3V0-12.26 Questions and Answers

The scenario maps directly to Availability, Manageability, and Recoverability , three of VMware ' s core AMPRS design qualities. VMware defines availability as the ability of a system to continue operating without interruption, recoverability as its ability to recover following failure or disaster, and manageability as how easily the environment can be deployed, configured, and controlled. ( VMware )

Recoverability (D) is central because the environment can enter a corrupted state and must be restored to a known reliable condition without damaging historical data. Recovery sequencing, backups, recovery points, and dependency-aware restoration therefore become critical design considerations.

Manageability (C) is required because restoration involves a complex and sensitive dependency chain. The design should reduce operational complexity through standardized procedures, automation, orchestration, configuration control, and repeatable recovery workflows. A recovery process that depends heavily on error-prone manual sequencing represents a manageability risk.

Availability (A) is required because stakeholders want some services to remain operational while the broader environment is being restored. The architecture therefore needs mechanisms that preserve service continuity or degraded-but-functional operation during recovery.

Performance and Scalability are not stated concerns. Security remains important generally, but the audit-data issue here concerns preserving recoverable state rather than an explicit confidentiality, access-control, or threat-protection requirement.

Study Guide References/Topics: AMPRS Design Qualities; Availability; Manageability; Recoverability; Business Continuity; Dependency-Aware Recovery; Operational Resilience.

B, C, and D represent the intended physical-design decisions for this requirement set.

B aligns with VCF network design because 10 GbE is an accepted baseline for ESX hosts , while moving to 25 GbE provides additional headroom for vSAN, NSX overlay, management, and future workload-domain traffic. Broadcom identifies 10-Gbps-or-faster NICs as a minimum hardware consideration for VCF hosts.

C aligns with the customer ' s preference for an all-flash architecture and future scalability. vSAN ESA uses a single-tier, high-performance storage model and is the appropriate architecture when designing new VCF infrastructure around modern flash/NVMe storage. The exact raw-capacity figure should always be validated against the selected storage policy, RAID scheme, FTT, operational reserve, and growth assumptions, but ESA is clearly preferable to the hybrid OSA design in F .

D provides sufficient compute and memory headroom for the management stack and anticipated growth. Management-domain sizing must consider not only current vCenter, NSX, SDDC Manager, and VCF services but also future lifecycle and operational services.

A is incorrect because VCF guidance recommends uniform host configurations within the management-domain cluster to ensure predictable performance and rebuild behavior. E is incorrect because a standard single-site vSAN-backed VCF Management Domain requires a minimum of four ESX hosts , not three.

Study Guide References/Topics: VCF Management Domain Physical Design; Host Sizing; vSAN ESA Design; Network Architecture and MTU; Management Domain Scalability; Uniform Host Configuration; Capacity and Growth Planning.

Functional requirements describe what the solution must accomplish or how it must behave , whereas non-functional requirements specify measurable qualities or operational characteristics such as performance, recoverability, security, and service levels. Broadcom ' s VCF architecture guidance explicitly distinguishes functional behavior from non-functional characteristics such as performance, scalability, and resilience. ( VMware Blogs )

A is functional because the platform must interact with the corporate password vault to store and retrieve service-account credentials. B specifies required identity functionality: authentication must integrate with an external SAML identity provider. C specifies required application behavior during a site failure—the applications must continue to tolerate loss of one data center. E is a clear user-facing function requiring users to view and track request progress.

By contrast, D specifies a security-assurance/testing target rather than platform functionality. F defines a measurable recoverability characteristic through a 10-minute RTO. G specifies a measurable SLO over a 12-month period and is therefore non-functional.

The VCF Architect exam guide specifically requires architects to distinguish business/technical requirements and relate solution requirements to AMPRS design qualities. ( Broadcom Docs )

Study Guide References/Topics: Conceptual Design; Functional vs. Non-Functional Requirements; Requirements Classification; AMPRS Design Qualities; Identity Integration; Availability and Recoverability Requirements.

A and E best satisfy the multi-instance scale requirement while keeping the identity-management footprint as small as possible.

A VCF Identity Broker should be associated with the management infrastructure , not deployed independently in workload domains. Broadcom documentation shows VCF Identity Broker as part of the VCF management-plane architecture and identifies the management domain as the normal installation location for the identity service. ( VMware Blogs )

The scale requirement determines the number of Identity Broker deployments. Broadcom states that an external/appliance VCF Identity Broker is intended for multi-instance fleets and is recommended to support up to five VCF instances . ( VMware Blogs ) With seven VCF instances , one broker would exceed that recommended scale boundary, while seven embedded brokers would create unnecessary compute footprint and operational overhead. The minimum practical topology is therefore two VCF Identity Broker deployments , distributed through the VCF Management Services architecture.

VCF 9.1 further integrates identity services with the broader VCF Management Services platform, and Broadcom requires the Identity Broker to reside on the same management network as those services.

B is incorrect because workload domains are not the preferred hosting boundary for centralized fleet identity. C creates the largest footprint. D is insufficient by itself because a single Identity Broker does not meet the recommended scale for seven VCF instances.

Study Guide References/Topics: VCF Identity Broker; Fleet-Level SSO; VCF Management Services; Management Domain Placement; Multi-Instance Identity Design; Identity Broker Scale and Footprint.

D is correct. VMware Cloud Foundation 9 uses VCF Identity Broker as the SSO provider, and it supports two deployment modes: Embedded and Appliance . The appliance deployment is specifically intended for environments requiring greater availability or where VCF components cannot reliably reach the management-domain vCenter.

The Embedded Mode runs the Identity Broker inside the management-domain vCenter. Although this minimizes infrastructure footprint, it ties authentication availability to that vCenter. This conflicts directly with the requirement that some VCF components cannot access the management-domain vCenter. Broadcom ' s design guidance explicitly identifies this condition as a reason to choose the appliance deployment model. ( VMware Blogs )

The Appliance Mode deploys VCF Identity Broker as an external, resilient cluster. Broadcom describes the appliance implementation as a three-node Identity Broker cluster , providing resiliency and allowing authentication services to survive failure of a single Identity Broker node. It can also provide identity services independently of the management-domain vCenter ' s availability. ( VMware Blogs )

Because three nodes are the minimum appliance topology needed to satisfy the stated single-node-failure requirement, this also meets the requirement to deploy the fewest nodes possible while retaining resiliency .

Options A and C are incorrect because VCF LDAP Services is not the VCF 9 SSO provider deployment model. B lacks the required independence and node-level resiliency.

Study Guide References/Topics: VCF Single Sign-On; VCF Identity Broker Deployment Models; Embedded vs Appliance Mode; Identity Broker High Availability; Management Domain Dependency; Identity and Access Architecture.

B is correct. vSphere Lifecycle Manager provides image-based lifecycle management at the cluster level , defining the required ESX version, vendor add-ons, firmware/driver add-ons, and additional components. Because the Management Domain and Workload Domain have different hardware/lifecycle characteristics—particularly the presence of DPUs in the WLD—separate composite image configurations provide the required hardware-specific desired state. Current VCF 9.x also supports heterogeneous hardware through composite images containing additional image definitions, allowing different server generations to receive appropriate vendor drivers and firmware while maintaining a common ESX base version. ( VMware Blogs )

The DPU constraint is decisive. For a DPU-backed cluster, VMware requires the participating hosts to use DPUs from the same vendor and model ; a DPU-backed cluster cannot simply mix arbitrary DPU models. Broadcom also documents that a cluster retains an association with its DPU vendor and rejects hosts using an incompatible DPU vendor.

C is incorrect because baseline-based lifecycle management is deprecated and VCF 9 requires image-based lifecycle management. A incorrectly permits different DPU models, while D unnecessarily specifies two independent WLD images rather than using the composite-image mechanism designed to accommodate hardware variations.

Study Guide References/Topics: vSphere Lifecycle Manager Images; VCF Composite Images; Hardware Support Managers; Heterogeneous Host Clusters; DPU/Distributed Services Engine Requirements; NSX and vSAN ESA Lifecycle Management.

The appropriate blueprint is VCF Fleet in a Single Site . This model is designed for organizations operating a primary data center in a single availability zone while still requiring enterprise-grade high availability. The architecture supports a multi-rack deployment , allowing hosts and infrastructure components to be distributed across racks to reduce the impact of rack-level failures. It also explicitly relies on vSphere HA for fault detection and automated VM recovery , supplemented by application-level clustering for critical management and control-plane services. ( VMware TechDocs )

This differs from the minimal-footprint single-site blueprint , which prioritizes lower resource consumption and consolidation. Because the scenario explicitly states that resource consumption is not a concern, the standard single-site blueprint is the better architectural match.

A introduces multiple sites and stretched-cluster requirements that are not specified. C adds both a stretched primary region and additional regions, introducing unnecessary complexity. D is intended for geographically distributed, multi-region environments and is likewise beyond the stated requirements. Current VCF design guidance distinguishes the standard single-site blueprint as the production model for high availability within one site , including multi-rack architecture and vSphere HA. ( VMware TechDocs )

Study Guide References/Topics: VCF Design Blueprints; VCF Fleet in a Single Site; Multi-Rack Architecture; vSphere HA; Management Domain Availability; Single-Site Production Design.

A Super Metric is the appropriate VCF Operations mechanism when an architect needs to derive a new metric by mathematically combining existing metrics. Broadcom documents Super Metrics as custom metrics created from formulas referencing one or more collected metrics. For this requirement, the architect can define a VM-level Super Metric representing:

Utilization = (CPU Usage % + Network Usage %) / 2

VCF Operations can then evaluate that resulting Super Metric against a threshold through an Alert Definition . Alert definitions are specifically used to identify conditions on monitored objects and generate alerts when the configured symptoms or metric conditions become true. Broadcom ' s current VCF Operations API separately exposes creation and management functions for both Super Metrics and Alert Definitions , reflecting these distinct functions. ( Broadcom Developer )

Therefore, C is correct : create the calculated utilization value as a Super Metric and use it as the condition for an Alert Definition.

A is incorrect because a Notification Definition controls how an existing alert is delivered; it does not perform the monitoring logic itself. B has the same notification-versus-alert problem. D is not the appropriate mechanism for this custom cross-metric formula; Super Metrics are specifically designed to create formula-based derived metrics. Broadcom documentation also demonstrates Super Metrics being created through formulas referencing existing metric keys.

Study Guide References/Topics: VCF Operations; Super Metrics; Custom Metric Formulas; Alert Definitions; Symptom Definitions; Notifications and Outbound Alerting.

A and D are requirements because they describe capabilities or outcomes that the completed architecture must deliver . VMware ' s architectural methodology distinguishes requirements from constraints, assumptions, and risks, and the current VCF Architect exam specifically expects architects to identify and document these categories independently. ( Broadcom Docs )

A defines an availability requirement: the architecture must provide a resilient multi-site topology . This states the desired behavior of the solution rather than prescribing a particular implementation technology.

D is also a requirement because it establishes a specific, measurable scalability target—20% growth over three years . It directly influences capacity planning and the logical and physical architecture.

B represents a risk/finding . An existing network single point of failure could adversely affect availability and should be documented and mitigated.

C is a constraint , because mandatory reuse of the existing storage array restricts the architect ' s available design choices. VMware defines constraints as limiting factors that affect or restrict a design. ( VMware )

E is an assumption or discovered condition regarding available storage capacity. It should be validated before relying on it for sizing because assumptions used in design decisions must be confirmed.

Study Guide References/Topics: Conceptual Design; Business and Technical Requirements; Requirements, Constraints, Assumptions and Risks; AMPRS; Capacity and Scalability Planning.

Recoverability requires independent, restorable recovery points plus controlled lifecycle procedures that can recover VCF after component, site, or upgrade failure. A directly addresses this requirement because VCF Operations requires VM-level/image-based protection for disaster recovery, while VCF Operations for Networks supports full backup and restoration of its platform and collector nodes. Keeping these backups offsite prevents a regional outage from destroying both production and recovery copies. Broadcom specifically documents image-based protection for VCF Operations and backup/restore procedures for Operations for Networks.

B addresses the post-upgrade-failure scenario. VCF lifecycle prechecks verify component health, backup readiness, compatibility, and the supported upgrade path before changes occur; postchecks validate component state after lifecycle operations. Broadcom explicitly requires valid, recent backups for recoverability before infrastructure updates and recommends confirming supported upgrade paths and completing upgrade prechecks.

D is fundamental to instance-level disaster recovery. VCF documentation states that backup storage should reside in a different fault domain from the protected environment. External, replicated storage therefore protects SDDC Manager, NSX, vCenter, and automation state against management-domain or regional loss. ( Broadcom Developer )

C is not a supported NSX recovery strategy; appliance clones can introduce state and identity consistency problems. E unnecessarily fragments recovery data and does not inherently provide regional resilience. F provides availability against VM/host failure, but HA is not a backup or disaster-recovery mechanism and cannot recover destroyed configuration state or an entire VCF instance.

Study Guide References/Topics: VCF AMPRS Considerations – Designing for Recoverability; Management Domain – Platform-Based Protection Mechanisms; VCF Upgrade Considerations; Day 2 Operations; Backup and Restore of VMware Cloud Foundation. ( globalknowledge.com )

B addresses the network-isolation requirement by keeping security-policy enforcement within the individual VPC boundary . VMware VPCs are designed as isolated networking and security domains in which tenant administrators can maintain VPC-specific firewall and networking policies. NSX VPC security provides distributed firewalling and microsegmentation close to workload interfaces, allowing east-west traffic to be restricted without depending on a shared tenant security object. Broadcom describes VPC administrators ' network and security policies as contained within their VPC and not affecting other VPCs. ( VMware Blogs )

C addresses identity isolation. VCF Automation organizations provide independent administrative and access-control boundaries, and each organization can configure its Identity Provider connection and organization-specific users/groups . This enables API consumers to authenticate within the appropriate organizational identity scope instead of sharing credentials or tenant identities.

A introduces shared provider-managed security constructs, conflicting with the no-shared-security-objects requirement. D concerns IP-address efficiency rather than zero-trust enforcement. E introduces shared routing infrastructure and depends on route filtering rather than enforcing isolation directly at each VPC boundary.

Study Guide References/Topics: VCF VPC Security Architecture; VPC Isolation; Distributed Firewall and Microsegmentation; VCF Automation Organizations; IAM and Identity Provider Integration; Zero-Trust Tenant Design.

C is the best match because this blueprint combines metro-style availability inside the primary region with disaster recovery into an additional region .

Within the primary region, two sites can use stretched vSphere/vSAN clusters . Current VCF design guidance specifies that stretched designs require high-bandwidth connectivity and less than 5 ms RTT between the data availability zones. This enables synchronous storage replication, which is the architectural mechanism required to achieve RPO 0 for Tier-1 and Tier-2 workloads. Broadcom also documents that stretched-cluster designs can provide zero RPO because data is synchronously maintained across sites.

The additional data center can then operate as a separate regional VCF instance within the same Fleet. This provides geographic separation for regional disaster recovery and supports the stated 24-hour RTO , while avoiding the operational complexity of stretching every site across every region.

A pure single-region multi-site design does not adequately address complete regional failure. Conversely, a generic multi-region design does not inherently provide the synchronous stretched-cluster architecture required for the Tier-1/Tier-2 zero-RPO requirement.

The VCF blueprint specifically described as “Multiple Sites in a Single Region plus Additional Region(s)” combines a stretched primary region with one or more standard remote regions. ( VMware TechDocs )

Study Guide References/Topics: VCF Design Blueprints; Multi-Site Single-Region Architecture; Additional Region Design; vSAN Stretched Clusters; RPO/RTO Design; Regional Disaster Recovery; Data Sovereignty; Fleet-Level Operations.

The design must satisfy both monitoring capacity and single-node resiliency . C is correct because the solution already contains 10,000 virtual machines, and the requirement additionally includes monitoring guest operating systems and infrastructure components. A two-node Small configuration is unsuitable: the supplied sizing table limits a Small multi-node deployment to 12,000 objects and 2.8 million metrics , leaving insufficient practical headroom once guest OS and infrastructure monitoring objects are included. Three Medium nodes provide substantially greater object and metric capacity and support future operational growth.

B is required because the logical design explicitly specifies the VCF Operations High Availability Model . Enabling VCF Operations HA provides application-level resilience by maintaining replicated analytics data so the Operations service can continue after failure of one cluster node.

A is also required because the VCF Operations nodes should be separated across ESX hosts. A DRS anti-affinity rule prevents multiple Operations nodes from running on the same physical host, ensuring that a single ESX host failure cannot simultaneously remove multiple Operations nodes.

D lacks adequate capacity and resilience headroom. E would intentionally colocate nodes and create a common failure domain. F is unnecessary because VCF Operations provides its own supported application-level HA mechanism.

Study Guide References/Topics: VCF Operations Sizing Guide; High Availability Model; Analytics Cluster Design; VCF Operations Node Sizing; vSphere DRS Anti-Affinity; Single-Node Failure Resilience.