Domain 1: 2.1 Private Cloud Vision
- A private cloud adds on-demand self-service under governance to virtualization: application teams draw machines, namespaces and networks from a catalog within quotas and policies, instead of raising a ticket for a platform team to build each workload by hand.
- VCF 9.0 delivers the private cloud as a fleet: one VCF Operations and one VCF Automation manage every VCF instance across sites, and both are mandatory parts of the fleet rather than the optional add-ons they were in 5.x.
- VMware vSphere Foundation (VVF) is the workload platform without the cloud management layer; VMware Cloud Foundation adds SDDC Manager, the NSX overlay, VCF Automation, Identity Broker, Operations for Networks and HCX. Pick VVF for a small site that needs vSphere and operations only.
- The value proposition rests on a validated stack lifecycled together, consistent operations from one console, and consumption that looks like a public cloud while data stays in the customer's own data centres.
- Data sovereignty and regulated workloads favour private cloud because the organization controls where data resides, who can reach it, and which compliance benchmarks are enforced.
- Licensing in 9.0 is subscription based: the VCF license is counted per physical core with a minimum of 16 cores per CPU, and vSAN is licensed per TiB. Consolidating workloads onto fewer well-utilized hosts is the main lever on licensed cores.
- FinOps in VCF Operations gives cost drivers, pricing policies, showback and chargeback so a platform team can attribute spend; capacity What-If Analysis models adding or removing hosts before hardware is ordered.
- Cloud repatriation, edge and retail fleets, VDI locality, developer and Kubernetes consumption, and Private AI on GPU-accelerated Supervisors are the use cases the exam expects you to recognise.
- Converging an existing vSphere estate into VCF is itself a private cloud use case: the running vCenter is imported rather than rebuilt, and gains fleet lifecycle, operations and automation.
- Consistent infrastructure means every workload domain is built the same way from the same images and policies, which is what makes fleet-wide compliance scanning and drift detection meaningful.
Domain 2: 2.2 VMware Compute Fundamentals
- ESX (renamed from ESXi in 9.0) is the bare-metal hypervisor on every host; the NSX and vSAN data paths are kernel modules inside it, which is why the host is the foundation the rest of the stack depends on.
- ESX 9 installs from the VMware-VMvisor installer image onto a persistent boot device of at least 32 GB, with 128 GB advised for ESX-OSData; SD cards and USB are no longer suitable for OSData.
- vCenter 9 deploys as an appliance in two stages and needs forward and reverse DNS for its FQDN plus reachable NTP; joining hosts with a large clock offset fails.
- vSphere Configuration Profiles replace the deprecated Host Profiles for keeping every host in a cluster configured identically; vSphere Lifecycle Manager images replace baselines, which are no longer supported in 9.0.
- Live Patch applies eligible ESX patches without maintenance mode, reboot or VM migration; it requires an image-managed cluster with DRS enabled and now covers user-space patches and NSX transport node updates.
- A 9.0 cluster image can carry additional hardware-specific definitions, so servers from different vendors with different firmware add-ons can share one cluster instead of being split.
- vSphere HA admission control reserves failover capacity; restart priority overrides sequence recovery. DRS automation levels and per-VM overrides govern placement, and custom EVC modes in 9.0 expose the highest CPU feature set common to the selected hosts.
- Virtual hardware version 22 brings 960 logical processors, TPM 2.0 library revision 1.59, Intel TDX and AMD SEV-SNP support and 4Kn virtual disks; vTPM needs a key provider configured first.
- VM encryption in 9.0 supports wrapped key mode, where one raw key protects many wrapped keys to conserve KMS resources; shallow recrypt changes the wrapping key while deep recrypt rewrites the data.
- Full clones are independent of their source; linked and instant clones stay dependent on the parent disk or memory. Snapshots form a delta chain and quiescing needs VMware Tools.
- vMotion in 9.0 adds vGPU cold data pre-copy that cuts checkpoint size and downtime; a CPU-feature mismatch that blocks vMotion is fixed with EVC, and a move with no shared datastore needs compute plus storage migration.
- Content libraries publish templates, OVF and ISO items to subscribers; guest customization specifications personalise clones; tags and their category cardinality organise inventory across vCenter instances.
Domain 3: 2.3 VMware Storage Fundamentals
- vSAN ESA is the default for new VCF 9.0 workload domains when eligible ReadyNode hardware is detected and is the preferred architecture; vSAN OSA remains fully supported for existing clusters, so neither is wrong, but new designs start from ESA.
- ESA is a single-tier NVMe design with no cache device and no disk groups, delivering RAID-5 and RAID-6 erasure coding without the performance penalty OSA carried; OSA pairs a cache device with capacity devices in disk groups.
- The VCF Installer needs at least 3 ESX hosts when vSAN (ESA or OSA) is the principal storage and 2 hosts when the management domain uses external storage over Fibre Channel VMFS or NFS.
- Workload domain principal storage choices are vSAN, NFS v3, Fibre Channel VMFS and vVols; vVols is deprecated in 9.0 and should not back new designs. NFS 4.1 and NVMe over TCP are supplemental datastore options.
- A vSAN storage cluster is disaggregated storage: it runs no workloads, is built on ESA-certified hosts with a four-host minimum (six recommended), is mounted by compute clusters, and cannot back the management domain.
- Storage Policy-Based Management attaches a policy to a VM, VMDK or namespace; the policy sets Failures to Tolerate, RAID method, stripe width and reservations, and vSAN places components to satisfy it.
- FTT=1 needs three hosts with RAID-1 mirroring or four with RAID-5; FTT=2 needs five hosts with RAID-1 or six with RAID-6. Fault domains group hosts by rack so a rack failure counts as one failure.
- A stretched cluster keeps the two data sites within the supported vSAN round-trip limit, commonly 5 ms, with a routed path to a witness site under its own more generous latency budget; a two-node cluster can share a witness.
- ESA compression is per object and always on; OSA deduplication and compression are a cluster toggle whose deduplication domain is the individual disk group. vSAN 9.0 adds global deduplication that spans clusters.
- TRIM/UNMAP must be enabled at the cluster level so guest deletions return capacity on thin-provisioned objects; without it reported usage only grows.
- After a host failure and recovery, resync traffic rebuilds components and competes with guest I/O, so a temporary rise in write latency during resync is expected rather than a fault.
- Boot from NVMe over Fibre Channel and NVMe over TCP is supported in ESX 9; 4Kn virtual disks require hardware version 21 or later on 4Kn-capable devices.
Domain 4: 2.4 VMware Network Fundamentals
- Component roles: the distributed switch owns uplinks and port groups, NSX Manager configures but forwards nothing, transport nodes terminate Geneve tunnels on the host, Edge nodes host the Tier-0 and Tier-1 service routers, and Avi Load Balancer supplies load balancing.
- Tier-0 gateways handle north-south traffic to the physical fabric with BGP or static routing; Tier-1 gateways connect tenant segments to a Tier-0. Only a Tier-0 can peer with the fabric.
- Overlay transport uses Geneve on UDP 6081 and needs at least a 1600-byte MTU end to end; VXLAN ports 4789 and 8472 are both supported for interoperability. Enhanced Data Path standard is the 9.0 default forwarding mode.
- VCF 9.0 introduces a simplified network connectivity workflow, available in both NSX and vCenter, built on Virtual Private Clouds and Transit Gateways, natively multi-tenant and consumable from VCF Automation.
- Centralized connectivity is for environments needing full NSX services such as DHCP, NAT and Layer 3; it requires Edge nodes, provisions Tier-0 gateways from NSX and connects through a Centralized Transit Gateway to the fabric with BGP or OSPF.
- Distributed connectivity needs no Edge nodes: it runs on the ESX hosts using existing VLAN and IP configuration through a Distributed Transit Gateway, offers 1:1 NAT and distributed DHCP, and requires the same VLAN on every top-of-rack switch where the hosts offering VPCs connect.
- Both connectivity models require the ESX cluster to have distributed switch uplinks configured; a VPC attaches to a Transit Gateway, and the VPC connectivity profile is where external connectivity is defined and the Virtual Network Appliance cluster configured.
- VPC subnet types: private (VPC-internal, the default, needing NAT to leave), external (routable public IPs for LoadBalancer services and project egress), and private transit gateway subnets (routed between VPCs of one NSX project without translation).
- An NSX Project is the tenant policy boundary with its own groups, segments and distributed firewall rules on the shared fabric; VPCs inside a project give self-service networking under provider quotas.
- The distributed firewall ships with an any-to-any allow rule at the bottom so installing NSX does not break workloads; policy is built above it before the default action is switched to drop. The gateway firewall is disabled by default in 9.0.
- Stateful services on an active/active Tier-0 have been supported since NSX 4.0.1 and need an interface group holding one equivalent uplink from each service router; ECMP across uplinks and redundant Edge nodes give north-south resilience.
- Distributed IDS/IPS inspects east-west traffic for signatures inside the hypervisor with no hairpin to an appliance; the DNS forwarder, DHCP, NAT and VPN are gateway services, and VCF Operations for Networks observes flows rather than enforcing anything.
Domain 5: 4.1 VCF: Deploy and Configure
- A VCF fleet is the top-level scope: fleet-level components are VCF Operations (single node or three-node cluster plus collectors), VCF Operations fleet management, VCF Operations for Logs and for Networks, VCF Automation and VCF Identity Broker. Instance-level components are SDDC Manager, vCenter, NSX and ESX.
- A VCF instance has one management domain and zero or more VI workload domains; a domain groups ESX hosts managed by one vCenter instance. Fleet designs span a single availability zone, two zones with stretched clusters, two regions for disaster recovery, or both.
- The VCF Installer replaces Cloud Builder and the deployment parameter workbook. It ships in the same OVA as SDDC Manager, is deployed on a network that reaches the ESX hosts, and drives deployment from a wizard or a JSON specification after validation.
- Binaries reach the Installer from the online depot at dl.broadcom.com using a download token generated on the Broadcom Support Portal, or from an offline depot filled by the VMware Cloud Foundation Download Tool, the only supported offline method.
- The first deployment builds the management domain and the fleet components; VCF Operations Orchestrator is always deployed manually afterwards, Identity Broker is an optional three-node cluster, and Operations for Networks and for Logs are added through VCF Operations automation. VCF Automation can be deferred to a day-N task.
- The SDDC Manager UI is deprecated in 9.0 and its workflows moved to VCF Operations and the vSphere Client; SDDC Manager remains the orchestration appliance and API inside each instance.
- Host commissioning happens in the vSphere Client (Global Inventory Lists, Unassigned Hosts) with prerequisites such as cleared disk partitions, forward and reverse DNS, a certificate regenerated to the FQDN, a 10 Gbps NIC and a matching network pool; workload domain creation happens in VCF Operations, which deploys the vCenter and NSX Manager for the domain.
- The VCF Network Gateway objective is the 9.0 connectivity workflow: choose centralized connectivity (Edge nodes, Tier-0 from NSX, Centralized Transit Gateway, BGP or OSPF) when full NSX services are needed, or distributed connectivity (no Edge nodes, Distributed Transit Gateway, 1:1 NAT and distributed DHCP) for minimal fabric change; both need VDS uplinks.
- Workload domain storage is chosen at creation: vSAN with the ESA toggle (default), vSAN storage cluster, NFS, VMFS on FC, or deprecated vVols. vSAN needs 3 hosts and external storage needs 2; a vLCM cluster image is a domain prerequisite.
- VDS profiles at domain creation (Default, Storage Traffic Separation, NSX Traffic Separation, Storage and NSX Traffic Separation, Custom) decide how vSAN, vMotion and overlay traffic share or split uplinks.
- Supervisor is enabled by default at domain creation or later in vCenter; with VCF networking it needs centralized connectivity with an active-standby Tier-0, an NSX project and VPC connectivity profile, transit and private CIDRs and a control-plane range of at least five addresses. A vSphere zone maps to one cluster and single-zone cannot become multi-zone later.
- Stretching a cluster across two availability zones uses a JSON specification through the SDDC Manager API and needs the data-site round trip within the vSAN limit plus a routed path to the witness.
Domain 6: 4.2 VCF: Manage
- Fleet Management in VCF Operations covers lifecycle, certificates, passwords, identity and access, licensing, backup and restore, tags, configuration profiles and drift, and orchestrated shutdown and startup; VCF Operations is the preferred console for all of them in 9.0.
- Lifecycle: fleet management uses fleet lifecycle, SDDC lifecycle and software depot components to deliver major, minor, maintenance and patch releases against a validated Bill of Materials; run the upgrade precheck for the domain and clear every error before executing a plan. SDDC Manager itself can be patched from VCF Operations.
- The depot is configured online with a Broadcom download token or offline through the VCF Download Tool; the Installer supports major, minor and maintenance releases but not express patches.
- Identity: VCF Identity Broker provides single sign-on across components, federating Active Directory over LDAPS, Okta, Microsoft Entra ID and other providers. Integrated Windows Authentication is discontinued and users must be in UPN format; domain\username is not supported.
- RBAC: built-in roles such as VCF Administrator, VCF Viewer, SDDC Administrator and SDDC Viewer scope what a user can do; separation of duties is implemented by splitting submitter and approver privileges, not by policy wording.
- Licensing: subscription license files replace 25-character keys. Licenses are assigned only to vCenter instances and every connected ESX host is licensed automatically; management lives in VCF Operations and the VCF Business Services console, with a 90-day evaluation, connected or disconnected mode, and after expiry management operations stop.
- Certificates: VCF Operations shows expiry across components, generates CSRs and installs certificates from VMCA, a Microsoft CA, OpenSSL or a third-party CA; expiring certificates surface as VCF Health findings before they break services.
- Passwords: VCF Operations updates, rotates and remediates component passwords on a schedule; SDDC Manager is retained for local and application accounts when required, and an out-of-band change must be remediated so the stored credential matches.
- Backup and restore for SDDC Manager, vCenter and NSX is configured from VCF Operations to an external SFTP target with an encryption passphrase that is not stored in the backup; VCF Automation restore needs the fleet SFTP server and a recent backup.
- Importing an existing vCenter: the VCF Installer converge path makes it the management domain of a new instance, while the VCF Operations import path adds it as a VI workload domain. VCF Installer 9.0.1 added support for vCenters with existing NSX registrations that do not use Enhanced Linked Mode.
- Convergence blockers include Enhanced Linked Mode with NSX, baseline-managed clusters, manual or partial DRS automation, partial cluster imports and vCenter High Availability; fully automated DRS, Supervisor-enabled clusters and stretched vSAN clusters are supported.
- vCenter Enhanced Linked Mode is deprecated in favour of VCF Operations grouping (vCenter linking), which does not replicate tags between instances; Host Profiles and vSphere Lifecycle Manager baselines are likewise retired from new work.
Domain 7: 4.3 VCF: Operations
- VCF Operations is the fleet console for monitoring, capacity, cost, compliance and troubleshooting. Deployment models are a single node, a three-node high-availability cluster, or continuous availability across two fault domains with a witness in a third site and about 10 ms between the zones.
- Node roles are primary, replica, data and witness; a cloud proxy (VCF Operations collector) is deployed by default in every workload domain to collect metrics, forward logs and run Log Assist, and collectors can be grouped.
- Metrics are time-series measurements such as CPU usage; properties are configuration attributes such as host version. Views (list, summary, trend, distribution) and scheduled reports present them; dashboards combine widgets and can be shared to groups.
- Alerts are built from symptoms and symptom sets into alert definitions with health, risk or efficiency impact and recommendations; notifications go out through outbound methods such as email and webhooks, and policies decide which alerts are enabled for which objects.
- Policies form a priority list with the Default Policy at the bottom; a directly assigned policy wins over an inherited one, and policies control thresholds, alert and symptom definitions and capacity settings per object group.
- VCF Operations for Logs is the log platform: native log analysis, RFC 5424 normalisation, queries, log alerts, dashboards and forwarding. Diagnostic Findings needs it for log-based and historical scans. Forwarding logs centrally keeps them past an appliance rebuild and correlates events across components.
- VCF Health continuously checks connectivity, utilisation and services across vCenter, ESX, NSX and vSAN, surfacing expired certificates, NTP drift, DNS problems and configuration errors; Diagnostics adds Diagnostic Findings for known product issues and VMSA security exposures, and Log Assist sends support bundles to Broadcom without an external FTP client.
- VCF Operations for Networks gives flow-level visibility, NSX Manager, transport node and Edge health, VPC dashboards, application discovery and micro-segmentation analysis. From 9.0 only one instance integrates per VCF Operations and its adapter is created and managed by the system.
- Storage operations centralise vSAN cluster health, capacity, deduplication and compression savings, and vSAN Performance Diagnostics for throughput, IOPS and latency; capacity What-If scenarios model adding hosts against the demand trend.
- Application monitoring installs a Telegraf agent to add in-guest operating system and application service metrics to what the vCenter adapter already sees from the hypervisor.
- Compliance benchmarks include VMware SDDC and VCF hardening plus CIS, DISA STIG, FISMA, HIPAA, ISO and PCI DSS, with custom benchmarks built from compliance alert definitions and scored per object; the 9.0 security operations dashboard shows the live posture.
- Configuration drift compares vCenter instances against templates and vSphere clusters against configuration profiles, reporting Not Drifted, Drift Detected, Drift Check Failed or Unavailable on a schedule so remediation can follow.
Domain 8: 4.4 VCF: Consume and Automate
- VCF Automation delivers a self-service private cloud on the vSphere Supervisor platform, exposing virtual machines, Kubernetes, networking, volumes, databases, secrets, DNS, certificates, Harbor registries and AI workloads as services to application teams.
- It deploys as a single node or a three-node high-availability cluster, depends on a Supervisor and on VCF Identity Broker for users, and embeds VCF Operations Orchestrator for workflow extensibility.
- Two roles: the Provider administrator manages shared infrastructure, Regions, quotas, provider networking, provider content libraries and organizations; the Organization administrator manages projects, users, namespaces, organization networks, catalogs and policies inside one organization.
- Organizations are the tenancy boundary. All Apps organizations map projects onto vSphere Namespaces plus a VPC and consume the full service set; VM Apps organizations are self-contained for teams continuing from Aria Automation and do not require a Supervisor.
- A Region groups compute, storage and networking from one or more Supervisors across vCenter instances managed by the same NSX Manager; Supervisors in a region need matching storage class names, Kubernetes versions and IaaS services, and regional quotas allocate the region to organizations.
- Provider networking: a provider gateway is discovered from an existing Tier-0 or Tier-0 VRF in active-standby mode and associated with up to five IP spaces; IP spaces carry private CIDRs, transit gateway blocks and provider-managed external blocks for SNAT, and consumption is capped by an IP space quota that an organization can override.
- Organization networking: a VPC is an isolated domain of networking resources associated with one or more namespaces, built from a provider-preconfigured connectivity profile, with private, external and private transit gateway subnets and one transit gateway per organization.
- A provider content library is created per region with a storage class and shared read-only with all organizations; it holds ISO and OVA/OVF items. Organization libraries are private and per region.
- Content: catalogs are backed by blueprints and templates; VM Service deploys from ISO or OVF with VADP-based backup and disk-level restore; vSphere Kubernetes Service 3.3.1 (Kubernetes 1.32) provisions conformant clusters and autoscales; Volume Service adds PVC snapshots and RWX; Data Services offers PostgreSQL and MySQL; Secret Store, External DNS and Harbor complete the set.
- Governance is policy as code in YAML: approval, lease, day-2 action and IaaS resource policies are authored by the organization administrator and scoped to the organization or a project, with quotas enforcing capacity.
- Extensibility uses embedded VCF Operations Orchestrator workflows, event subscriptions on VM lifecycle topics such as allocation and post-provision, and the Terraform provider with GitOps for declarative management.
- Supervisor-based services are installed from the Supervisor Services catalog; VKS itself ships as a Supervisor Service in 9.0, and installing a service makes it consumable from every namespace on that Supervisor.
VMware VCP-VCF Administrator (2V0-17.25) exam tips
- Read every scenario for its generation. The exam is VCF 9.0: Cloud Builder and the parameter workbook are gone (VCF Installer), Aria products are VCF Operations and VCF Automation, ESXi is ESX, the SDDC Manager UI is deprecated with its workflows in VCF Operations and the vSphere Client, and license keys are subscription files assigned to vCenter instances.
- Know where each day-1 and day-2 task lives in 9.0: host commissioning in the vSphere Client, workload domain creation and every fleet-management task (lifecycle, certificates, passwords, licensing, backup, identity) in VCF Operations, tenant consumption in VCF Automation.
- For networking, separate the two 9.0 connectivity models. Centralized needs Edge nodes, a Tier-0 and a Centralized Transit Gateway and gives full NSX services; distributed needs no Edge nodes, uses a Distributed Transit Gateway with the same VLAN on every ToR, and offers only 1:1 NAT and distributed DHCP. Both need VDS uplinks.
- Keep the storage minimums straight: 3 ESX hosts for vSAN (ESA or OSA) and 2 for FC or NFS in the Installer; 4 hosts for a vSAN storage cluster, which cannot back the management domain; ESA is the default and preferred while OSA stays supported; RAID-1 FTT=1 needs 3 hosts, RAID-5 needs 4, RAID-1 FTT=2 needs 5, RAID-6 needs 6.
- Objectives 4.3 and 4.4 are 26 of the 59 published bullets. Expect metrics versus properties, alert definitions versus symptoms versus policies, VCF Health versus Diagnostic Findings versus Log Assist, provider versus organization administrator, All Apps versus VM Apps organizations, and Region, IP space, provider gateway and VPC as distinct objects.
Study guide FAQ
Which product version does the 2V0-17.25 exam test?
VMware Cloud Foundation 9.0. Broadcom's exam guide states verbatim that the content is based on VCF 9.0 and directs candidates to the 9.0 release notes. Material written for VCF 5.x (Cloud Builder, the parameter workbook, Aria Suite Lifecycle, the SDDC Manager UI as the console) describes a different product generation and will steer you to wrong answers.
What is the difference between a VCF fleet, a VCF instance and a workload domain?
A fleet is the top-level management scope: one VCF Operations and one VCF Automation manage every VCF instance in it, across sites. A VCF instance has exactly one management domain (SDDC Manager, the management vCenter and NSX Manager cluster) plus zero or more VI workload domains. A domain is a logical unit of ESX hosts managed by one vCenter instance; VCF Operations deploys the vCenter and NSX Manager for each new workload domain while SDDC Manager orchestrates the underlying host and cluster operations.
What does SDDC Manager still do in VCF 9.0 if its UI is deprecated?
SDDC Manager remains the orchestration appliance and API inside every VCF instance: it commissions and manages hosts, creates and expands workload domains, manages network pools and stretches clusters, and can still manage local and application account passwords. What changed is where the administrator works: those workflows are surfaced in VCF Operations and the vSphere Client, and VCF Operations is the preferred console for lifecycle, certificates, passwords, licensing and backup.
How is a VCF 9.0 environment licensed?
Through subscription license files rather than 25-character keys. You assign licenses only to vCenter instances in VCF Operations, and every ESX host connected to a licensed vCenter is licensed automatically. Two license types exist: VMware Cloud Foundation, counted per physical core with a minimum of 16 cores per CPU, and vSAN, counted per TiB. New deployments run in a 90-day evaluation, license usage is reported in connected or disconnected mode, and the VCF Business Services console shows the estate.
Official exam sources
The domain names and weightings on this page follow the published exam blueprint. Each source below records what it confirmed and when it was read, so the split can be checked rather than taken on trust.
- Broadcom - VCP-VCF Administrator (2V0-17.25)link and content verified 8 September 2026"Duration: 135 Minutes", "Number of Questions: 60 (English)", "Passing Score: 300", $250, and the required exam is VMware Cloud Foundation 9.0 Administrator (2V0-17.25) - our exam code. OUR GUIDE SAID "the 120-minute exam has roughly 663 questions in the bank, with a scaled passing score of 600": every one of those three numbers was CertGrid's, not Broadcom's, and the sentence presented them as the exam's. Corrected to 60 questions, 135 minutes, passing 300, with the pool and threshold labelled as practice figures. Read through a rendered browser; broadcom.com serves this detail from a JavaScript application.