3V0-23.25 Advanced VMware Cloud Foundation 9.0 Storage Questions and Answers

With “Ensure Accessibility,” vSAN migrates only the minimum amount of data required to keep objects accessible while the host enters maintenance mode. This mode is faster than Full Data Migration, but it does not fully reprotect all objects. The documentation states that objects might no longer be fully compliant with their storage policy during this evacuation mode, meaning they might not have access to all replicas. Because the default policy is RAID-1 with FTT=1, each object can tolerate only one failure. While the first host is in maintenance mode, some VM objects are already running in a reduced-availability state. If a second host loses network connectivity during this window, affected objects can lose quorum or access to required components. vSAN does not immediately rebalance or fully rebuild objects simply because Ensure Accessibility was selected, and permanent data loss is not the expected result from a temporary network loss. The likely impact is that some VMs become inaccessible until either the maintenance host returns or the isolated host reconnects. Reference topics: vSAN Maintenance Mode, Ensure Accessibility, Default Storage Policy, RAID-1 FTT=1, Network Partition Handling.

High latency in a vSAN cluster is commonly caused by congestion in the backend storage path. Disk group congestion means vSAN is queuing, delaying, or throttling I/O because one or more disk groups cannot service the workload at the required rate. VCF Operations and vSAN performance views expose disk group and device-level congestion indicators, including IOPS congestion, log congestion, component congestion, memory congestion, and SSD congestion. These metrics directly correlate with elevated latency because the virtual machine I/O path must wait for vSAN backend processing to complete. PVSCSI controllers are normally recommended for high-performance virtual disks and are not a typical cause of vSAN latency. Jumbo frames, when consistently configured end-to-end, are a valid network optimization and do not inherently cause latency. Disabled erasure coding would usually reduce parity overhead, not create backend latency. Therefore, disk group congestion is the most likely explanation for high latency shown in the vSAN cluster performance charts. Reference topics: vSAN Performance Service, Disk Group Metrics, Congestion Metrics, vSAN Latency Troubleshooting.

A witness host for a 2-node vSAN cluster must be external to the 2-node vSAN-enabled data cluster. The witness provides quorum and must be placed outside the protected data-node pair so that it can arbitrate availability during host or site failure. If the proposed witness host resides inside the 2-node vSAN enabled cluster, it is not eligible and therefore does not appear as an available selection during the replacement workflow. Having a VMkernel adapter configured with vSAN traffic enabled is required for witness communication, so that is not the cause of the issue. Connectivity to the data hosts is also expected and does not make the witness invalid. A witness host already assigned to another 2-node vSAN cluster is not necessarily disqualified because shared witness configurations are supported within scale and sizing limits. The core eligibility issue is that the witness host cannot be a member of the same 2-node vSAN cluster that it is intended to witness. Reference topics: 2-Node vSAN Cluster, Witness Host Placement, Replace Witness Host, Shared Witness Support.

NFS must be used as principal storage because the hosts have no local storage available. vSAN OSA and vSAN ESA both require local storage devices on the ESX hosts to create the vSAN datastore, so neither can be selected as principal storage in this design. NVMe over RDMA is supported as a high-performance NVMe over Fabrics transport in vSphere, but in the VCF storage model it is treated as supplemental storage rather than principal storage for workload domain creation. Therefore, NVMe over RDMA cannot be the initial principal datastore used to build the Workload Domain. NFS is the valid principal storage option from the provided choices, and after the Workload Domain is created, NVMe over RDMA can be added as supplemental storage for additional performance or capacity use cases. This build order satisfies the lack of local disks, uses a supported principal storage type, and allows the NVMe over RDMA design requirement to be met after the domain exists. Reference topics: Principal Storage, Supplemental Storage, NFS Storage Model, NVMe over RDMA, VCF Workload Domain Storage Design.

In vSAN Original Storage Architecture, a disk group consists of one flash cache device and one or more capacity devices. The cache device is a required component of the disk group, so a failed cache device cannot be replaced as an isolated drive while preserving the same disk group. The supported operational approach is to remove the affected disk group, physically replace the failed cache device, verify that ESX detects the new device, and then manually recreate the disk group using the replacement cache device and the appropriate capacity devices. The scenario states that vSAN has already completed resynchronization and that all objects are healthy and compliant, so removing the failed disk group no longer risks object noncompliance. Selecting Full Data Migration on a failed cache device is not the correct workflow because the cache failure affects the entire disk group. Simply inserting a replacement drive does not cause vSAN OSA to automatically rebuild the disk group. Reference topics: vSAN OSA Disk Groups, Replace a Cache Device, Remove Disk Group, Recreate Disk Group.

Dedicated VMFS datastores on assigned Fibre Channel arrays meet both the performance and separation requirements. VCF supports Fibre Channel-backed VMFS as principal storage for workload domains, making it valid as the primary datastore type for the tier-1 business application cluster. Fibre Channel provides low-latency block storage, resilient pathing, SAN zoning, LUN masking, and mature enterprise performance characteristics. Because the existing FC arrays are partitioned by business unit, dedicated datastores preserve organizational separation and avoid mixing business-unit workloads on shared storage resources. The same dedicated FC-backed VMFS approach can also be used as supplemental storage after the workload domain exists, allowing extra capacity or specialized tiers while maintaining separation. Shared VMFS datastores do not satisfy the organizational separation requirement because they allow multiple business units to consume the same datastore boundary. vSAN is explicitly excluded, so the design must rely on supported non-vSAN storage. Automated VM placement can be supported by VMFS datastore clusters and Storage DRS where datastores are compatible and similarly managed. Reference topics: Fibre Channel Storage Model, VMFS Datastores, Principal Storage, Supplemental Storage, Datastore Clusters.

In vSAN ESA, the observed three disk stripes are expected behavior for objects using RAID-1, even when the storage policy shows “Number of disk stripes per object = 1.” The vSAN policy rule defines the minimum number of capacity devices across which each replica of an object is striped, and the default value is 1. However, VMware documentation explicitly notes that objects in a vSAN ESA cluster with RAID-0 or RAID-1 configuration have 3 disk stripes, even if the default storage policy defines only 1 disk stripe. Therefore, the three stripes are not caused by site mirroring itself, nor by the VM having three objects. Site mirroring controls placement across the preferred and secondary sites in a stretched cluster, while Failures to tolerate with RAID-1 controls local host/device protection. The behavior is also not evidence that a VM-level policy override exists. The datastore-level policy can still be applied correctly; ESA’s internal RAID-1 object layout uses three stripes as part of its optimized storage architecture. Reference topics: vSAN ESA Default Storage Policy Characteristics, Number of Disk Stripes per Object, RAID-1 Mirroring, vSAN Stretched Cluster Storage Policies.

A shallow rekey operation rotates only the Key Encryption Key (KEK). In vSAN Data-at-Rest Encryption, vCenter obtains or generates the KEK through the configured key provider, while ESX hosts use Data Encryption Keys (DEKs) to encrypt the actual disk or object data. The KEK is used to protect, or wrap, those DEKs. When a shallow rekey is performed, the underlying encrypted data does not need to be rewritten because the DEKs remain the same; only the KEK changes, and the existing DEKs are re-encrypted with the new KEK. This is why shallow rekey is faster and less disruptive than a deep rekey. A deep rekey generates both a new KEK and new DEKs, requiring re-encryption of data. The Host Key is used for encrypted core dumps, not datastore data encryption. Key Derivation Key is not the key rotated in this vSAN shallow rekey workflow. Reference topics: vSAN Data-at-Rest Encryption, Generate New Encryption Keys, Shallow Rekey, Deep Rekey, KEK and DEK lifecycle.

vSAN File Share SMB services are required because the storage must be consumed by Windows workstations and the application requires native NTFS permissions. SMB is the Windows-native file sharing protocol and integrates with Active Directory authentication. vSAN File Service supports SMB file shares, and Windows clients joined to the Active Directory domain configured with vSAN File Service can access those shares by using the SMB path. vSAN File Service also supports Microsoft Management Console for SMB shares, including Access Control List management, open file viewing, active sessions, and client connection management. These capabilities align directly with NTFS-style permission expectations for Windows-based graphic design workstations. vSAN File Service also supports two-node vSAN configurations, which matches the remote-site rack-space constraint of two hosts with a witness deployed remotely or in a shared location. NFSv3 does not provide native NTFS permissions for Windows clients. vSAN Storage Cluster and vSAN HCI Mesh address remote datastore capacity sharing, not SMB file access for Windows users. Reference topics: vSAN File Service, SMB File Shares, Active Directory Integration, Two-Node vSAN Support.

The correct process is to present the Fibre Channel LUNs from the storage array, rescan HBAs on each ESX host, create the VMFS datastore once, verify that the datastore is visible on all hosts, and confirm the result in vCenter. Fibre Channel storage requires correct SAN fabric zoning, LUN masking, host registration, and HBA discovery so that all hosts in the workload domain cluster can see the same shared LUN. After the array presents the LUN, each host must rescan its HBAs to discover the new storage device. VMFS is a clustered file system, so the datastore is created only once on the shared LUN. The datastore then becomes available to all hosts that have access to that device; it must not be independently formatted on each host. Creating the VMFS datastore separately on each host would risk datastore corruption or duplicate formatting. The final validation step is confirming datastore visibility and accessibility for all cluster hosts in vCenter. Reference topics: Fibre Channel Storage Model, HBA Rescan, Create VMFS Datastore, Shared VMFS Datastore Visibility.

Windows Server Failover Cluster shared disks require coordinated access to shared block storage. vSAN supports Windows Server Failover Clusters by providing SCSI-3 Persistent Reservation support at the virtual disk level, which allows cluster nodes to arbitrate access to a shared disk resource. One supported approach is to use the vSAN iSCSI Target Service, which presents vSAN-backed LUNs to initiators and can be used for clustered workloads that require shared block access. Another supported approach is to configure a shared virtual disk using a VMware Paravirtual SCSI controller with physical bus sharing. Physical bus sharing allows multiple VMs to access the same shared virtual disk in a WSFC configuration where supported. Raw Device Mapping is not the vSAN ESA-native solution for this requirement. NFS v4.1 is a file datastore protocol, not a WSFC shared block disk mechanism. “LSI SCSI controller per disk” does not satisfy the required shared-disk bus sharing configuration. Reference topics: vSAN Support for Windows Server Failover Clusters, SCSI-3 Persistent Reservations, vSAN iSCSI Target Service, Shared VMDK Configuration.

The support status is based on the VCF 9.0 Principal and Supplemental Storage model. vSAN ESA is supported as principal storage for the Management Domain default cluster, Management Domain additional clusters, and Virtual Infrastructure Workload Domains. A vSAN Storage Cluster is not supported for the Management Domain default cluster, but it is supported as principal storage for Management Domain additional clusters and VI Workload Domains. NFS storage supports principal and supplemental usage when the protocol is NFS v3; the table states “Principal (NFS v3)” and “Supplemental (NFSv3 and NFSv4.1)” across all three domain categories, so NFS v3 maps to Both. iSCSI is supported only as supplemental storage across the Management Domain default cluster, Management Domain additional clusters, and VI Workload Domains. This follows the VCF distinction where principal storage is used during workload domain or cluster creation, while supplemental storage is added after creation for workloads or data-at-rest use cases such as templates, backups, and ISO images. Reference topics: Storage Models, Principal Storage, Supplemental Storage, vSAN ESA, vSAN Storage Cluster, NFS, iSCSI.

The direct action is to convert the latency-sensitive OLTP workload policy from RAID-5/6 erasure coding to RAID-1 mirroring while keeping FTT=1. RAID-5/6 provides space efficiency, but it introduces parity operations and additional backend I/O, which can increase write latency during peak transactional activity and resynchronization. VMware states that RAID-1 mirroring requires fewer I/O operations to the storage devices and can provide better performance; cluster resynchronization also completes faster with RAID-1. This directly addresses the observed symptom: resync I/O and backend congestion increasing latency despite adequate network bandwidth. Increasing Object Space Reservation to 100% changes capacity preallocation but does not remove parity overhead or reduce write amplification from erasure coding. Increasing FTT to 2 with RAID-5/6 would increase protection overhead and backend work, making latency worse. Disabling checksums is not valid for ESA because object checksum is always enabled and cannot be deactivated. For ESA, compression can be controlled by policy, but the most direct protection-compliant performance action is RAID-1 FTT=1 for OLTP objects. Reference topics: vSAN Storage Policies, RAID-1 Mirroring, RAID-5/6 Erasure Coding, vSAN ESA Checksum, Resync and Congestion Metrics.

To deliver vSAN File Service for NFS shares in an Edge environment, the administrator must prepare the vSAN File Service network correctly. When a vSphere Distributed Switch is used, vSAN File Services are supported on DVS and require a dedicated distributed port group for vSAN File Services. During vSAN File Services enablement, MAC Learning and Forged Transmits are enabled for the provided DVS port group. If the design uses an NSX-based network, MAC Learning must be enabled on the provided NSX network entity from the NSX admin console, and the hosts and File Service nodes must be connected to the desired NSX network. For Edge-style network behavior, DVS 6.6.0 or later is required to support MAC Learning on the distributed port group, with ESX 6.7 or later. MAC Learning and Forged Transmits being disabled is therefore incorrect. Jumbo frames are not listed as a vSAN File Service requirement in this workflow. vSAN Witness functionality on each VMkernel is also unrelated; witness traffic applies to two-node or stretched-cluster quorum, not file-service delivery. Reference topics: vSAN File Service Network Considerations, DVS Port Group Requirements, NSX MAC Learning, Edge Networking.

Run the esxcli storage nfs list command.

Use vCenter Datastore Performance view to monitor NFS datastore latency, IOPS and throughput.

Create a vCenter performance alarm for “Datastore Latency (NFS)” to trigger when thresholds are exceeded.

The correct monitoring workflow is to verify NFS datastore presentation at the host layer, then use vCenter performance views and alarms for operational monitoring. The esxcli storage nfs list command confirms that the NFS datastore is mounted and visible to the ESX host, which is the first validation point before any performance assessment. vCenter Datastore Performance views provide the correct datastore-level telemetry for latency, IOPS, and throughput, including NFS-backed datastores. Creating a vCenter performance alarm for NFS datastore latency allows proactive alerting when the datastore exceeds the required latency threshold. The esxcli storage core device list command is intended for block storage devices and paths, not NFS datastores. The --verbose NFS option listed here is not the required method for collecting detailed performance metrics in this scenario. VCF Operations Logs is log-focused, not the correct graph source for NFS throughput validation. vSAN Performance Service applies to vSAN performance, not external NFS datastore monitoring. Reference topics: NFS Datastore Monitoring, vCenter Datastore Performance, NFS Host Validation, vCenter Performance Alarms.

Seven hosts per availability zone is required for this design. In a vSAN ESA stretched cluster, data components are distributed across two data sites, while a witness site provides quorum. The first requirement is a secondary level of resilience of FTT=2 using RAID-6 erasure coding. RAID-6 requires enough fault domains to place data and parity components while tolerating two failures. The second requirement is more restrictive: vSAN must be able to regain its prescribed level of resilience after a sustained host outage. This means the site must have enough remaining placement capacity to rebuild components and return objects to policy compliance after a host is lost. A six-host site can satisfy the RAID-6 placement minimum, but it does not provide the additional host needed to rebuild cleanly after a sustained host outage. Therefore, the design requires seven hosts in each availability zone. This produces fourteen data hosts across the stretched cluster, plus the witness. Reference topics: vSAN ESA Stretched Cluster Design, Secondary Level of Resilience, RAID-6 Erasure Coding, Availability Zone Host Count.

The administrator must create a datastore cluster from the three NFS datastores that are intended to host virtual machine workloads. The ISO datastore should not be included because datastore clusters should contain similar or interchangeable datastores used for the same purpose. All three NFS datastores must be available to each ESX host server so Storage DRS recommendations and VM placement are valid across the cluster. Storage DRS should be configured in Manual mode because the requirement states that migrations must occur only after administrator approval. Manual mode displays placement and migration recommendations but does not execute them automatically. The Storage DRS space threshold should be set to 50% so recommendations are generated when a datastore exceeds that utilization level. Setting the storage space utilization difference to 50% is not correct because that value controls the minimum difference between source and destination datastore utilization, not the trigger threshold itself. Fully Automated mode would violate the approval requirement by automatically applying migrations. Reference topics: Datastore Cluster Requirements, Storage DRS, Manual Automation Mode, Space Utilization Thresholds, NFS Datastores.

Four hosts are required to meet the 12 TB usable-capacity requirement after applying the protection policy, data reduction, reserves, and overhead. Each host contributes 8 TB raw capacity from two 4 TB NVMe devices. Three hosts provide 24 TB raw capacity, but once host rebuild reservation, 10% operational reserve, RAID-5 protection overhead, and 25% filesystem/object overhead are considered, the remaining effective usable capacity falls below the required 12 TB target. Four hosts provide 32 TB raw capacity. With vSAN ESA and FTT=1/RAID-5, vSAN uses erasure coding to improve capacity efficiency compared with mirroring. The vSAN sizing guidance states that RAID-5 with FTT=1 provides approximately 75% usable capacity before other reserves and overhead. Host Rebuild Reserve must also be planned so the cluster has enough free capacity to rebuild components after a host failure. After applying the expected 1.5 data reduction ratio and the required reserves, four hosts provide enough usable capacity while three hosts do not. Reference topics: vSAN ESA Capacity Sizing, RAID-5 Erasure Coding, Host Rebuild Reserve, Operations Reserve, vSAN Object Overhead.

When vSAN Data-at-Rest Encryption uses an external KMS, vCenter requests a Key Encryption Key (KEK) from the KMS and stores only the key ID, not the key itself. ESX hosts use the KEK to decrypt the Data Encryption Keys that protect the encrypted vSAN disk data. If a host reboots, it must retrieve the KEK from the KMS before its encrypted vSAN disk groups can be mounted. The guide states that when a host reboots, it does not mount its disk groups until it receives the KEK. Key persistence can allow continued operation when the key server is unavailable, but the documented persistence mechanism relies on TPM-backed key persistence across reboots. In this scenario, the host does not have a Trusted Platform Module and the KMS is temporarily unavailable. Therefore, the ESX host can boot, but the encrypted storage remains unavailable and unmounted until communication with the KMS is restored. Reference topics: vSAN Data-at-Rest Encryption, External KMS, Key Encryption Key, Encryption Key Persistence.

vSAN ESA Storage Clusters are the optimal choice because the workload profile is capacity-heavy and benefits from disaggregated storage. The requirement for 2.5 PB of application data, archival workloads, gateways, and development/test applications indicates a need to scale storage capacity independently from compute resources. VMware Cloud Foundation describes a vSAN storage cluster as a disaggregated storage solution based on vSAN ESA. It provides storage resources but not compute resources, and its datastore can be mounted by vSAN compute clusters or vSAN HCI clusters. This model is designed for storage-dense environments where capacity and performance can be expanded without adding unnecessary compute. A standard vSAN ESA HCI cluster is excellent for high-performance workloads, but it scales compute and storage together. vSAN OSA all-flash and hybrid use the older disk-group architecture and are less suitable for this large-capacity, storage-centric design. Therefore, the principal storage recommendation should be vSAN ESA Storage Clusters to meet scalability, performance, and capacity growth requirements. Reference topics: vSAN Storage Cluster, Disaggregated Storage, vSAN ESA, Storage Models.