Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
An architect is reviewing the security and compliance requirements for a new application that will be hosted on a vSphere 8 environment.
The following information has been noted about the new application:
The application stores and processes confidential data
The supporting virtual infrastructure is shared with other departments
No other application stores or processes confidential data
The application virtual machines must be able to run on any ESXi host in the cluster
The storage layer is a iSCSI attached SAN
Data at Rest Encryption is in place for each presented LUN validated to FIPS 140-2
No budget is available for additional infrastructure components or software
Application data must not be accessible outside of the application's virtual machines
The architect has been tasked with providing a secure virtual machine design to host the application.
Which three design elements must the architect include to meet the requirements? (Choose three.)
Virtual Machine Encryption
To ensure that the application's confidential data is protected, Virtual Machine Encryption should be applied. This will ensure that even if someone gains access to the storage layer or the underlying infrastructure, the data in the virtual machine is encrypted and cannot be accessed outside of the VM, as required by the security and compliance requirements.
The vSphere Native Key Provider
The vSphere Native Key Provider can be used to manage encryption keys within the vSphere environment. Since no budget is available for additional infrastructure components or software, leveraging vSphere's native capabilities for key management ensures that encryption is securely handled without introducing external dependencies. This also aligns with the requirement to not introduce additional infrastructure.
External Key Management Service (KMS) provider
While the vSphere Native Key Provider can manage keys within the environment, if there is a requirement for a more secure or compliant key management solution, an External Key Management Service (KMS) may be used. The KMS provider allows for centralized management of encryption keys, ensuring that the keys are securely stored and controlled according to compliance standards (e.g., FIPS 140-2). Although the Native Key Provider may suffice, this option ensures that key management adheres to stricter compliance needs, especially for confidential data.
An architect is reviewing the information provided by a customer for a new vSphere solution design. The customer has stated that some of the virtual machines (VMs) that will be hosted on the new solution handle credit card information from their users as part of an online payment application, and that some of the information will need to be stored temporarily to allow transactions to be completed. Therefore, the solution must be designed to be able to mask or hash the stored information as they will need to show compliance against common industry standards that contain references to the requirements for handling sensitive information.
Which design quality is being requested by the customer?
The customer is requesting that the solution meet security requirements, specifically around handling sensitive information (such as credit card data). The need to mask or hash stored information for compliance with industry standards (e.g., PCI-DSS) is a security-focused design requirement. This ensures that sensitive data is protected and compliant with regulations, making security the primary design quality being requested.
An architect is holding a requirements workshop with a customer for a new vSphere solution design. The customer states that the solution should make it easy to identify and apply patches or updates to ESXi hosts, including the ability to pre-stage the files on the ESXi hosts.
Which design quality is being referenced by the customer?
The customer's requirement for making it easy to identify and apply patches or updates to ESXi hosts, including pre-staging the files, is focused on simplifying the management of the vSphere environment. This is a key aspect of manageability, which refers to the ease with which IT administrators can handle tasks like patching, updates, and configuration management in a consistent and efficient manner.
An architect is responsible for the lifecycle management design for a brownfield vSphere-based solution.
The following information has been provided during initial meetings around the new solution:
Existing heterogeneous server hardware will be used to provide the hosting platform.
The available hardware is:
- 10 servers that contain 2 x 20-Core Intel Xeon processors and 512GB RAM from Vendor A
- 10 servers that contain 2 x 24-Core Intel Xeon processors and 768GB RAM from Vendor A
- 20 servers that contain 2 x 16-Core AMD EPYC processors and 512GB RAM from Vendor B
- 10 servers that contain 1 x 24-Core AMD EPYC processors and 256GB RAM from Vendor B
All of the hardware is currently listed on the VMware Hardware Compatibility List (HCL).
All existing server hardware has 36months vendor support remaining.
The requirements from the customer are:
REQ001 - The solution must support the hosting of 5,000 workloads spread across two physical sites.
REQ002 - The solution should minimize the number of clusters.
REQ003 - The solution must ensure that there is no impact to service when completing upgrades.
Given the resource requirements needed for the solution, the architect has calculated that all of the existing servers will be required to provide sufficient resources for the new environment. The Intel-based (Vendor A) servers will be deployed to the primary site and both the Intel-based and AMD-based servers (Vendor B) will be deployed to the secondary site.
Which assumption should the architect make to support the lifecycle management of vSphere 8?
vSphere Lifecycle Manager (vLCM) is used to manage ESXi host configurations and software versions in a consistent and streamlined manner. In this case, the architect needs to account for the heterogeneous hardware across two sites (Intel and AMD-based servers).
Since Intel and AMD processors are incompatible for remediation with a single vSphere Lifecycle Manager image, the different processor architectures should be grouped by site (not across sites). Within each site, vLCM can manage a single image per processor architecture, ensuring that each site's hosts with compatible processors are remediated consistently. Intel-based servers will be managed with one image and AMD-based servers with another image, but they can be managed in separate sites.
This approach avoids the issue where heterogeneous hardware with different processor types would need separate images. By keeping them within the same site, the architecture simplifies the lifecycle management and meets the requirement for minimizing clusters and ensuring service availability during upgrades.
An architect is documenting the design for a new multi-site vSphere solution. The customer has informed the architect that the workloads hosted on the solution are managed by application teams, who must perform a number of steps to return the application to service following a failover of the workloads to the secondary site. These steps are defined as the Work Recovery Time (WRT). The customer has provided the architect with the following information about the workloads:
Critical workloads have a WRT of 12hours
Production workloads have a WRT of 24hours
Development workloads have a WRT of 24hours
All workloads have an RPO of 4hours
Critical workloads have an RTO of 1hour
Production workloads have an RTO of 12hours
Development workloads have an RTO of 24hours
The customer has also confirmed that the Disaster Recovery solution will not begin the recovery of the development workloads until all critical and production workloads have been recovered at the secondary site.
What would the architect document as the maximum tolerable downtime (MTD) for each type of workload in the design?
The Maximum Tolerable Downtime (MTD) is the maximum time that an application or system can be unavailable before it negatively impacts the business. The MTD is calculated by adding the Recovery Time Objective (RTO) to the Work Recovery Time (WRT). Here's how it applies to each workload type:
- RTO: 1 hour (time to restore the system to a usable state after failure).
- WRT: 12 hours (the time to get the application fully back to service).
- MTD = RTO + WRT = 1 hour + 12 hours = 13 hours.
- RTO: 12 hours (time to restore the system to a usable state after failure).
- WRT: 24 hours (time to get the application fully back to service).
- MTD = RTO + WRT = 12 hours + 24 hours = 36 hours.
- RTO: 24 hours (time to restore the system to a usable state after failure).
- WRT: 24 hours (time to get the application fully back to service).
- MTD = RTO + WRT = 24 hours + 24 hours = 48 hours.
92 questions covering all exam domains, starting from $20
Exam domains verified against: Official VMware 3V0-21.23 exam guide, last checked September 2026.
Differentiate between business and technical requirements and between conceptual, logical, and physical design phases. Apply the AMPRS framework (Availability, Manageability, Performance, Recoverability, Security) to structure design decisions around these five pillars of enterprise architecture.
Sample question from this domain above: Q4
Describe VMware Cloud Foundation and Validated Solutions architectures, their components, benefits, and appropriate use cases. Understand how these solutions provide integrated, pre-validated stacks for common enterprise requirements.
Sample question from this domain above: Q5
Gather business objectives and requirements, create conceptual, logical, and physical designs for vSphere environments. Make design decisions for capacity planning, scalability, lifecycle management, availability, performance, security, and recoverability that align with business Service Level Objectives.
Common questions about the exam itself
