A and E best satisfy the multi-instance scale requirement while keeping the identity-management footprint as small as possible.

A VCF Identity Broker should be associated with the management infrastructure , not deployed independently in workload domains. Broadcom documentation shows VCF Identity Broker as part of the VCF management-plane architecture and identifies the management domain as the normal installation location for the identity service. ( VMware Blogs )

The scale requirement determines the number of Identity Broker deployments. Broadcom states that an external/appliance VCF Identity Broker is intended for multi-instance fleets and is recommended to support up to five VCF instances . ( VMware Blogs ) With seven VCF instances , one broker would exceed that recommended scale boundary, while seven embedded brokers would create unnecessary compute footprint and operational overhead. The minimum practical topology is therefore two VCF Identity Broker deployments , distributed through the VCF Management Services architecture.

VCF 9.1 further integrates identity services with the broader VCF Management Services platform, and Broadcom requires the Identity Broker to reside on the same management network as those services.

B is incorrect because workload domains are not the preferred hosting boundary for centralized fleet identity. C creates the largest footprint. D is insufficient by itself because a single Identity Broker does not meet the recommended scale for seven VCF instances.

Study Guide References/Topics: VCF Identity Broker; Fleet-Level SSO; VCF Management Services; Management Domain Placement; Multi-Instance Identity Design; Identity Broker Scale and Footprint.

C and D are the primary factors that directly determine the required vSAN storage capacity and its performance/redundancy characteristics.

C is correct because the selected vSAN storage policy determines how VM objects are placed and how much physical capacity they consume. Broadcom documents that Failures to Tolerate (FTT) controls redundancy, while the RAID method determines capacity efficiency and performance. For example, RAID-1 with FTT=1 creates mirrored data and consumes approximately 2× the logical data size, while FTT=2 mirroring consumes approximately 3× . Stripe width can also affect performance and component consumption.

D is correct because workload quantity and sizing establish the fundamental storage demand. The proposed 725 VMs (475 + 250) at an average 275 GB each represent approximately 199.4 TB of logical VM disk capacity before applying redundancy, metadata, operational reserve, and growth allowances. Storage policies then multiply or otherwise alter that physical-capacity requirement.

E affects cluster architecture and determines whether certain policies can be supported—for example, RAID-6 FTT=2 requires at least six hosts—but with 15 hosts already specified , host count is not the principal sizing factor among the choices. A concerns management-network redundancy, while B addresses workload networking rather than vSAN capacity design.

Study Guide References/Topics: vSAN Storage Policy-Based Management; Failures to Tolerate; RAID-1/5/6; Stripe Width; Workload Profiling; Storage Capacity Planning; VCF Workload Domain Storage Design.

B is correct. The principal architectural advantage of a Distributed Transit Gateway (DTGW) is that it provides external VPC connectivity directly from the ESX hosts to the physical network , without requiring NSX Edge VMs or a Tier-0 gateway. In the distributed connectivity model, the Transit Gateway maps directly to an external VLAN shared by the participating ESX hosts . This reduces infrastructure footprint, removes an additional forwarding hop, and accelerates VPC onboarding. ( VMware Blogs )

For workloads requiring external connectivity, addresses can be allocated from the VPC ' s external IP block associated with that VLAN. The distributed gateway then forwards traffic between the VPC and physical network without forcing traffic through centralized Edge appliances. VCF 9.x specifically positions DTGW as the simpler model when customers need basic connectivity and do not require the complete centralized network-services stack. ( VMware Blogs )

A is incorrect because DTGW intentionally eliminates the NSX Edge cluster and therefore does not depend on static routing policies configured there. C is incorrect because centralized stateful services—particularly VPN—are characteristic of the centralized Transit Gateway model; VPN remains exclusive to centralized connectivity. D is incorrect because DTGW does not instantiate distributed Tier-0 service routers in an Active/Active Edge topology. Its northbound connectivity is directly to the physical VLAN.

Study Guide References/Topics: VCF VPC Networking; Distributed Transit Gateway; Distributed External Connectivity; Edgeless Networking; External VLAN Connectivity; VPC External IP Blocks; Centralized vs. Distributed Transit Gateway Design.

B is correct. In a multi-zone VKS design, the architect should explicitly map vSphere Zones to Kubernetes failure domains within the NodePools so that cluster nodes are distributed across independent infrastructure fault domains. This provides resilience against an entire underlying vSphere cluster or zone becoming unavailable.

Current Broadcom guidance for VKS multi-zone configurations confirms that a Node Pool can have an explicit failureDomain defined. In multi-zone environments, this allows the VKS topology controller to deterministically place nodes and their associated storage in the intended availability zone. Broadcom specifically documents explicit failure-domain configuration as the mechanism for controlling Node Pool placement in a multi-zone topology.

A is incorrect because worker nodes should not be assumed to be automatically balanced across independent vSphere Zones in a way that guarantees the required cluster-level failure tolerance.

C provides recovery from individual VM or ESXi host failure within an available vSphere cluster, but it cannot restart nodes when the entire underlying cluster or zone is offline.

D relates to Kubernetes service exposure and networking and has no bearing on failure-domain placement or infrastructure availability.

By explicitly assigning NodePools to separate failure domains, the design ensures surviving nodes remain available across the other zones after loss of one vSphere cluster.

Study Guide References/Topics: vSphere Kubernetes Service; VKS Multi-Zone Architecture; vSphere Zones; NodePools; Failure Domains; Cluster API Topology; Kubernetes High Availability.

VMware vDefend Firewall is the VCF Advanced Service that directly satisfies the stated security requirements. VMware positions vDefend as the advanced lateral-security capability for VCF, providing zero-trust controls, distributed firewalling, workload-level microsegmentation, and protection against lateral movement . ( VMware Blogs )

The decisive requirement is the combination of macro-segmentation and microsegmentation with repeatable prescriptive guidance . Broadcom ' s Lateral Security for VMware Cloud Foundation with VMware vDefend Validated Solution specifically documents design decisions for securing VCF management-domain components and provides streamlined guidance for implementing both macro- and microsegmentation for workloads in workload domains. It is designed as a repeatable implementation pattern that can be applied consistently across VCF environments. ( VMware Blogs )

vDefend ' s Distributed Firewall operates close to each workload ' s virtual network interface, enabling granular east-west policy enforcement independent of the traditional physical network perimeter. This is fundamental to a zero-trust architecture because communication is explicitly controlled between applications, VMs, containers, and infrastructure services rather than implicitly trusted based on network location. ( VMware Blogs )

A primarily provides load balancing and application delivery. C addresses backup, disaster recovery, and cyber recovery. D does not provide the required lateral firewall and segmentation capabilities.

Study Guide References/Topics: VCF Advanced Services; VMware vDefend; Lateral Security; Zero Trust; Distributed Firewall; Macro-Segmentation; Microsegmentation; VMware Validated Solutions.

D is correct. A dedicated Supervisor Cluster for each tenant establishes the strongest infrastructure and Kubernetes control-plane isolation. Each Supervisor has its own Kubernetes control plane and underlying vSphere infrastructure boundary, avoiding the shared control-plane dependency that would exist if multiple tenants used namespaces on the same Supervisor.

This design also addresses the requirement for independent failure domains . A Supervisor deployed on separate workload-domain infrastructure can be associated with distinct vSphere clusters, networking, storage, and lifecycle boundaries. Consequently, failure or maintenance affecting one tenant ' s Supervisor does not inherently affect another tenant ' s Kubernetes control plane.

The independent-upgrade requirement is also significant. Broadcom documents Supervisor and VKS lifecycle operations at the Supervisor level , including compatibility validation between the Supervisor, VKS service, and workload-cluster Kubernetes releases. VKS service upgrades are activated on the relevant Supervisor, reinforcing the Supervisor as an important lifecycle boundary.

A and B are useful security controls but do not isolate Kubernetes control planes or infrastructure failure domains. C provides namespace-level tenancy, but all namespaces still depend on the same Supervisor control plane and its lifecycle , so it cannot satisfy the stated isolation and independent-upgrade requirements.

Study Guide References/Topics: VCF VKS Architecture; Supervisor Clusters; Workload Domains; Tenant Isolation; Kubernetes Control-Plane Isolation; Failure Domains; Supervisor and VKS Lifecycle Management.

C is the best match because this blueprint combines metro-style availability inside the primary region with disaster recovery into an additional region .

Within the primary region, two sites can use stretched vSphere/vSAN clusters . Current VCF design guidance specifies that stretched designs require high-bandwidth connectivity and less than 5 ms RTT between the data availability zones. This enables synchronous storage replication, which is the architectural mechanism required to achieve RPO 0 for Tier-1 and Tier-2 workloads. Broadcom also documents that stretched-cluster designs can provide zero RPO because data is synchronously maintained across sites.

The additional data center can then operate as a separate regional VCF instance within the same Fleet. This provides geographic separation for regional disaster recovery and supports the stated 24-hour RTO , while avoiding the operational complexity of stretching every site across every region.

A pure single-region multi-site design does not adequately address complete regional failure. Conversely, a generic multi-region design does not inherently provide the synchronous stretched-cluster architecture required for the Tier-1/Tier-2 zero-RPO requirement.

The VCF blueprint specifically described as “Multiple Sites in a Single Region plus Additional Region(s)” combines a stretched primary region with one or more standard remote regions. ( VMware TechDocs )

Study Guide References/Topics: VCF Design Blueprints; Multi-Site Single-Region Architecture; Additional Region Design; vSAN Stretched Clusters; RPO/RTO Design; Regional Disaster Recovery; Data Sovereignty; Fleet-Level Operations.

A, D, and E meet the availability, sizing, and fault-domain requirements.

A is required because Continuous Availability (CA), rather than standard HA, provides fault-domain resilience. Broadcom states that VCF Operations CA stretches cluster nodes across two fault domains and can tolerate the loss of an entire fault domain without cluster downtime. Standard VCF Operations HA protects only against one node failure , so C does not satisfy the stated requirement for a single fault domain failure. CA requires equal node distribution across the two fault domains and a witness in a third location.

E is correct because 15,000 VMs plus all monitored infrastructure objects exceed the practical capacity of the Small configuration. Two Small nodes support only 12,000 maximum cluster objects before CA replication considerations . Four Medium nodes provide sufficient capacity and can be distributed as two analytics nodes per fault domain. Broadcom also notes that CA replication effectively reduces available object capacity compared with a non-CA deployment.

D ensures Operations analytics nodes are separated across physical hosts rather than sharing a common failure point. Broadcom specifically recommends DRS anti-affinity to keep Operations nodes on separate hosts.

Study Guide References/Topics: VCF Operations Sizing; Continuous Availability; Fault Domains; Analytics Node Placement; DRS Anti-Affinity; High Availability versus Continuous Availability.

Recoverability requires independent, restorable recovery points plus controlled lifecycle procedures that can recover VCF after component, site, or upgrade failure. A directly addresses this requirement because VCF Operations requires VM-level/image-based protection for disaster recovery, while VCF Operations for Networks supports full backup and restoration of its platform and collector nodes. Keeping these backups offsite prevents a regional outage from destroying both production and recovery copies. Broadcom specifically documents image-based protection for VCF Operations and backup/restore procedures for Operations for Networks.

B addresses the post-upgrade-failure scenario. VCF lifecycle prechecks verify component health, backup readiness, compatibility, and the supported upgrade path before changes occur; postchecks validate component state after lifecycle operations. Broadcom explicitly requires valid, recent backups for recoverability before infrastructure updates and recommends confirming supported upgrade paths and completing upgrade prechecks.

D is fundamental to instance-level disaster recovery. VCF documentation states that backup storage should reside in a different fault domain from the protected environment. External, replicated storage therefore protects SDDC Manager, NSX, vCenter, and automation state against management-domain or regional loss. ( Broadcom Developer )

C is not a supported NSX recovery strategy; appliance clones can introduce state and identity consistency problems. E unnecessarily fragments recovery data and does not inherently provide regional resilience. F provides availability against VM/host failure, but HA is not a backup or disaster-recovery mechanism and cannot recover destroyed configuration state or an entire VCF instance.

Study Guide References/Topics: VCF AMPRS Considerations – Designing for Recoverability; Management Domain – Platform-Based Protection Mechanisms; VCF Upgrade Considerations; Day 2 Operations; Backup and Restore of VMware Cloud Foundation. ( globalknowledge.com )

B is correct. A single VCF instance minimizes management-plane footprint while still allowing separate workload domains to provide dedicated hardware pools for each tenant or department. In VCF, each VCF instance contains one management domain , while additional workload domains can be created for different workload types and hardware requirements. Broadcom specifically describes workload domains as infrastructure boundaries that can contain host clusters configured to meet the requirements of a particular workload set. ( VMware Blogs )

This design maps cleanly to the requirements. The Analytics department can receive a workload domain built from GPU-capable hosts, allowing specialized accelerators to be dedicated to analytics and AI workloads. VMware guidance also uses separate VCF workload domains for GPU-enabled infrastructure because workload domains provide their own infrastructure and policies for these specialized workloads. ( VMware Blogs )

The Finance department can receive another workload domain backed by physically separate ESX hosts. That satisfies the requirement that financial workloads not share hardware with other departments.

Creating a separate VCF instance for every tenant, as proposed in C and D , would unnecessarily multiply management domains and management components, directly conflicting with the minimum-footprint requirement. A is architecturally invalid because a VCF instance has a single management domain, not one management domain per tenant, and a shared workload domain would not provide the required physical isolation.

Study Guide References/Topics: VCF Automation Tenant Design; VCF Instance Architecture; Management Domain; Workload Domains; Tenant Isolation; Dedicated Hardware Pools; GPU Workload Design.