PDF 3V0-12.26 Study Guide

A directly improves NSX Edge availability. VMware/Broadcom guidance recommends placing Edge appliances on separate ESXi hosts using VM-VM anti-affinity so that a single host failure cannot remove multiple routing instances simultaneously. Broadcom specifically notes that Edge anti-affinity keeps Edge Nodes on different hosts and preserves NSX services if one ESXi host becomes unavailable.

B provides the required North/South forwarding resilience. An Active/Active Tier-0 design allows service routers on multiple Edge Nodes to forward simultaneously and supports ECMP north-south routing . If an Edge Node or forwarding path fails, remaining active paths continue carrying traffic. Distributing Edge Nodes across independent fault domains further avoids concentrating routing availability on one host or failure domain. Broadcom ' s VCF guidance explicitly documents Active/Active Tier-0 gateways and ECMP across Edge Nodes.

C does not itself create redundancy; BFD accelerates failure detection, but merely sharing a profile is not an availability architecture. D unnecessarily concentrates gateway services and increases failure-domain dependency. E addresses NSX Federation management/policy continuity rather than North/South forwarding availability; Global Manager failover is also manual, while existing data-plane forwarding can continue without it.

Study Guide References/Topics: NSX Edge High Availability; Edge Node Placement; VM Anti-Affinity; Tier-0 Active/Active HA; ECMP Routing; BGP/BFD Convergence; Fault-Domain Design; VCF Network Availability.

D is correct. VMware Cloud Foundation 9 uses VCF Identity Broker as the SSO provider, and it supports two deployment modes: Embedded and Appliance . The appliance deployment is specifically intended for environments requiring greater availability or where VCF components cannot reliably reach the management-domain vCenter.

The Embedded Mode runs the Identity Broker inside the management-domain vCenter. Although this minimizes infrastructure footprint, it ties authentication availability to that vCenter. This conflicts directly with the requirement that some VCF components cannot access the management-domain vCenter. Broadcom ' s design guidance explicitly identifies this condition as a reason to choose the appliance deployment model. ( VMware Blogs )

The Appliance Mode deploys VCF Identity Broker as an external, resilient cluster. Broadcom describes the appliance implementation as a three-node Identity Broker cluster , providing resiliency and allowing authentication services to survive failure of a single Identity Broker node. It can also provide identity services independently of the management-domain vCenter ' s availability. ( VMware Blogs )

Because three nodes are the minimum appliance topology needed to satisfy the stated single-node-failure requirement, this also meets the requirement to deploy the fewest nodes possible while retaining resiliency .

Options A and C are incorrect because VCF LDAP Services is not the VCF 9 SSO provider deployment model. B lacks the required independence and node-level resiliency.

Study Guide References/Topics: VCF Single Sign-On; VCF Identity Broker Deployment Models; Embedded vs Appliance Mode; Identity Broker High Availability; Management Domain Dependency; Identity and Access Architecture.

C is the best match because this blueprint combines metro-style availability inside the primary region with disaster recovery into an additional region .

Within the primary region, two sites can use stretched vSphere/vSAN clusters . Current VCF design guidance specifies that stretched designs require high-bandwidth connectivity and less than 5 ms RTT between the data availability zones. This enables synchronous storage replication, which is the architectural mechanism required to achieve RPO 0 for Tier-1 and Tier-2 workloads. Broadcom also documents that stretched-cluster designs can provide zero RPO because data is synchronously maintained across sites.

The additional data center can then operate as a separate regional VCF instance within the same Fleet. This provides geographic separation for regional disaster recovery and supports the stated 24-hour RTO , while avoiding the operational complexity of stretching every site across every region.

A pure single-region multi-site design does not adequately address complete regional failure. Conversely, a generic multi-region design does not inherently provide the synchronous stretched-cluster architecture required for the Tier-1/Tier-2 zero-RPO requirement.

The VCF blueprint specifically described as “Multiple Sites in a Single Region plus Additional Region(s)” combines a stretched primary region with one or more standard remote regions. ( VMware TechDocs )

Study Guide References/Topics: VCF Design Blueprints; Multi-Site Single-Region Architecture; Additional Region Design; vSAN Stretched Clusters; RPO/RTO Design; Regional Disaster Recovery; Data Sovereignty; Fleet-Level Operations.

C is required because BGP uses the AS_PATH attribute for loop prevention . If a Tier-0 gateway uses an autonomous-system number already present in an incoming route ' s AS path, the advertisement can be rejected as a routing loop. Assigning a unique private ASN to each Tier-0 gateway prevents this condition and is the documented VCF physical-network design consideration for the VPC Full Services model.

D addresses the explicit constraint that BFD cannot be used . Without BFD, failure detection falls back to BGP keepalive/hold timers. Broadcom ' s VCF configuration guidance uses 4-second Keep Alive and 12-second Hold Down timers when BFD is disabled, allowing three missed keepalives before declaring the peer unavailable. Therefore, the wording “3 retries and 12 hold down” is expressing this timer behavior.

E is not automatically justified by a 40+ Gbps requirement: UPT requires compatible DPU/SmartNIC-backed Edge interfaces and is not a generic VPC Full Services prerequisite. F does not solve AS-path loop detection. A conflicts with the centralized Full Services forwarding model, while B is unnecessary for a single-tenant design.

Study Guide References/Topics: NSX VPC Full Services Model; Tier-0 Gateway Physical Design; BGP Autonomous Systems and Loop Prevention; BGP Failure Detection; BGP Keepalive/Hold Timers; NSX Edge Connectivity.