2V0-13-25 practice question 2 of 10

An agency is designing its secure private cloud on VMware Cloud Foundation with the following requirements: * Strict data segregation between the…

An agency is designing its secure private cloud on VMware Cloud Foundation with the following requirements: * Strict data segregation between the management and workload domains. * Company policy prevents using vSAN as a storage solution. * Data encryption at rest is mandatory for both the management and workload domains. * Data encryption in transit is mandatory for the workload domains. * Data-at-rest encryption must be performed by the storage array and not rely on VMware native or vSAN- specific mechanisms. * Allow for automated VM placement, operational integrity with VCF Operations, and assurance that file- based workloads scale efficiently. Which storage architecture fulfills these technical and regulatory requirements?

Answer options

A: Deploy metro clusters backed by Self-Encrypting Disk (SED) using iSCSI for both domains and configure encrypted VLANs for data-in-transit between VCF Operations and hosts.

B: Configure dedicated VMFS datastores on separate Fibre Channel arrays for management and workloads, with array-based encryption enabled and SPBM storage policies assigned. Use NFS v4.1 shares with Kerberos-based encryption for in-transit data for file workloads in the workload domain, restricting cross-domain datastore access. Correct answer

C: Enable VMware VM-level encryption using vSphere Native Key Provider (NKP) on local VMFS disks for all environments, implementing manual file workload allocation through generic SMB shares.

D: Create a unified NAS platform offering both NFS and SMB exports shared across management and workload domains, then enable application-level encryption for sensitive workloads and restrict access via firewall rules.

Correct Answer:

B. Configure dedicated VMFS datastores on separate Fibre Channel arrays for management and workloads, with array-based encryption enabled and SPBM storage policies assigned. Use NFS v4.1 shares with Kerberos-based encryption for in-transit data for file workloads in the workload domain, restricting cross-domain datastore access.

Explanation

Option B perfectly aligns with all technical and regulatory constraints for this VMware Cloud Foundation design. By utilizing dedicated Fibre Channel arrays with array-based encryption, it satisfies both the strict domain segregation requirement and the mandate for hardware-level data-at-rest encryption, explicitly avoiding vSAN or VMware native encryption mechanisms. The use of Storage Policy Based Management (SPBM) ensures automated VM placement and maintains operational integrity with VCF Operations by abstracting storage capabilities. Furthermore, implementing NFS v4.1 with Kerberos provides robust, native data-in-transit encryption specifically tailored for scalable file-based workloads in the workload domain. This comprehensive approach fulfills the transit security requirements while maintaining strict cross-domain isolation, ensuring compliance with the agency's stringent security policies.

Why Incorrect

A: Encrypted VLANs are not a standard vSphere storage encryption mechanism. iSCSI SEDs lack native file-based workload scaling and in-transit encryption capabilities provided by NFS v4.1 with Kerberos. C: Explicitly violates the design requirements by utilizing VMware native VM-level encryption (NKP) instead of array-based encryption. Additionally, manual allocation directly contradicts the automated VM placement requirement. D: Sharing a unified NAS across management and workload domains violates the strict data segregation requirement. Furthermore, application-level encryption fails the mandate for storage array-based data-at-rest encryption.

References

1. VMware vSphere 8.0 Product Documentation. vSphere Storage Guide. Section: "NFS Storage" -> "Using Kerberos for NFS 4.1". (Details the use of AES-256 encryption for data-in-transit over NFS v4.1).

2. VMware Cloud Foundation 5.x Design Guide. Section: "Storage Design for the Workload Domain". (Covers the use of Fibre Channel and NFS as principal/supplemental storage, SPBM for automated placement, and physical segregation of domains).

3. VMware vSphere 8.0 Product Documentation. vSphere Security Guide. Section: "Data at Rest Encryption". (Differentiates between vSphere Native Key Provider/VM Encryption and hardware-based Self-Encrypting Drives/Array-based encryption).

Keep practicing

Take the free 2V0-13-25 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test