Use this domain to connect VCF architecture choices to administrable operating models: governed self-service, Aria Automation projects, cloud zones, catalog items, approvals, leases, quotas, and network mappings.
Practice Question: Development and finance teams need separate self-service catalogs. Development can deploy short-lived test VMs, while finance requires approval and a restricted network. What design area addresses this requirement? A. Aria Automation projects, cloud zones, catalog items, policies, leases, approvals, and network mappings. B. A larger vSAN storage policy for the management domain only. C. NSX Edge uplink MTU settings without catalog or project policy. D. ESXi host boot mode selection for all clusters.
Correct Answer: A
Explanation: Option A is correct because it governs who requests resources, where they deploy, which policies apply, and how networks are assigned. Option B affects storage only. Option C is a network transport detail without self-service governance. Option D is a host configuration choice unrelated to catalog consumption.
Exam Takeaway: Self-service is governed placement, not just a catalog. Always ask who can deploy, where it lands, what policy applies, and who owns day-2 operations.
Self-service in VCF is a consumption design, not just a catalog page. Projects, cloud zones, catalog items, approvals, quotas, leases, images, networks, and day-2 actions determine who can deploy what, where it lands, how long it lives, and which governance rule is enforced.
The why-layer is policy containment. Without project boundaries and placement logic, automation can bypass the architecture by deploying into the wrong network, consuming unplanned capacity, or creating workloads with no lifecycle owner. Exam questions often place quota, approval, or tenant wording in the stem to pull the answer toward Aria Automation governance rather than vSphere or NSX configuration alone.
| Object | Attribute | Value Range | Default State | Dependency | Failure State |
|---|---|---|---|---|---|
| Project | Tenant and ownership boundary | Team, user group, quota, approval scope | Undefined until governance design | Identity source and cloud zone | Requests are not tied to accountable owners |
| Cloud zone | Placement boundary | VCF domain, cluster, tag, capability, region/site | Not useful until mapped | vSphere endpoint and capacity model | Deployments land in unintended domains or clusters |
| Catalog item | Requestable service definition | Blueprint/template, inputs, network choice, policy hooks | Hidden until published | Image/flavor/network mappings | Users request inconsistent or unsupported workloads |
| Approval and lease policy | Consumption control | Approval chain, lease duration, quota, day-2 entitlement | No governance unless configured | Project and business owner | Resource sprawl or unauthorized deployment |
| Network mapping | Deployment network placement | NSX segment, network profile, routed/isolated choice | Undefined until designed | NSX and cloud zone integration | VMs deploy onto wrong network or security boundary |
A self-service request enters the automation layer through a project and catalog item. Placement logic selects a cloud zone and infrastructure target, policies apply quotas, approvals, leases, and naming, and network mappings bind the deployment to allowed segments. If any governance link is missing, the request can bypass the architecture even when the underlying VCF infrastructure is healthy.
| Task | Precise Command or Path | Verification Standard |
|---|---|---|
| Validate tenant governance | Aria Automation UI/API evidence: inspect projects, catalog items, policies, quotas, approvals, and leases | Each tenant has the intended consumption limits and approval behavior |
| Validate placement logic | Automation design review: inspect cloud zones, image mappings, flavor mappings, and network mappings | Deployments land only in approved VCF domains, clusters, and networks |
| Review supporting evidence | Conceptual verification method: compare design decision, dependency register, and acceptance evidence | The selected object, rationale, risk treatment, and validation evidence are traceable without relying on an unverified CLI syntax |
| Check VCF inventory context | SDDC Manager UI or supported API inventory view, version-aware | The relevant domain, cluster, component, and lifecycle-managed product boundary are visible and match the design scenario |
| Validate operational evidence | Aria Operations or automation deployment history | Deployment ownership, policy result, and target placement are auditable |
NSX deployment fails during VCF bring-up. What should be checked first?
Check DNS, NTP, VLAN configuration, MTU, IP pools, routing, and management network reachability.
Many VCF bring-up failures are caused by prerequisite or network configuration issues rather than product defects. NSX deployment depends on accurate name resolution, time synchronization, reachable management addresses, correct transport networks, and consistent MTU. In exam scenarios, the first troubleshooting step is usually to validate foundational infrastructure settings before escalating to deeper component analysis.
Demand Score: 90
Exam Relevance Score: 97
How should an administrator add a host to an existing VCF workload domain?
Use the supported SDDC Manager workflow.
SDDC Manager keeps host inventory, compatibility, lifecycle state, and domain membership consistent. Adding hosts manually through vCenter may appear to work temporarily, but it can create configuration drift and break lifecycle automation. Certification questions commonly treat SDDC Manager as the correct operational path for VCF domain expansion and lifecycle-aware administration.
Demand Score: 88
Exam Relevance Score: 96
Why should VCF upgrades and patches be performed through SDDC Manager?
To maintain validated stack compatibility, precheck enforcement, and correct upgrade sequencing.
SDDC Manager verifies environment readiness, applies supported bundles, and coordinates upgrade order across VCF components. This helps prevent version mismatch between ESXi, vCenter, NSX, vSAN, and supporting services. Direct patching outside SDDC Manager can bypass safeguards and leave the environment unsupported. In exam scenarios, SDDC Manager is the expected tool for controlled VCF lifecycle operations.
Demand Score: 91
Exam Relevance Score: 98
How can administrators prevent self-service deployments from using unapproved networks, oversized templates, or incorrect storage policies?
Use governance guardrails such as approved templates, quotas, network profiles, storage policies, and approval workflows.
Self-service automation should accelerate delivery while preserving architectural control. Without guardrails, users may deploy inconsistent workloads that waste capacity or violate security and operational standards. Governance policies ensure that automation aligns with the approved VCF design. In certification scenarios, this type of question usually tests the balance between automation flexibility and administrative control.
Demand Score: 84
Exam Relevance Score: 93
What should administrators do when direct changes in vCenter or NSX create configuration drift from the approved VCF design?
Compare the running environment against the approved baseline and bring changes back under documented operational control.
Configuration drift can break lifecycle assumptions, monitoring accuracy, security boundaries, and troubleshooting procedures. A baseline allows administrators to identify unsupported or unauthorized changes and decide whether to remediate them or formally update the design. In VCF exams, operational consistency is usually preferred over ad hoc manual changes.
Demand Score: 82
Exam Relevance Score: 92