Advanced VMware Cloud Foundation 9.0 Networking v1.0
Question 1
Identify two requirements for deploying an NSX Virtual Routing and Forwarding (VRF) gateway with BGP. (Choose two.)
- A. The Tier-0 VRF must have a dedicated BGP Autonomous System (AS).
- B. The Tier-0 VRF gateway needs to be connected to a trunked VLAN segment.
- C. NSX federation must be enabled with at least one NSX Global Manager.
- D. The parent Tier-0 Gateway must not have any preexisting Tier-0 VRFs configured.
- E. The parent Tier-0 Gateway must be created and connected to an external network.
Answer : BE
Question 2
The administrator must configure Border Gateway Protocol (BGP) on the Tier-0 Gateway to establish neighbor relationships with upstream routers.
Which two statements describe the Border Gateway Routing Protocol (BGP) configuration on a Tier-0 Gateway? (Choose two.)
- A. Can be used as an Exterior Gateway Protocol.
- B. It supports a 4-byte autonomous system number.
- C. EIGRP is configured by default.
- D. The network is divided into areas that are logical groups.
Answer : AB
Question 3
An administrator is tasked to configure NSX Federation between separate VMware Cloud Foundation (VCF) Fleets.
Which requirement must all sites meet before being added to a Global Manager (GM) for NSX Federation?
- A. All sites must use the same VTEP VLAN and IP pools.
- B. All sites must be managed by the same VCF instance.
- C. All sites must have the same NSX version and build.
- D. All sites must use identical Tier-0 gateway BGP autonomous system numbers.
Answer : C
Question 4
DRAG DROP -
An administrator is attempting to confirm the successful transmission between an internal VM to an external destination.
An ICMP request packet is being sent from Sa-transit-web-01 to the Student Desktop in the diagram.
Drag and Drop the commands output into their appropriate originating NSX object.
Answer : 
Question 5
An administrator has been tasked with providing a networking solution including a Source and Destination NAT for a single Tenant.
The tenant is using Centralized Connectivity with a Tier-0 Gateway named Ten-A-Tier-0 supported by an Edge cluster in Active Active mode. The NAT solution must be available for multiple subnets within the Tenant space. The administrator chooses to deploy a Tier-1 Gateway to implement the NAT solution.
How would the administrator complete the task?
- A. Change Ten-A-Tier-0 to Active-Standby to support the stateful NAT.
- B. Create a Tier-1 Gateway in Distributed Routing mode only and do not attach it to Ten-A-Tier-0.
- C. Create a new Tier-0 Gateway in Active Standby mode and attach another Tier-1 Gateway.
- D. Create a new Tier-1 Gateway in Active Standby mode and attach it to Ten-A-Tier-0.
Answer : D
Question 6
An administrator notices that BGP is established, but no routes are advertised from the VPC Transit Gateway to the router. The administrator runs this command: get logical-router <SR-tier0-gw-> route bgp and observed there are 0 routes being advertised.
What must the administrator do to get routes to be advertised?
- A. Enable BGP Address Family IPv4 Unicast in the logical tier 0 router.
- B. Enable Allowas-in on the BGP neighbor in the logical tier 0 router.
- C. Enable Route Re-distribution Connected Interfaces & Segments.
- D. Disabled Next-hop-self in the VPC transit gateway.
Answer : C
Question 7
An administrator is troubleshooting BGP flapping in an VMware Cloud Foundation 9 environment. A Tier-0 Gateway is running in Active/Active mode with two Edge nodes. BFD is enabled on the eBGP sessions to the upstream routers. Each Edge node uses its own uplink IP for BGP. After some network maintenance, one BGP session starts flapping every few minutes. The other BGP sessions stay stable.
On the affected Edge node, the command get bfd-sessions shows:
State: Down -
Diag: Detect Time Expired -
Symptoms:
The upstream router also shows the BFD session as Down with Control Detection Time Expired.
There are no interface errors, no packet loss for normal traffic, and clearing the BFD session temporarily brings it back up - but it flaps again after few minutes.
What is the root cause?
- A. BFD is configured in echo mode on the upstream routers.
- B. The MTU does not match on the end-to-end between Tier-0 Gateway and upstream routers.
- C. The Edge nodes are undersized and are experiencing high contention on CPU and drops BFD packets.
- D. BFD timers are mismatched between Tier-0 Gateway and the upstream routers.
Answer : D
Question 8
An administrator is upgrading an existing VMware Cloud Foundation (VPC) environment. An NSX Edge Cluster is required to support north-south traffic for a workload domain.
How would the administrator initiate the edge cluster deployment?
- A. Through VCF Operations Fleet Manager.
- B. From the VCF Installer.
- C. From the vCenter Server Appliance Management Interface (VAMI).
- D. From vCenter Network Connectivity wizard.
Answer : A
Question 9
A sovereign cloud provider has a VMware Cloud Foundation (VCF) stretched Workload Domain across two data centers (AZ1 and AZ2), where site connectivity via layer-3 is provided by the underlay.
The following NSX details are included in the design:
Each site must host its own local NSX Edge Cluster for availability zones.
Tier-0 gateways must be configured in active/active mode with BGP ECMP to local top of rack switches.
Inter-site Edge TEP traffic must not cross the inter-DC link.
SDDC Manager is used to automate NSX deployment.
During deployment of the Edge Cluster for AZ2, the SDDC Manager workflow fails because the Edge transport nodes TEP IPs are not reachable from the ESX transport nodes.
Which step ensures correct Edge Cluster deployment in multi-site stretched domains?
- A. Configure BGP neighbors before deploying the Edge Cluster.
- B. Reuse the TEP IP pool from AZ1.
- C. Disable the liveness check during Edge deployment in SDDC Manager.
- D. Create an AZ2-specific Edge TEP IP pool and map it to the AZ2 uplink profile before deploying the Edge Cluster.
Answer : D
Question 10
An administrator has a VMware Cloud Foundation (VCF) instance. A critical NSX security update has been released by Broadcom.
How can the administrator install the NSX update?
- A. Download the NSX patch to the NSX Manager. Apply it using NSX Manager.
- B. Download the NSX patch to VCF Operations. Apply it using VCF Operations Fleet Management.
- C. Download the NSX patch to VCF Operations. Apply it using NSX Manager.
- D. Download the NSX patch to the NSX Manager. Apply it using VCF Operations Fleet Management.
Answer : B
Question 11
An administrator is investigating packet loss reported by workloads connected to VXLAN segments in an NSX environment. Initial checks confirm: that all VMs are powered on
VXLAN Segments IDs are consistent across transport nodes, and visible to all hosts physical switch configurations are correct.
Which two NSX tools can be used to troubleshoot packet loss on VXLAN Segments? (Choose two.)
- A. Flow Monitoring
- B. Activity Monitoring
- C. Packet Capture
- D. Traceflow
- E. Live Flow
Answer : CD
Question 12
An administrator changed the SFTP server used for scheduled NSX Manager backups. The backup jobs now fail with the error Host KEY Verification Failed. The connectivity and credentials are correct.
How would an administrator resolve the error?
- A. Update the SSH fingerprint.
- B. Use the NSX cluster VIP as the SFTP endpoint.
- C. Turn off Backup encryption.
- D. Trust the certificate on the SFTP server.
Answer : A
Question 13
An administrator is troubleshooting BGP connectivity issue on a Tier-0 Gateway (Active/Active).
The Tier-0 has the following configuration:
Uplink VLAN 2711 → 172.25.100.0/24
Uplink VLAN 2712 → 172.25.101.0/24
BGP neighbors configured: 172.25.100.1 and 172.25.101.1
A single static default route (0.0.0.0/0) exists with next-hop 172.25.100.1
Symptoms observed on both Edge Nodes:
Get BGP neighbors → both neighbors stuck in Idle (Connect) – "No route to peer"
Ping to 172.25.100.1 and 172.25.101.1 succeeds from the Edge nodes
Get route shows the default route present only on VLAN 2712 interface (fp-eth1), missing on VLAN 2711 (fp-eth0)
What is the root cause of both BGP sessions remaining in Idle state?
- A. Multi-hop eBGP is required when using two VLANs.
- B. The static default route Scope is set only to the uplink VLAN 2712 segment.
- C. BGP authentication mismatch between Tier-0 and ToR routers.
- D. The ToR routers do not have routes back to the Edge uplink interfaces.
Answer : B
Question 14
HOTSPOT -
The network team has decided to use a single Edge Cluster to provide Tier-0 A/ A Gateway routing and Tier-1 Gateway A/S services.
The active Tier-1 with a Gateway Firewall service is on EN2.
Which highlighted options will show the ECMP paths used by that Tier-1 GFW?
Answer : 
Question 15
An administrator is onboarding a secondary site Local Manager to the Global Manager (GM). The site has existing tier-0 and tier-1 gateways configured locally. The GM prompts you to import these objects.
What happens when you import these local networking objects into Federation?
- A. Objects remain local objects but are synchronized every 24 hours with the global configuration.
- B. Objects become global objects, replicate to other sites automatically.
- C. Objects must be deleted and recreated on the Global Manager.
- D. The objects stay local on the secondary site and become copies on the primary site.
Answer : B