Free Practice Questions for VMware 3V0-23.25 Exam

The failure is host-specific because the KMS is online and reachable from the other hosts, and those hosts remain healthy with encryption enabled. In vSAN Data-at-Rest Encryption, vCenter works with the external KMS to manage the Key Encryption Key (KEK). ESX hosts use the KEK to unlock the Data Encryption Keys that protect encrypted vSAN disk data. When a host reboots, it must retrieve the required encryption key before encrypted vSAN disk groups can be mounted. If the host’s trust relationship, certificate, or KMS identity relationship is invalid or missing, that host cannot retrieve the key, and its encrypted disk groups remain unmounted. A Deep Rekey changes encryption material but does not repair a broken host-to-KMS trust relationship. Restarting vCenter is not the required fix because other hosts are functioning normally. TPM failure is not the best explanation because the error explicitly states that retrieval from the KMS failed. Reference topics: vSAN Data-at-Rest Encryption, External KMS Trust, Key Retrieval, Encrypted Disk Group Mounting.

Site A = Data Site; Site B = Witness Site; Site C = Data Site; Site A ↔ Site C = Layer 3, RTT < 5 ms; Site A ↔ Site B = Layer 3, RTT < 200 ms; Site B ↔ Site C = Layer 3, RTT < 200 ms

Site A and Site C should be the data sites because Site A hosts production services and Site C has been commissioned to replace the capacity-constrained Site B. Site B should be used as the witness site because it has no space for additional physical hosts, and a vSAN witness appliance does not run workload VMs. A vSAN Stretched Cluster requires two availability zones for data nodes and a third site for the witness appliance. The data-site-to-data-site connection carries synchronous vSAN data traffic and must meet less than 5 ms RTT. The witness site carries metadata traffic only, so the data-site-to-witness links support higher latency, with less than 200 ms RTT for up to 10 hosts per site. Because the requirement specifically calls out minimizing disruption from STP, Layer 3 is the preferred network type between sites. VMware states that Layer 3 helps avoid STP redirecting traffic across undesirable links, such as constrained witness links. Reference topics: vSAN Stretched Cluster Network Design, Data Site and Witness Site Placement, Layer 3 Recommendation, RTT Requirements.

The readings indicate a write-path pressure condition rather than a read-cache, network, or device-health issue. In vSAN ESA, storage devices are organized into a storage pool architecture where NVMe devices contribute both capacity and performance. The dashboard shows low read latency and normal network throughput, so the read path and vSAN network are not the likely bottlenecks. Disk Group Health being green also rules out an obvious device or pool-health failure. AI inferencing environments can still create bursts of small random writes from logs, metadata updates, temporary files, checkpoints, and application-side write activity. When backend write latency rises while reads remain low, the most likely explanation is transient write-buffer or commit-queue pressure. ESA does not use the traditional OSA read-cache tier model, so option B is incorrect. ESA also does not rely on OSA-style inline deduplication and compression behavior for the stated cause, making option C incorrect. Normal network throughput makes option D unlikely. Reference topics: vSAN ESA Architecture, Storage Pool Metrics, Backend Write Latency, VCF Operations Storage Performance.

Windows Server Failover Cluster shared disks require coordinated access to shared block storage. vSAN supports Windows Server Failover Clusters by providing SCSI-3 Persistent Reservation support at the virtual disk level, which allows cluster nodes to arbitrate access to a shared disk resource. One supported approach is to use the vSAN iSCSI Target Service, which presents vSAN-backed LUNs to initiators and can be used for clustered workloads that require shared block access. Another supported approach is to configure a shared virtual disk using a VMware Paravirtual SCSI controller with physical bus sharing. Physical bus sharing allows multiple VMs to access the same shared virtual disk in a WSFC configuration where supported. Raw Device Mapping is not the vSAN ESA-native solution for this requirement. NFS v4.1 is a file datastore protocol, not a WSFC shared block disk mechanism. “LSI SCSI controller per disk” does not satisfy the required shared-disk bus sharing configuration. Reference topics: vSAN Support for Windows Server Failover Clusters, SCSI-3 Persistent Reservations, vSAN iSCSI Target Service, Shared VMDK Configuration.

The workload domain should use Fibre Channel as principal storage because the existing five hosts already have resilient HBAs and are connected to a dedicated, highly resilient storage area network. The third-party block storage is also stated to have sufficient scale, capacity, and IOPS for the new workload requirements only, so it should be reused where it directly fits: the VI workload domain. VMware Cloud Foundation supports Fibre Channel as both principal and supplemental storage for VI workload domains. The management domain should use VMware vSAN as principal storage because the four new servers are being purchased for the management domain, and the existing block storage is not sized for management workloads. vSAN is a native VCF principal storage model for management domains and provides automated deployment, policy-based management, lifecycle integration, and integrated operations. iSCSI is not the right answer because the scenario describes Fibre Channel SAN connectivity and HBAs, not an iSCSI design. vSAN for the workload domain would also fail the reuse requirement because it would ignore the existing block storage investment. Reference topics: Principal Storage, Fibre Channel Storage Model, vSAN Storage Model, Management Domain Storage.

In vSAN Original Storage Architecture, a disk group consists of one flash cache device and one or more capacity devices. The cache device is a required component of the disk group, so a failed cache device cannot be replaced as an isolated drive while preserving the same disk group. The supported operational approach is to remove the affected disk group, physically replace the failed cache device, verify that ESX detects the new device, and then manually recreate the disk group using the replacement cache device and the appropriate capacity devices. The scenario states that vSAN has already completed resynchronization and that all objects are healthy and compliant, so removing the failed disk group no longer risks object noncompliance. Selecting Full Data Migration on a failed cache device is not the correct workflow because the cache failure affects the entire disk group. Simply inserting a replacement drive does not cause vSAN OSA to automatically rebuild the disk group. Reference topics: vSAN OSA Disk Groups, Replace a Cache Device, Remove Disk Group, Recreate Disk Group.

The Live! vSphere Heavy Hitter VM dashboard is the correct place to identify which virtual machines are driving storage IOPS and disk throughput problems. In VCF Operations, heavy hitter dashboards are designed to isolate the consumers creating the highest demand on shared infrastructure resources. For storage troubleshooting, this dashboard identifies VMs producing significant I/O load, including IOPS and throughput. This is especially useful when a Fibre Channel datastore is reporting performance alerts because the datastore itself may show contention, but the root cause is often one or more high-demand VMs consuming disproportionate backend storage resources. The vSAN Health dashboard is not correct because the affected datastore is Fibre Channel, not vSAN. The vSphere Storage Inventory dashboard is useful for topology and inventory visibility, but it is not the best view for identifying the VM-level consumers causing IOPS and throughput pressure. The Storage Operations page is broader and less targeted than the Live heavy hitter view. Reference topics: VCF Operations Performance Dashboards, Storage Heavy Hitters, VM IOPS and Throughput Troubleshooting.

The correct steps are to create an NFS export on the storage array and mount the NFS datastore on each ESX host in the cluster. NFS datastore creation begins on the storage system, where the storage administrator creates and exports the NFS volume or directory with the required access permissions for the ESX hosts. After the export exists, vSphere mounts that export as a datastore. For a clustered VCF workload domain, the datastore must be mounted consistently across all ESX hosts in the cluster so that HA, DRS, vMotion, and VM placement can operate correctly. Mounting the datastore on only one host would create inconsistent datastore accessibility and could prevent workloads from moving or restarting on other hosts. “Attach NFS as a secondary datastore” is not the correct procedural step; the datastore is created and mounted as a vSphere datastore. Configuring vSAN is irrelevant because the workload domain already uses NFS storage and the task is to add another NFS datastore. Reference topics: NFS Datastore Creation, NFS Export, Host Accessibility, VCF Workload Domain Storage Administration.

Run the Python reboot helper script only on one ESXi host to recover the cluster.

Enable cluster member updates from vCenter Server on all ESXi hosts.

Exit all hosts from maintenance mode.

During a manual vSAN cluster restart after a planned outage, the hosts must first be brought back and exited from maintenance mode so the cluster can begin recovery. The vSAN reboot helper recovery script must then be run on only one ESXi host. Running the script on multiple hosts can create race conditions and unexpected cluster state. After the recovery script completes, cluster member updates from vCenter Server must be enabled on all ESXi hosts so that normal membership updates resume across the cluster. Enabling updates on only one host is incomplete because all hosts must return to normal cluster-member update behavior. Running the Python reboot helper script on all ESXi hosts is explicitly incorrect because the recovery operation must be initiated from a single host only. Disabling cluster member updates is a shutdown-side activity, not the required restart-side recovery action in this question. Reference topics: Manual vSAN Cluster Restart, Reboot Helper Script, Maintenance Mode Exit, Cluster Member Updates.

The user account used by the application.

The Active Directory used by the application.

The password used by the application.

NFSv4.1 with Kerberos requires identity integration through Active Directory and a valid Kerberos-capable user credential. In vSphere, Kerberos authentication for NFS 4.1 uses Active Directory credentials so ESX can authenticate securely when mounting Kerberos-protected NFS datastores. The required inputs are the Active Directory domain, the user account, and the password associated with that account. The storage guide also states that when several ESX hosts access the same NFS 4.1 datastore, all hosts must use the same Active Directory credentials to ensure consistent access. The Organizational Unit is not the required credential element for datastore mounting. The DNS name of a Kerberos server may be resolved through Active Directory and DNS infrastructure, but it is not one of the required configuration values selected here. A “Kerberos Key Management Server” is not part of the vSphere NFSv4.1 Kerberos datastore configuration model. Therefore, the required options are the application’s user account, its Active Directory, and the account password. Reference topics: NFSv4.1 Datastores, Kerberos Authentication, Active Directory Credentials, Kerberos Security for NFS.