/06/28/updating-a-vsan-license-in-vmware-cloud-foundation/