3V0-11.26 Exam Advanced VMware Cloud Foundation 9 Administrator https://www.passquestion.com/3v0-11.26.html 35% OFF on All, Including 3V0-11.26 Questions and Answers Pass 3V0-11.26 Exam with PassQuestion 3V0-11.26 questions and answers in the first attempt. https://www.passquestion.com/ 1. Domain: SDDC Manager & Architecture Operations An administrator is commissioning four ESXi hosts in SDDC Manager to expand an existing VI Workload Domain cluster. During the host validation phase, the validation task fails with an error indicating that the host network configuration does not match the network pool specifications. Which configuration requirement must be satisfied on the ESXi hosts prior to successful commissioning in SDDC Manager? A. The ESXi host must have an active VMkernel adapter (vmk1) pre-configured with the designated vSAN IP address. B. The ESXi management interface (vmk0) must be assigned an IP address within the range specified by the target Network Pool. C. The ESXi host must have standard vSphere Standard Switch (vSS) with two active uplinks configured and DNS forward/reverse lookups verified. D. The ESXi host must have an existing NSX Transport Node Profile applied prior to SDDC Manager discovery. Answer: C Explanation: l Correct Option (C): When commissioning ESXi hosts in SDDC Manager, the hosts must be installed with supported ESXi builds, configured with a standard vSphere Standard Switch (vSwitch0) using active physical uplinks, and have valid forward and reverse FQDN resolution in DNS. SDDC Manager automatically manages the creation of vSphere Distributed Switches (VDS), VMkernel ports for vSAN/Geneve, and NSX encapsulation during the cluster creation or expansion workflows. l Distractor Analysis: n Option A: VMkernel adapters for vSAN (vmk1 or designated) and vSAN IPs are automatically generated and assigned by SDDC Manager during the cluster creation/expansion task from the selected Network Pool; pre-creating them causes validation failures. n Option B: The management IP (vmk0) is configured during ESXi host staging and must match the FQDN in DNS. Network Pools in SDDC Manager provide IP address ranges strictly for vSAN, vSphere vMotion, and NSX Overlay (Host TEPs), not ESXi host management. n Option D: ESXi hosts must not be configured as NSX Transport Nodes prior to commissioning; SDDC Manager automates NSX host preparation and Transport Node Profile attachment when the host is added to a workload domain cluster. PassQuestion 3V0-11.26 Practice Questions 2 / 15 2. Domain: Lifecycle Management (LCM) An administrator is preparing to apply an upgrade bundle to an existing VMware Cloud Foundation 5.x multi-cluster VI Workload Domain using the SDDC Manager UI. Before initiating the upgrade, the administrator runs the pre-check task, and the vCenter Server pre-check generates a warning regarding insufficient disk space on the /storage/seat partition. What is the immediate and supported administrative action required to resolve this condition before continuing the LCM workflow? A. Increase the virtual disk size allocated to /storage/seat in vCenter Server Appliance Settings and reboot the appliance. B. Log into the vCenter Server Appliance shell and execute vmon-cli --restart all to purge the SEAT temporary cache. C. Use the SDDC Manager SOS utility with the --force-lcm-bypass argument to override the disk warning. D. Enable log rotation and purge historical event and task data using the vSphere Client management interface. Answer: D Explanation: l Correct Option (D): The /storage/seat partition on the vCenter Server Appliance (VCSA) stores Statistics, Events, Alarms, and Tasks. During pre-checks, LCM verifies partition thresholds to guarantee database schema migration and rollbacks. The supported procedure to remediate high disk utilization on /storage/seat without breaking LCM state is to truncate or purge historical events, tasks, and statistical data via the vSphere Client or retention policy settings. l Distractor Analysis: n Option A: While increasing virtual disks on VCSA is supported for general maintenance, resizing /storage/seat on a VCF-managed vCenter requires careful coordination with SDDC Manager inventory metadata and may mask runaway event logging issues. Purging historical records is the first recommended operational step. n Option B: The vmon-cli tool manages vCenter services; restarting services does not reclaim disk space on the persistent SEAT database partition. n Option C: The sos utility does not provide a --force-lcm-bypass parameter; bypassing safety pre-checks during core component upgrades is unsupported and risks bricking the appliance mid-migration. PassQuestion 3V0-11.26 Practice Questions 3 / 15 3. Domain: Software-Defined Networking (NSX) An administrator needs to deploy an NSX Edge Cluster for a newly created VI Workload Domain to provide north-south routing and centralized stateful services. The workload domain cluster utilizes a single vSphere Distributed Switch (VDS) with two 25 GbE uplinks. When deploying the NSX Edge Nodes through the SDDC Manager interface, which network design requirement is mandatory for the Edge TEP communication? A. Edge TEPs must reside on the same VLAN and IP subnet as the Host TEPs. B. Edge TEPs must utilize a dedicated VLAN ID distinct from the Host TEP VLAN ID. C. Edge TEP interfaces must be configured with static IP addresses without a default gateway. D. Edge TEP interfaces must terminate on dedicated physical uplinks not shared with the VDS. Answer: B Explanation: l Correct Option (B): When deploying NSX Edge VMs on the same VDS and physical uplinks as the ESXi hosts (collapsed compute and edge design), Edge TEPs and Host TEPs cannot share the same VLAN ID. This is due to how Geneve encapsulation and packet forwarding operate on the hypervisor: if an Edge VM sends encapsulated Geneve traffic to a local Host TEP on the same VLAN, the local vSwitch drops the traffic to prevent loops. Therefore, Edge TEPs must use a distinct VLAN ID. l Distractor Analysis: n Option A: Sharing the same VLAN and subnet between Edge TEPs and Host TEPs on a single VDS causes Geneve encapsulation drops and breaks BGP peering across TEP endpoints. n Option C: Edge TEPs require default gateways (or specific static routes) to allow Geneve encapsulation across routed layer-3 underlay networks. n Option D: VCF natively supports collapsed Edge deployments where Edge VM vNICs attach to trunk port groups on the existing VDS shared with system traffic. 4. Domain: Software-Defined Storage (vSAN) An enterprise deploys a 4-host VI Workload Domain cluster utilizing vSAN Express Storage Architecture (ESA). The administrator is tasked with defining an appropriate Storage Policy-Based Management (SPBM) policy for business-critical virtual machines requiring high performance and resilience against a single host failure. Which configuration represents the default and recommended failure tolerance method for this 4-host vSAN ESA cluster? A. RAID-1 (Mirroring) — 1 failure - RAID-1 (Mirroring) B. RAID-5 (Erasure Coding) — 1 failure - RAID-5 (Single Parity) with 4+1 scheme C. RAID-6 (Erasure Coding) — 2 failures - RAID-6 (Dual Parity) with 4+2 scheme D. RAID-5 (Erasure Coding) — 1 failure - RAID-5 (Single Parity) with 2+1 scheme Answer: D Explanation: l Correct Option (D): In vSAN Express Storage Architecture (ESA), VMware introduced adaptive RAID-5 erasure coding. For clusters with 3 to 5 hosts, vSAN ESA automatically employs a 2+1 RAID-5 erasure coding scheme (consuming only 1.5x storage capacity compared to RAID-1's 2.0x while tolerating 1 failure). When the cluster scales to 6 or more hosts, vSAN ESA switches to a 4+1 scheme (1.25x overhead). In a 4-host cluster, 2+1 is the native supported RAID-5 configuration. l Distractor Analysis: n Option A: RAID-1 is supported but is not the recommended default in vSAN ESA because ESA provides RAID-5 erasure coding with performance equal to or better than RAID-1, without the 100% capacity penalty. n Option B: The 4+1 RAID-5 scheme in vSAN ESA requires a minimum of 6 hosts (4 data + 1 parity + 1 spare/rebuild host). n Option C: RAID-6 (4+2 dual parity) requires a minimum of 7 hosts in vSAN ESA. PassQuestion 3V0-11.26 Practice Questions 4 / 15 5. Domain: SDDC Manager & Architecture Operations An administrator needs to rotate and replace the self-signed SSL/TLS certificates across all components in the Management Domain (SDDC Manager, vCenter Server, and NSX Manager) using an enterprise Microsoft Active Directory Certificate Services (AD CS) instance. What is the correct operational procedure within SDDC Manager to accomplish this task? A. Manually generate OpenSSL private keys on each appliance, import the certificates into the appliance keystores, and click "Synchronize Certificates" in SDDC Manager. B. Configure the Microsoft CA authority under Security Settings in SDDC Manager, generate CSRs through SDDC Manager, submit them to the CA, and apply the issued certificates via the SDDC Manager UI. C. Use the vSphere Certificate Manager tool on vCenter to generate certificates for all SDDC components and push them via VMware Aria Suite Lifecycle. D. Log into the SDDC Manager appliance via SSH and run /opt/vmware/vcf/commonsvcs/cert-manager --force-replace-all. Answer: B Explanation: l Correct Option (B): SDDC Manager features built-in Certificate Management automation. The administrator connects SDDC Manager to the enterprise Certificate Authority (such as OpenSSL or Microsoft AD CS), generates Certificate Signing Requests (CSRs) directly from the SDDC Manager interface, obtains signed certificates, and instructs SDDC Manager to orchestrate certificate replacement across all endpoints (vCenter, NSX Manager, SDDC Manager) seamlessly. l Distractor Analysis: n Option A: Manually updating certificates directly on individual appliances bypasses SDDC Manager inventory, leading to trust store mismatches, broken API communications, and LCM failure during future updates. n Option C: vSphere Certificate Manager only manages certificates local to vCenter Server and cannot coordinate certificate lifecycles for NSX Managers or SDDC Manager. n Option D: There is no such command or directory path; direct filesystem manipulation of keystores without SDDC Manager orchestration breaks component trust. PassQuestion 3V0-11.26 Practice Questions 5 / 15 6. Domain: Modern Apps & vSphere Supervisor An administrator is enabling Workload Management (vSphere Supervisor Cluster) on a dedicated cluster in a VI Workload Domain. The environment uses a single vSphere Distributed Switch (VDS) and is licensed for VMware Cloud Foundation. The networking team requires that virtual server traffic for Kubernetes applications be distributed using dedicated virtual appliances without consuming NSX Edge Node capacity. Which load balancing topology meets these administrative requirements? A. NSX Advanced Load Balancer (Avi Load Balancer) deployed in standalone mode integrated with the vDS. B. Embedded HAProxy load balancer appliance deployed directly on the ESXi management network. C. Native NSX-T Tier-0 Gateway inline server load balancing with active-standby stateful services. D. MetalLB containerized daemonset running inside the Supervisor control plane virtual machines. Answer: A Explanation: l Correct Option (A): For vSphere with Tanzu /Supervisor Cluster enablement in VCF, VMware provides two primary networking models: NSX-T networking (which can leverage native NSX load balancing) or VDS networking with an external load balancer. When requirements dictate offloading load balancing from NSX Edge nodes or using VDS networking, the supported enterprise solution is NSX Advanced Load Balancer (formerly Avi Networks). Avi Service Engines deploy as dedicated VMs and manage ingress and load balancing independently of NSX Edge instances. l Distractor Analysis: n Option B: HAProxy was previously available as a community/dev solution in early vSphere with Tanzu releases but is deprecated and not recommended for production VCF deployments compared to NSX ALB. n Option C: Using native NSX Tier-0 Gateway stateful load balancing runs directly on NSX Edge nodes, which explicitly violates the requirement to avoid consuming NSX Edge Node capacity. n Option D: MetalLB is a bare-metal Kubernetes load balancer used inside Tanzu Kubernetes Grid guest clusters, not for the vSphere Supervisor control plane management layer. PassQuestion 3V0-11.26 Practice Questions 6 / 15 7. Domain: SDDC Manager & Architecture Operations An administrator runs the SOS health check utility on the SDDC Manager appliance before expanding an existing cluster. Based on the output in the exhibit, which issue must be resolved before the ESXi host expansion task will pass pre-check validation? # /opt/vmware/sddc-support/sos --health-check [INFO] Running Supportability and Serviceability (SOS) Health Check... Component Check Name Status Details ------------------------------------------------------------------------------------------------ DNS DNS Forward Resolution (FQDN) PASSED sddc-mgr.corp.local -> 192.168.10.10 DNS DNS Reverse Resolution (PTR) FAILED 192.168.10.15 has no PTR record for esx-04.corp.local NTP NTP Time Synchronization PASSED Jitter < 4ms across all nodes SERVICES SDDC Manager Commonsvcs PASSED Service running (PID 2145) VCENTER vCenter API Connectivity PASSED Token validation successful A. NTP time jitter across the ESXi hosts must be brought below 1 millisecond. B. The reverse DNS (PTR) record for esx-04.corp.local (192.168.10.15) must be created in the corporate DNS server. C. The SDDC Manager Commonsvcs service must be manually stopped and restarted via systemctl. D. The vCenter Server session token cache must be purged via the vmon CLI. Answer: B Explanation: l Correct Option (B): In VMware Cloud Foundation, forward and reverse DNS lookups are strictly mandatory for all infrastructure management components. SDDC Manager validation tasks will fail if any ESXi host lacks a valid Reverse (PTR) DNS mapping. Creating the PTR record for 192.168.10.15 -> esx-04.corp.local resolves the FAILED check. l Distractor Analysis: n Option A: NTP jitter under 4ms is well within acceptable operational thresholds (typically < 5000ms). n Option C & D: The Commonsvcs and vCenter connectivity checks are already in PASSED status.</details> PassQuestion 3V0-11.26 Practice Questions 7 / 15 8. Domain: Software-Defined Networking (NSX) An administrator is creating an NSX Distributed Firewall (DFW) rule in an active VI Workload Domain to restrict MySQL database access (TCP port 3306) to only web servers in the Production-Web-SG security group. The rule must apply only to the relevant virtual machines without enforcing state evaluation across every virtual machine in the entire workload domain. Which configuration setting within the DFW policy ensures this optimization? A. Set the Rule Action to "Allow" and configure the Direction parameter to "In /Out". B. Set the "Applied To" column in the specific firewall rule to the Production-DB-SG security group. C. Configure a Gateway Firewall policy on the Tier-1 Gateway uplinks. D. Set the "Applied To" column at the DFW category level to "DFW" (Default). Answer: B Explanation: l Correct Option (B): In NSX Distributed Firewall, the "Applied To" field is critical for scalability and resource optimization. By default, rules are set to "Applied To: DFW", which installs the rule on the virtual NICs (vNIC filters) of every ESXi host and VM in the environment. Setting "Applied To" to the specific destination target group (e.g., Production-DB-SG) ensures that the rule filter is only programmed onto the vNICs of the database virtual machines, minimizing CPU and memory consumption across hypervisors. l Distractor Analysis: n Option A: Direction dictates traffic flow relative to the vNIC interface, not which hypervisors or VM vNICs receive the firewall rule table. n Option D: Leaving "Applied To" as "DFW" applies the rule to every vNIC across the entire fabric, consuming unnecessary hypervisor memory and inspection cycles. n Option C: Gateway Firewall rules apply to the Tier-0 or Tier-1 gateway interfaces (centralized on Edge Nodes), not directly to east-west VM vNICs. PassQuestion 3V0-11.26 Practice Questions 8 / 15 9. Domain: SDDC Manager & Architecture Operations An administrator needs to change the operational password for the local admin account of the NSX Manager cluster managed by VMware Cloud Foundation. According to VMware best practices, where must this password update be executed to prevent out-of-sync credential state across the SDDC? A. Change the password in the NSX Manager web UI, then click "Refresh Status" in vCenter Server. B. Use the SDDC Manager Password Management dashboard to update and rotate the NSX Manager admin password. C. Log into the NSX Manager CLI as admin and execute set user admin password, followed by restarting the nsx-manager service. D. Edit the credentials encrypted database directly on the SDDC Manager appliance at /etc/vmware/vcf/vault/credentials.json. Answer: B Explanation: l Correct Option (B): In VMware Cloud Foundation, all administrative passwords (ESXi root, vCenter root/administrator, NSX admin/audit/root, Backup accounts) must be managed centrally through SDDC Manager Password Management. Updating the password through SDDC Manager ensures that the new credential is rotated on the endpoint appliance and simultaneously updated in the SDDC Manager internal secure database. l Distractor Analysis: n Option A & C: If an administrator changes the password directly on the NSX Manager UI or CLI, SDDC Manager will lose API communication with NSX, causing automated inventory collection, pre-checks, and lifecycle upgrades to fail. (Remediating this requires a manual "Remediate" password task in SDDC Manager). n Option D: Direct modification of configuration files or vault databases on SDDC Manager is strictly unsupported and can corrupt the internal credential store. PassQuestion 3V0-11.26 Practice Questions 9 / 15 10. Domain: Lifecycle Management (LCM) A VMware Cloud Foundation environment is deployed in a secure, air-gapped data center with no direct internet access. The administrator needs to download the latest VCF 5.x upgrade bundles and make them available to SDDC Manager. Which utility is officially designed to download the bundles on an internet-connected workstation and transfer them to the offline SDDC Manager instance? A. VMware Aria Suite Lifecycle Easy Installer B. Async Patch Tool (AP Tool) configured in offline depot mode C. VCF LCM Bundle Transfer Utility (lcm-bundle-transfer-utility) D. VMware vCenter Server Update Planner CLI Answer: C Explanation: l Correct Option (C): For dark-site /offline VCF environments, VMware provides the LCM Bundle Transfer Utility (lcm-bundle-transfer-utility). Administrators run this script on an internet-connected machine to download the compatibility manifests and upgrade bundles from VMware depots, transfer the archive to the air-gapped SDDC Manager appliance via SCP/SFTP, and run the utility in upload mode (--upload) to populate the local LCM repository. l Distractor Analysis: n Option A: The Easy Installer is used for initial deployment of VMware Aria Suite Lifecycle and Identity Manager, not for staging VCF core system update bundles. n Option B: The Async Patch Tool is used to apply standalone patches to individual products (like vCenter or ESXi) between major VCF releases; it does not replace the general LCM bundle transfer utility for standard VCF core release bundles. n Option D: vCenter Update Planner is a tool within vSphere Client to assess vSphere-only updates, not VCF multi-cloud stack bundles. PassQuestion 3V0-11.26 Practice Questions 10 / 15 11. Domain: Lifecycle Management (LCM) An administrator is planning an automated VMware Cloud Foundation 5.x upgrade for an existing Management Domain. The environment includes SDDC Manager, VMware Aria Suite components, NSX, vCenter Server, and ESXi cluster hosts. According to the official VCF 5.x upgrade guidelines, what is the mandatory sequence of component upgrades enforced by the LCM orchestration engine? A. SDDC Manager -> NSX -> vCenter Server -> ESXi Hosts B. SDDC Manager -> vCenter Server -> NSX -> ESXi Hosts C. vCenter Server -> SDDC Manager -> NSX -> ESXi Hosts D. SDDC Manager -> vCenter Server -> ESXi Hosts -> NSX Answer: A Explanation: l Correct Option (A): In VMware Cloud Foundation 5.x, the strict LCM upgrade sequence for the Management Domain begins with SDDC Manager, followed by VMware Aria Suite (if integrated), then NSX (NSX Manager cluster and Edge nodes), then vCenter Server, and finally ESXi hosts (and vSAN). Upgrading NSX prior to vCenter Server ensures API interoperability and data plane stability before the vCenter database and management layer are upgraded. l Distractor Analysis: n Option B: Upgrading vCenter Server before NSX was a legacy vSphere workflow; VCF 5.x LCM explicitly orchestrates NSX upgrades before vCenter Server to maintain API and switch control plane compatibility. n Option C: vCenter Server cannot be upgraded prior to SDDC Manager; SDDC Manager drives the entire workflow and must be on the target release to decode the new release manifest and bundle dependencies. n Option D: ESXi hosts cannot be upgraded before NSX or vCenter Server, as host VIBs and transport node components require the management planes to be updated first. PassQuestion 3V0-11.26 Practice Questions 11 / 15 12. Domain: SDDC Manager & Architecture Operations An administrator needs to decommission an ESXi host from SDDC Manager inventory to reallocate the physical server to another project. The host is currently part of an active 6-node VI Workload Domain cluster. Which administrative workflow must be executed before the "Decommission" option becomes selectable for this specific host in the SDDC Manager interface? A. Put the host in maintenance mode in vCenter, manually disconnect it from the cluster, and delete the host object in vCenter inventory. B. Unassign the NSX Transport Node Profile, reboot the host to clear the scratch partition, and click Decommission in SDDC Manager. C. Remove the host from the workload domain cluster using the "Remove Host" workflow in SDDC Manager, ensuring it transitions to Unassigned state. D. Power off the physical host server, trigger an inventory sync in SDDC Manager, and force-purge the host using the SOS command-line utility. Answer: C Explanation: l Correct Option (C): In VMware Cloud Foundation, an ESXi host cannot be decommissioned while assigned to an active workload domain cluster. The administrator must first invoke the "Remove Host" workflow from the specific cluster within SDDC Manager. SDDC Manager automatically manages data evacuation (vSAN resync), places the host in maintenance mode, unconfigures NSX transport components, removes it from the vCenter cluster, and places the host in the "Unassigned" host inventory. Only unassigned hosts can be decommissioned to release credentials and network pool IP reservations. l Distractor Analysis: n Option A: Manually removing the host directly within vCenter Server corrupts the SDDC Manager inventory database and breaks cluster metadata consistency. n Option B: Manually stripping the NSX Transport Node Profile bypasses SDDC Manager automation and leaves orphaned vCenter cluster dependencies. n Option D: Powering off the host or attempting command-line database purges is unsupported and triggers critical SDDC Manager cluster validation errors. PassQuestion 3V0-11.26 Practice Questions 12 / 15 13. Domain: Software-Defined Storage (vSAN) An administrator is designing a storage policy using RAID-5 erasure coding in a vSAN Express Storage Architecture (ESA) cluster. Which two statements correctly describe the architectural requirements and behavior of RAID-5 in vSAN ESA? (Choose two.) A. In clusters with 3 to 5 hosts, vSAN ESA automatically applies RAID-5 with a 2+1 data and parity layout (1.5x capacity overhead). B. RAID-5 erasure coding in vSAN ESA requires a dedicated caching tier formatted with Optane NVMe devices. C. In clusters with 6 or more hosts, vSAN ESA automatically applies RAID-5 with a 4+1 layout (1.25x capacity overhead). D. vSAN ESA requires all virtual disks using RAID-5 erasure coding to have deduplication and compression enabled globally at the cluster level. Answer: A, C Explanation: l Correct Options (A, C): vSAN Express Storage Architecture (ESA) features an adaptive RAID-5 erasure coding implementation: 1. On clusters with 3 to 5 hosts, it automatically uses a 2+1 scheme (2 data components + 1 parity component), requiring only 3 hosts with a 1.5x capacity overhead. 2. On clusters with 6 or more hosts, it automatically switches to a 4+1 scheme (4 data + 1 parity), reducing capacity overhead to 1.25x while maintaining single-fault tolerance. l Distractor Analysis: n Option B: vSAN ESA eliminates the dedicated caching tier entirely; it operates on a single-tier Storage Pool using certified NVMe TLC drives. n Option D: Compression in ESA is enabled per-storage-policy, not globally forced at the cluster level.</details> PassQuestion 3V0-11.26 Practice Questions 13 / 15 14. Domain: Software-Defined Storage (vSAN) A 6-node VI Workload Domain cluster utilizes vSAN Express Storage Architecture (ESA). A single NVMe storage device on ESXi host esx-03.corp.local suffers an unrecoverable hardware failure. How does drive replacement and capacity reclamation in vSAN ESA differ fundamentally from legacy vSAN Original Storage Architecture (OSA)? A. The administrator must delete the affected disk group in vCenter, recreate the disk group with a new cache drive, and trigger a manual resync. B. The failed NVMe drive is removed from the host's unified Storage Pool; once physically replaced, the new drive is claimed directly without disk group reconstruction. C. The entire host must be evacuated and decommissioned from SDDC Manager, as vSAN ESA does not support single-drive hot-plug replacement. D. The host enters an automatic 60-minute repair delay timer during which all cluster write I/O is frozen to prevent split-brain states. Answer: B Explanation: l Correct Option (B): In vSAN Express Storage Architecture (ESA), VMware eliminated the legacy two-tier concept of "disk groups" (which required a dedicated caching drive and 1-7 capacity drives, where a cache drive failure invalidated the entire group). In ESA, all NVMe drives participate in a unified single-tier Storage Pool. When an NVMe drive fails, only that specific drive's capacity is lost. Replacing the drive involves physically swapping the NVMe device and claiming the new drive into the host's storage pool; no disk groups need to be torn down or rebuilt. l Distractor Analysis: n Option A: Recreating disk groups is the legacy vSAN OSA procedure, which does not apply to vSAN ESA's single-tier Storage Pool model. n Option C: vSAN ESA fully supports individual drive replacement without requiring host evacuation or decommissioning. n Option D: The vSAN object repair timer (default 60 minutes) governs delayed rebuilds for transient network disconnects, but cluster write I/O is never frozen during drive failures. PassQuestion 3V0-11.26 Practice Questions 14 / 15 15. Domain: Modern Apps & vSphere Supervisor An enterprise enables Workload Management on a VI Workload Domain cluster. A developer attempts to deploy a Tanzu Kubernetes Grid (TKG) workload cluster using kubectl apply -f tkg-cluster.yaml. The deployment fails with the error: Failed to create VirtualMachine: storage policy 'vSAN-Default' not assigned to namespace 'dev-team-ns'. Which action must the VCF administrator take in the vSphere Client to resolve this issue? A. Log into the Tanzu Kubernetes cluster control plane and edit the default Kubernetes CSI StorageClass YAML definition to point to the local ephemeral datastore. B. SSH into the SDDC Manager appliance, execute wcp-storage-sync --force, and restart the Workload Control Plane (WCP) service on the Supervisor. C. Update the VM storage policy directly on the underlying ESXi host local configuration file using esxcli vsan storage policy set. D. Navigate to Workload Management > Namespaces > dev-team-ns in the vSphere Client, edit Storage, and add the required vSAN storage policy to the namespace permissions. Answer: D Explanation: l Correct Option (D): In vSphere with Tanzu, Kubernetes storage classes are dynamically surfaced by assigning vSphere Storage Policies to specific Supervisor Namespaces. If a requested storage policy (such as vSAN-Default) has not been explicitly associated with the target vSphere Namespace (dev-team-ns), the Cloud Native Storage (CNS) and Workload Control Plane (WCP) controllers block persistent volume and virtual disk creation. The administrator must grant the policy under the Namespace's "Storage" configuration in the vSphere Client. l Distractor Analysis: n Option A: Editing CSI definitions inside the guest cluster does not grant underlying vSphere authorization if the Supervisor namespace lacks the assigned storage policy. n Option B: wcp-storage-sync is a fictitious command; namespace authorization is an administrative RBAC configuration in vSphere, not an internal SDDC Manager synchronization failure. n Option C: Storage policies cannot be manually forced at the host CLI level to bypass vSphere Namespace authorization boundaries. PassQuestion 3V0-11.26 Practice Questions 15 / 15