3V0-23.25 Advanced VMware Cloud Foundation 9.0 Storage Questions and Answers

In vSAN ESA, the observed three disk stripes are expected behavior for objects using RAID-1, even when the storage policy shows “Number of disk stripes per object = 1.” The vSAN policy rule defines the minimum number of capacity devices across which each replica of an object is striped, and the default value is 1. However, VMware documentation explicitly notes that objects in a vSAN ESA cluster with RAID-0 or RAID-1 configuration have 3 disk stripes, even if the default storage policy defines only 1 disk stripe. Therefore, the three stripes are not caused by site mirroring itself, nor by the VM having three objects. Site mirroring controls placement across the preferred and secondary sites in a stretched cluster, while Failures to tolerate with RAID-1 controls local host/device protection. The behavior is also not evidence that a VM-level policy override exists. The datastore-level policy can still be applied correctly; ESA’s internal RAID-1 object layout uses three stripes as part of its optimized storage architecture. Reference topics: vSAN ESA Default Storage Policy Characteristics, Number of Disk Stripes per Object, RAID-1 Mirroring, vSAN Stretched Cluster Storage Policies.

The required action is to deploy the VMware Live Recovery appliance. In VMware Cloud Foundation 9.0, vSAN Data Protection is powered by VMware Live Recovery and provides local virtual machine protection and remote virtual machine replication for supported vSAN ESA environments. The vSAN Services configuration workflow explicitly states that before vSAN Data Protection can be used, the VMware Live Recovery appliance must be deployed. This appliance provides the data protection control plane required for protection groups, native snapshots, recovery workflows, and replication-based protection. Enabling vSAN advanced options is not sufficient because those settings control cluster behaviors such as repair timers, read locality, thin swap, unmap, and rebalance. Data Services Manager is used for database/data-service lifecycle use cases, not vSAN VM data protection. vSphere Replication can be part of broader site-recovery scenarios, but it is not the required action to enable vSAN Data Protection from the vSAN services workflow. Reference topics: vSAN Data Protection, VMware Live Recovery Appliance, vSAN Services Configuration, Local VM Protection and Replication.

The Live! vSphere Heavy Hitter VM dashboard is the correct place to identify which virtual machines are driving storage IOPS and disk throughput problems. In VCF Operations, heavy hitter dashboards are designed to isolate the consumers creating the highest demand on shared infrastructure resources. For storage troubleshooting, this dashboard identifies VMs producing significant I/O load, including IOPS and throughput. This is especially useful when a Fibre Channel datastore is reporting performance alerts because the datastore itself may show contention, but the root cause is often one or more high-demand VMs consuming disproportionate backend storage resources. The vSAN Health dashboard is not correct because the affected datastore is Fibre Channel, not vSAN. The vSphere Storage Inventory dashboard is useful for topology and inventory visibility, but it is not the best view for identifying the VM-level consumers causing IOPS and throughput pressure. The Storage Operations page is broader and less targeted than the Live heavy hitter view. Reference topics: VCF Operations Performance Dashboards, Storage Heavy Hitters, VM IOPS and Throughput Troubleshooting.

The Repair Delay Timer expires, and vSAN starts automatic repair evaluation.

Once data resync completes, objects are marked as Compliant again.

vSAN verifies policy requirements and rebuilds missing components on available capacity devices.

When a host goes offline unexpectedly, vSAN treats the missing components as absent and waits for the configured repair delay timer before initiating rebuild operations. This prevents unnecessary resynchronization when a host or device returns quickly. In this scenario, the host is offline for more than an hour, so the repair delay timer expires and vSAN begins automatic repair evaluation. vSAN then checks the assigned storage policies, available capacity, and fault-domain placement requirements to determine whether missing components can be rebuilt safely on available capacity devices. If sufficient capacity and fault domains exist, vSAN creates replacement components and starts resynchronization. When the resync process finishes and the affected objects again satisfy their assigned policies, the objects are marked Compliant. The administrator does not need to manually run a resync task from vCenter, and the host does not need to be placed into maintenance mode for automatic repair. A full cluster rebalance is a separate capacity-balancing operation and is not required before object repair. Reference topics: vSAN Repair Delay Timer, Object Compliance, Resynchronization, ESA Object Repair.

The administrator must create a datastore cluster from the three NFS datastores that are intended to host virtual machine workloads. The ISO datastore should not be included because datastore clusters should contain similar or interchangeable datastores used for the same purpose. All three NFS datastores must be available to each ESX host server so Storage DRS recommendations and VM placement are valid across the cluster. Storage DRS should be configured in Manual mode because the requirement states that migrations must occur only after administrator approval. Manual mode displays placement and migration recommendations but does not execute them automatically. The Storage DRS space threshold should be set to 50% so recommendations are generated when a datastore exceeds that utilization level. Setting the storage space utilization difference to 50% is not correct because that value controls the minimum difference between source and destination datastore utilization, not the trigger threshold itself. Fully Automated mode would violate the approval requirement by automatically applying migrations. Reference topics: Datastore Cluster Requirements, Storage DRS, Manual Automation Mode, Space Utilization Thresholds, NFS Datastores.

vSAN Stretched Clusters meet the availability-zone requirement by extending a single logical vSAN cluster across two availability zones and using a witness for quorum. This provides rapid recovery from a site or availability-zone failure because workloads remain protected by the stretched topology and vSAN site-failure tolerance. vSAN Storage Cluster addresses the need for scalable, high-performance storage that can grow independently as application capacity requirements increase. In VCF 9.0, a vSAN Storage Cluster is based on vSAN ESA and provides disaggregated storage to vSAN compute or HCI clusters. This design supports storage-dense NVMe-based nodes, high IOPS, low latency, independent capacity scaling, and centralized storage services. Encryption at rest and in transit are native vSAN capabilities that can be enabled on the vSAN-backed storage architecture. vSAN File Service is for file shares, and vSAN iSCSI Target Service is for presenting block LUNs to external initiators; neither is required by the stated application-storage design. vSAN Data Protection is valuable for snapshots and recovery points, but the core architecture requirements are best satisfied by stretched site resilience plus scalable vSAN storage clustering. Reference topics: vSAN Storage Cluster, vSAN Stretched Cluster, vSAN ESA, vSAN Encryption.

The two major contributors are RAID overhead and Operational Reserve. With the default policy set to FTT=1 using RAID-1 mirroring, vSAN stores two copies of protected data. The capacity planning guidance states that when Failures to tolerate is set to 1 failure with RAID-1 mirroring, virtual machines can use about 50 percent of raw capacity because each object consumes mirrored space. This is the largest capacity-impacting factor. The second contributor is Operational Reserve, which reserves capacity for vSAN internal operations such as policy changes, rebalancing, object movement, and other transient storage activities. Even when Host Rebuild Reserve is not activated, vSAN capacity monitoring still accounts for the operations threshold/reserve needed to keep the cluster functional during internal activity. Encryption overhead is typically not the primary reason for a 20% capacity difference. Host upgrade overhead is not a vSAN capacity category. VM swap can consume capacity, but it does not normally account for most unavailable raw capacity compared with RAID mirroring and operational reservation. Reference topics: vSAN Capacity Planning, RAID-1 FTT=1 Capacity Impact, Operations Reserve, Reserved Capacity.

Full Clone from Volume Snapshot

4kn Support

Online Volume Expansion

Offline Volume Expansion

Static Persistent Volume

VMware Kubernetes Service persistent volumes use vSphere storage integrations such as CNS and pvCSI to provide Kubernetes storage services backed by vSphere datastores and storage policies. The supported persistent volume capabilities include Static Persistent Volume, which allows pre-existing storage to be consumed by Kubernetes workloads; Offline Volume Expansion and Online Volume Expansion, which allow persistent volumes to be resized depending on workload and filesystem state; Full Clone from Volume Snapshot, which enables a new volume to be created from an existing snapshot; and 4kn Support, which supports modern 4K native storage devices where the underlying stack supports them. Storage vMotion with attached Persistent Volumes is not supported because moving an attached Kubernetes persistent volume while it is in active use can break attachment and consistency assumptions. Storage DRS is also not a supported persistent volume capability in this VKS context. Flash Read Cache is not part of the supported VKS persistent-volume capability set. Reference topics: VMware Kubernetes Service Storage, CNS, pvCSI, Persistent Volume Capabilities, Volume Expansion, Volume Snapshot Clone.

NFS must be used as principal storage because the hosts have no local storage available. vSAN OSA and vSAN ESA both require local storage devices on the ESX hosts to create the vSAN datastore, so neither can be selected as principal storage in this design. NVMe over RDMA is supported as a high-performance NVMe over Fabrics transport in vSphere, but in the VCF storage model it is treated as supplemental storage rather than principal storage for workload domain creation. Therefore, NVMe over RDMA cannot be the initial principal datastore used to build the Workload Domain. NFS is the valid principal storage option from the provided choices, and after the Workload Domain is created, NVMe over RDMA can be added as supplemental storage for additional performance or capacity use cases. This build order satisfies the lack of local disks, uses a supported principal storage type, and allows the NVMe over RDMA design requirement to be met after the domain exists. Reference topics: Principal Storage, Supplemental Storage, NFS Storage Model, NVMe over RDMA, VCF Workload Domain Storage Design.

The cluster must not include hosts from different subnets or networks (L3).

The default management vSphere cluster must already be stretched.

The cluster must not include DPU-backed hosts.

The cluster must not share a vSAN Storage Policy with any other cluster.

To stretch a vSAN cluster in a VCF Workload Domain, the environment must satisfy specific VCF stretch prerequisites and avoid unsupported configurations. The default management vSphere cluster must already be stretched so the management plane remains available if an availability zone fails. The workload cluster must not include hosts from different subnets or Layer 3 networks because the stretch workflow expects supported site and network placement assumptions for the cluster being stretched. The cluster must also not include DPU-backed hosts, because clusters with DPU-backed hosts are excluded from this stretch operation. In addition, the cluster must not share a vSAN Storage Policy with any other cluster, because shared policies can create policy scope and compliance conflicts during stretch configuration. SSH does not need to be manually activated on all hosts as a prerequisite. The default management cluster being “not stretched” is the opposite of the required condition. Host self-signed certificates are not the listed blocking condition for this workflow. Reference topics: Stretch vSAN Cluster in VCF, Workload Domain Stretch Prerequisites, vSAN Storage Policy Constraints, Unsupported Stretch Configurations.

To deliver vSAN File Service for NFS shares in an Edge environment, the administrator must prepare the vSAN File Service network correctly. When a vSphere Distributed Switch is used, vSAN File Services are supported on DVS and require a dedicated distributed port group for vSAN File Services. During vSAN File Services enablement, MAC Learning and Forged Transmits are enabled for the provided DVS port group. If the design uses an NSX-based network, MAC Learning must be enabled on the provided NSX network entity from the NSX admin console, and the hosts and File Service nodes must be connected to the desired NSX network. For Edge-style network behavior, DVS 6.6.0 or later is required to support MAC Learning on the distributed port group, with ESX 6.7 or later. MAC Learning and Forged Transmits being disabled is therefore incorrect. Jumbo frames are not listed as a vSAN File Service requirement in this workflow. vSAN Witness functionality on each VMkernel is also unrelated; witness traffic applies to two-node or stretched-cluster quorum, not file-service delivery. Reference topics: vSAN File Service Network Considerations, DVS Port Group Requirements, NSX MAC Learning, Edge Networking.

vSAN HCI Mesh is the correct feature because the application must continue running on the existing compute cluster, but that cluster lacks enough unused vSAN capacity and has no available NVMe slots for expansion. HCI Mesh, also known as vSAN datastore sharing, allows independent vSAN clusters to share remote datastore capacity with other compatible vSAN clusters. The remote datastore can be mounted and used as if it were local storage, allowing VMs running on the current cluster to consume storage from another vSAN cluster that has sufficient capacity and performance. This satisfies the requirement without purchasing hosts, reassigning hosts, or moving the application away from the cluster that provides the required CPU and memory. vSAN Data Protection addresses snapshots and recovery, not capacity expansion. vSAN File Services provides SMB/NFS file shares, not additional VM datastore capacity. vSAN Stretched Clusters provide availability-zone resilience, not cross-cluster capacity borrowing. VCF documentation describes HCI Mesh as cross-cluster capacity sharing that enables multiple independent vSAN HCI clusters to consume storage from adjacent vSAN storage resources. Reference topics: vSAN HCI Mesh, vSAN Datastore Sharing, Cross-Cluster Capacity Sharing, Remote vSAN Datastore.

vSAN object availability is based on two conditions: an intact replica must be available, and more than 50% of the object’s votes must be accessible. In this scenario, vSAN can locate a full replica and 55% of the votes for the noncompliant objects. Because 55% is greater than the quorum threshold, the objects remain available to the vSAN datastore. A noncompliant status means the VM objects do not currently satisfy the assigned storage policy, but it does not automatically mean the VM is inaccessible. The documentation states that if the operational state remains healthy although the object is noncompliant, the virtual machine can continue using the vSAN datastore. If the cluster contains enough resources and the failure is permanent, vSAN automatically recovers failed components and restores compliance. The VM is marked inaccessible only when a full replica cannot be located or when 50% or fewer votes are available. It becomes orphaned only if the VM namespace, such as the .vmx file, cannot be accessed. Reference topics: vSAN Object Health, Quorum Votes, Noncompliant Objects, Inaccessible and Orphaned VM States.

The extended resync behavior is best explained by deduplication and compression in a vSAN OSA design. In vSAN OSA, deduplication and compression are enabled at the cluster level but applied on a disk-group basis. The documentation states that deduplication occurs inline when data is written back from the cache tier to the capacity tier, and compression is then applied as data moves from cache to capacity. During resynchronization, vSAN must read, rewrite, deduplicate, compress, and destage data through this disk-group architecture. That additional processing can extend resync duration even when the physical network and hardware are healthy. “Ensure Accessibility” does not trigger a full component migration; it evacuates only enough data to maintain object accessibility and may leave objects temporarily noncompliant. The number of disk groups is not inherently the cause, and NVMe cache devices are not automatically limiting throughput simply because they are used in the cache tier. The key differentiator in the scenario is that deduplication and compression are enabled while heavy resync activity is occurring. Reference topics: vSAN OSA Deduplication and Compression, Disk Group Scope, Cache-to-Capacity Destaging, Maintenance Mode, Resynchronization.

Both vSAN OSA and vSAN ESA require a trusted key provider before Data-at-Rest Encryption can be enabled. With a standard external KMS, the configuration process includes adding the KMS to vCenter and establishing trust with the KMS. vCenter then provisions encryption keys from the key provider. The vSAN encryption workflow uses a Key Encryption Key from the KMS to protect Data Encryption Keys used by ESX hosts. This requirement applies to vSAN encryption generally and is not limited to a specific vSAN architecture. OSA supports external KMS integration, so the option stating that OSA does not support external KMS integration is incorrect. Trusted Platform Modules are not mandatory prerequisites for either OSA or ESA. The vSphere key provider requirements state that TPM is not required for a standard key provider or for vSphere Native Key Provider, although Native Key Provider availability can optionally be restricted to hosts with TPMs. Therefore, the mandatory prerequisite is a trusted KMS identity for both OSA and ESA. Reference topics: vSAN Data-at-Rest Encryption, Standard Key Provider, KMS Trust, OSA and ESA Encryption Support, TPM Requirements.

The failure is host-specific because the KMS is online and reachable from the other hosts, and those hosts remain healthy with encryption enabled. In vSAN Data-at-Rest Encryption, vCenter works with the external KMS to manage the Key Encryption Key (KEK). ESX hosts use the KEK to unlock the Data Encryption Keys that protect encrypted vSAN disk data. When a host reboots, it must retrieve the required encryption key before encrypted vSAN disk groups can be mounted. If the host’s trust relationship, certificate, or KMS identity relationship is invalid or missing, that host cannot retrieve the key, and its encrypted disk groups remain unmounted. A Deep Rekey changes encryption material but does not repair a broken host-to-KMS trust relationship. Restarting vCenter is not the required fix because other hosts are functioning normally. TPM failure is not the best explanation because the error explicitly states that retrieval from the KMS failed. Reference topics: vSAN Data-at-Rest Encryption, External KMS Trust, Key Retrieval, Encrypted Disk Group Mounting.

vSAN HCI Cluster = A cluster that provides both compute and storage to Virtual Machines;

vSAN Storage Cluster = A vSAN cluster that provides disaggregated storage for vSAN and vSphere clusters;

vSAN Compute Cluster = A vSphere cluster that does not have local vSAN storage, but instead, it mounts a remote vSAN datastore;

vSAN Stretched Cluster = A vSAN Cluster topology that extends a single logical vSAN cluster across two availability zones. A vSAN stretched cluster can tolerate a site failure.

These mappings describe the primary vSAN storage models used in VMware Cloud Foundation 9.0. A vSAN HCI Cluster is the traditional hyperconverged model where the same cluster provides compute resources and contributes local storage devices to the vSAN datastore for running virtual machines. A vSAN Storage Cluster is a disaggregated storage model based on vSAN ESA; it provides storage capacity and performance to other vSAN or vSphere clusters instead of primarily running workloads itself. A vSAN Compute Cluster is a vSphere cluster that does not contribute local vSAN capacity. Instead, it consumes a remote datastore exported by a vSAN Storage Cluster, enabling compute and storage to scale separately. A vSAN Stretched Cluster extends a single logical vSAN cluster across two availability zones or sites and uses a witness to maintain quorum, allowing workloads to tolerate a full site failure. These distinctions are essential for choosing between HCI, disaggregated storage, remote storage consumption, and availability-zone resilience. Reference topics: vSAN HCI Cluster, vSAN Storage Cluster, vSAN Compute Cluster, vSAN Stretched Cluster, VCF Storage Models.

Four hosts are required to meet the 12 TB usable-capacity requirement after applying the protection policy, data reduction, reserves, and overhead. Each host contributes 8 TB raw capacity from two 4 TB NVMe devices. Three hosts provide 24 TB raw capacity, but once host rebuild reservation, 10% operational reserve, RAID-5 protection overhead, and 25% filesystem/object overhead are considered, the remaining effective usable capacity falls below the required 12 TB target. Four hosts provide 32 TB raw capacity. With vSAN ESA and FTT=1/RAID-5, vSAN uses erasure coding to improve capacity efficiency compared with mirroring. The vSAN sizing guidance states that RAID-5 with FTT=1 provides approximately 75% usable capacity before other reserves and overhead. Host Rebuild Reserve must also be planned so the cluster has enough free capacity to rebuild components after a host failure. After applying the expected 1.5 data reduction ratio and the required reserves, four hosts provide enough usable capacity while three hosts do not. Reference topics: vSAN ESA Capacity Sizing, RAID-5 Erasure Coding, Host Rebuild Reserve, Operations Reserve, vSAN Object Overhead.

Deploy ESX 9.x

Configure to use NVMe storage

Deploy vCenter 9.x

Deploy the VCF Installer Appliance

Download binaries for the installation

Deploy VCF 9.x using existing components as building blocks

Add additional components

The sequence begins with deploying ESX 9.x on the blade hosts because the hosts are the physical foundation for the future management domain. Since there is no local storage beyond the operating system and the external array supports NVMe/TCP only, the hosts must then be configured to use NVMe storage before vCenter is deployed. This provides the required shared datastore for the vCenter deployment and for later VCF management component placement. After the NVMe storage is accessible, vCenter 9.x is deployed to manage the ESX hosts and form the existing vSphere building block. The convergence process then moves into the VCF workflow: deploy the VCF Installer Appliance, download the required binaries to the installer appliance, and deploy VCF 9.x by using the existing vCenter and ESX hosts as starting building blocks. Because Aria Operations is not currently deployed, VCF Installer deploys the required missing components during the converge process, and remaining additional components are added after the core platform deployment is complete. Reference topics: Converging Existing Virtual Infrastructure, VCF Installer, Existing Components as Building Blocks, NVMe Storage Preparation.