2V0-33.22 VMware Cloud Professional Questions and Answers

The two incident management services included in the VMware Cloud on AWS Service Management process are Incident Management and Capacity Management.

Incident Management is responsible for detecting, classifying, and resolving incidents quickly and effectively. It includes monitoring and alerting, incident response, and problem management. Capacity Management is responsible for predicting, measuring, and managing the capacity of the infrastructure. It includes capacity planning, performance analysis, and resource optimization.

References: [1] https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/cloud-management/vmware-cloud-on-aws-service-management-process.pdf [2] https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.admin.doc/GUID-684D1A84-C57F-4EC1-8A18-7A9A9EB9B7FF.html

A private network segment is an isolated network segment that is used for disaster recovery testing. Private network segments provide a secure and isolated environment for testing, allowing administrators to test their disaster recovery plans without risking the stability of their production environment. Private network segments also provide additional security, as they are not connected to the public internet, making them less vulnerable to external attacks. [1]

[1] https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.networking/GUID-64D7A8F3-45C9-4A83-8528-A8C2A2C7001D.html

The VMware solution that offers long-term immutable point-in-time recovery options is VMware Cloud Disaster Recovery (CDR). CDR offers continuous data protection and point-in-time recovery options with up to 30 days of retention. It also provides a secure and immutable copy of your data that is stored in the cloud and can be used to recover from ransomware attacks.

https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-solution-overview-vmware-ransomware-recovery.pdf

RAID-1 is a mirror configuration that provides high availability by creating multiple copies of a VMDK. RAID-5 and RAID-6 are erasure coding configurations that provide fault tolerance by distributing data and parity across multiple hosts.

The number of failures to tolerate (FTT) determines how many copies or parity blocks are created for each VMDK. For example, RAID-1 FTT = 2 means that there are three copies of each VMDK.

Therefore, based on your requirements, a possible VM storage policy setting could be RAID-1 FTT = 2, which would provide redundancy at the highest level possible with six hosts.

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vsphere.vmc-aws-manage-data-center-vms.doc/GUID-EDBB551B-51B0-421B-9C44-6ECB66ED660B.html

VMware Cloud Disaster Recovery is a managed disaster recovery-as-a-service offering that is built on the latest version of VMware vSphere 7.0. It provides an on-demand cloud consumption model, allowing administrators to rapidly power-on recovered virtual machines in the cloud, assuming cloud capacity availability. Additionally, VMware Cloud Disaster Recovery delivers a recovery point objective (RPO) of no more than 30 minutes, and can accommodate for single region failure.

Publishing Applications with VMware Horizon 7

https://vcdx.vmware.com/content/dam/digitalmarketing/vmware/ru/pdf/techpaper/vmware-horizon-7-application-publishing.pdf

VMware Technical Support Guide

https://www.vmware.com/pdf/techsupportguide.pdf

Quick-Start Tutorial for VMware Dynamic Environment Manager ...

https://techzone.vmware.com/resource/quick-start-tutorial-vmware-dynamic-environment-manager

VMware Cloud Disaster Recovery ----------------------------------------------------- * Protect your workloads running on VMware Cloud on AWS SDDC using high-frequency snapshots to achieve RPOs as low as 30 minutes. * Availability Zone Failure Handling https://docs.vmware.com/en/VMware-Cloud-Disaster-Recovery/services/vmware-cloud-disaster-recovery/GUID-067EE6DF-80CC-44D2-94E6-D7183A239D9A.html

https://docs.vmware.com/en/VMware-Cloud-Disaster-Recovery/services/rn/vmware-cloud-disaster-recovery-release-notes/index.html

https://docs.vmware.com/en/VMware-HCX/4.5/hcx-user-guide/GUID-741F47D5-A3C9-4D74-9672-E54D8791D8F0.html

"VMware HCX Replication Assisted vMotion (RAV) uses the HCX Interconnect appliance along with replication and vMotion technologies to provide large scale, parallel migrations with zero downtime." Understanding VMware HCX Replication Assisted vMotion: https://docs.vmware.com/en/VMware-HCX/4.6/hcx-user-guide/GUID-741F47D5-A3C9-4D74-9672-E54D8791D8F0.html#GUID-741F47D5-A3C9-4D74-9672-E54D8791D8F0

 Incident Management is responsible for handling customer incidents and ensuring customer satisfaction. Capacity Management is responsible for ensuring that the service is sized appropriately for customer needs and that the capacity is monitored to ensure that it meets customer requirements. VMware Tools management, Microsoft licensing management, and workload OS management are not part of the service management process.

What is a Hypervisor? | VMware Glossary

https://www.vmware.com/topics/glossary/content/hypervisor.html

VMware Cloud on AWS Operations Guide

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/vmc-aws-operations.pdf

What is a Bare Metal Hypervisor? | VMware Glossary

https://www.vmware.com/topics/glossary/content/bare-metal-hypervisor.html

The best option for a cloud administrator who wants to deploy a VMware Cloud software-defined data center (SDDC) on a cloud provider and requires a consistent 4.5 Gbps bandwidth from applications to communicate from on-premises to the SDDC is a Route-Based Virtual Private Network (VPN). This type of connection offers enhanced performance [1][2], flexibility, scalability, and security compared to other options, such as Policy-Based Virtual Private Network (VPN), Private L2 Virtual Private Network (VPN), or Private Line.

According to the VMware official site, "Route-based VPN enables a secure connection between two or more sites, or between a site and a mobile user, and provides better performance and scalability than a policy-based VPN. Route-based VPNs are also more secure than policy-based VPNs, because the traffic is encrypted with a unique encryption key for each tunnel, rather than relying on a shared key for all tunnels. This allows for secure and reliable connections for devices and applications located in different physical locations." [1]

[1] https://docs.vmware.com/en/VMware-NSX-Data-Center/2.4/com.vmware.nsx.admin.doc/GUID-D6B7B9E9-E134-4C8A-8F2E-1C60A2FEDC1A.html

VMware HCX Network Extension is a layer-two bridging function initiated at the source site1. It allows customers to extend their on-premises networks to a VMware Cloud SDDC without changing the IP addresses of the virtual machines2. When extending a network, a corresponding NSX segment is created at the destination site1. The network segment type that HCX Network Extension creates in the VMware Cloud SDDC is Extended2. This means that the network is stretched across both sites and the routing is handled at the source site2. The Extended network segment type preserves the network identity and connectivity of the virtual machines that are migrated or created on the extended segment at the remote site2. References: 1: Extending Networks Using VMware HCX, 2: About VMware HCX Network Extension

Customer responsibility “Security in the Cloud” – Customers are responsible for the deployment and ongoing configuration of their SDDC, virtual machines, and data that reside therein. In addition to determining the network firewall and VPN configuration, customers are responsible for managing virtual machines (including in guest security and encryption) and using VMware Cloud on AWS User Roles and Permissions along with vCenter Roles and Permissions to apply the appropriate controls for users.

The responsibility for the encryption of virtual machines in VMware Cloud lies with the customer. The customer is responsible for configuring and managing any encryption or security related settings and configurations in the virtual machines, such as disk encryption or the configuration of security protocols. The VMware Cloud Provider Partner (VCPP) is responsible for the overall security of the cloud environment [1][2], including the encryption of data at rest, but the customer is responsible for configuring and managing the encryption settings within their virtual machines. Reference: https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.encryption/GUID-6F6921CA-44D6-4D9D-B0C0-12C18A545B7C.html

According to the VMware official guide, VMware Tanzu Service Mesh is a cloud-native service mesh platform that simplifies the secure communication between microservices running in Kubernetes clusters . It provides secure and consistent network communication between services and enables policy-driven authorization and observability. With its distributed tracing capabilities, Tanzu Service Mesh can help administrators easily monitor and troubleshoot their applications. It also provides a unified platform to manage the lifecycle of Tanzu Kubernetes clusters, including provisioning, upgrades, patching, and more.

Management “and Server” network - 172.18.0.0/16

“and Server” being the 250 application servers.

https://docs.vmware.com/en/VMware-HCX/4.6/hcx-user-guide/GUID-DBDB4D1B-60B6-4D16-936B-4AC632606909.html

Detected and Restricted Source Network Types

The HCX Network Extension service detects and prevents several non-supported Network Extension scenarios (items are dimmed in the Network Extension UI):

• vSphere infrastructure networks (ESXi VMkernel networks).

Hybrid Linked Mode allows you to link your cloud vCenter Server instance with an on-premises vCenter Single Sign-On domain. https://docs.vmware.com/en/VMware-Cloud- on-AWS/services/com.vmware.vsphere.vmc-aws-manage-data-center-vms.doc/GUID-91C57891-4D61-4F4C-B580-74F3000B831D.html

Hybrid Linked Mode is the solution that meets the requirement of viewing and managing workloads across both an on-premises environment and a VMware Cloud on AWS SDDC. Hybrid Linked Mode allows customers to link their on-premises vCenter Server with their VMware Cloud on AWS vCenter Server and use a single interface to manage both environments1. Hybrid Linked Mode also enables customers to perform cold and live migrations of workloads between on-premises and cloud SDDCs2. Hybrid Linked Mode leverages the existing vCenter Single Sign-On domain and does not require any additional components or licenses1. References: 1: Hybrid Linked Mode - VMware Docs, 2: VMware Cloud on AWS Documentation

When deploying VMware Cloud on Dell EMC or VMware Cloud on AWS Outposts, the Dell or AWS guys will bring a populated rack to the on-prem DC to extend the private cloud. They will bring technisians on-site to carry, install and configure the devices. AWS Outposts rack hardware specs: https://aws.amazon.com/outposts/rack/hardware-specs/?nc=sn &loc=4 https://docs.vmware.com/en/VMware-Cloud-on-Dell-EMC/services/vmc.dell.emc.datasheet/GUID-9252D1FC-FE9C-4317-8EEB-4C019A21CAA9.html

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws-operations/GUID-1A175E91-2317-4261-A63E-B398D92ECE8D.html vMotion Requirements for SDDCs With NSX:Networking speed and latency: Migration with vMotion requires sustained minimum bandwidth of 250 Mbps between source and destination vMotion vMkernel interfaces, and a maximum latency of 100 ms round trip between source and destination.

On-premises vSphere version: Your on-premises vSphere installation must be vSphere 6.7U2 or higher. See VMware Knowledge Base article 56991 for more information.

On-premises DVS version:  6.0 or higher.

On-premises NSX version: any

Note: SDDCs configured with NSX do not support hot vMotion to or from on-premises VXLAN encapsulated networks (NSX for vSphere) or Geneve Datacenter Overlay networks (NSX).

IPsec VPN: Configure an IPsec VPN for the management gateway.

See Configure a VPN Connection Between Your SDDC and On-Premises Data Center in the VMware Cloud on AWS Networking and Security guide.

Direct Connect: Direct Connect over a private virtual interface between your on-premise data center and your VMware Cloud on AWS SDDC is required for migration with vMotion.

See Using AWS Direct Connect with VMware Cloud on AWS.

Hybrid Linked Mode: Hybrid Linked Mode is required to initiate migration from the vSphere Client. It is not required to initiate migration using the API or PowerCLI.

See "Hybrid Linked Mode" in Managing the VMware Cloud on AWS Data Center.

L2 VPN: Configure a Layer 2 VPN to extend virtual machine networks between your on-premises data center and cloud SDDC. Routed networks are not supported. See VMware Cloud on AWS Networking and Security. VMware Cloud on AWS firewall rules Ensure that you have created the necessary firewall rules as described in Required Firewall Rules for vMotion.

On-premises firewall rules: Ensure that you have created the necessary firewall rules as described in Required Firewall Rules for vMotion.

Virtual machine hardware and settings: Ensure that these requirements are met for virtual machine hardware.

• Virtual machine hardware version 9 or later is required for migration with vMotion from the on-premises data center to the cloud SDDC.
• EVC is not supported in the VMware Cloud on AWS SDDC.
• VMs that are created in the cloud SDDC or that have been power-cycled after migration to the cloud SDDC can't be migrated back to the on-premises data center with vMotion unless the on-premises EVC baseline is Broadwell. You can relocate these VMs after powering them off, as long as their virtual machine hardware version is compatible with the on-premises data center.
• Migration of VMs with DRS or HA VM overrides is not supported. For more information on VM overrides, see Customize an Individual Virtual Machine.

Important: Source switch configurations (including NIOC, spoofguard, distributed firewall, and Switch Security) and runtime state are not applied at the destination as part of migration in either direction. Before you initiate vMotion, apply the source switch configuration to the destination network.

In order for a virtual machine to be migrated using VMware vSphere vMotion, the versions of VMware vSphere need to match between the on-premises data center and the cloud SDDC, and a Layer 2 connection needs to be configured between them. Additionally, cluster-level Enhanced vMotion Compatibility (EVC) must be configured in both the on-premises data center and the cloud SDDC. IPsec VPN and AWS Direct Connect do not need to be configured for the migration to occur.

The throughput provided by a Google Cloud VMware Engine private cloud network is 100 Gbps. This allows for a high level of performance and scalability, and supports a variety of services and applications. Additionally, the private cloud network is secure and reliable, providing support for different authentication methods and encryption standards.

100Gb dedicated for cluster (vSAN + east-west) 4x mellanox connect-4 lx dual port 25GbE.

"It is a good idea to periodically monitor the CPU usage of the host. This can be done through the vSphere Client, using the VMware vRealizeOperations management suite, or by using resxtop. Below we describe how to interpret resxtop" https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/vmc-aws-performance.pdf

• Use the VMware vSphere Client to connect to the VMware vCenter which manages the virtual machine and examine its performance statistics. You can use charts, alarms, and events to identify CPU bottlenecks or contention.
• Use the Troubleshooting Workbench in VMware vRealize Operations Cloud to look for potential evidence. You can use dashboards, alerts, metrics, logs, and recommendations to diagnose and resolve CPU performance issues.

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/vmc-aws-performance.pdf

• Total number of workloads. This determines how many hosts are needed in the VMware Cloud SDDC cluster.
• Total amount of available storage across all on-premises datastores. This determines how much storage capacity is needed in the VMware Cloud SDDC cluster.
• Average size of workload resources (CPU & RAM). This determines how much compute capacity is needed in the VMware Cloud SDDC cluster.

https://docs.vmware.com/en/VMware-Cloud/services/vmc-cloud-sizer-user/GUID-7CECF719-E56B-4830-84ED-77206A2A118D.html

CloudHealth by VMware is a cloud cost governance platform that provides budget management, cost reporting, and cost forecasting from a single platform. It provides comprehensive visibility and control to manage cloud costs in hybrid and multi-cloud environments. CloudHealth by VMware also provides cost optimization, resource optimization, and real-time alerting capabilities to help organizations make cost-effective decisions to reduce cloud costs.

Tanzu Kubernetes Grid is a service from VMware Cloud that enables customers to deploy and manage Kubernetes applications in the cloud. In order to deploy a namespace or their Kubernetes Application developments, an administrator must configure a Tanzu Kubernetes Cluster and a Management Cluster.

A Tanzu Kubernetes Cluster is a cluster of nodes that are used to run applications and services. The nodes are connected to the Management Cluster, where administrators can manage and monitor deployments.

The Management Cluster is a cluster of nodes that are used to manage and monitor the Tanzu Kubernetes Cluster nodes. It provides the tools to manage and monitor deployments, as well as to configure and maintain the Tanzu Kubernetes Cluster nodes.

According to VMware's official website, "Tanzu Kubernetes Grid is a service that provides a simplified way to deploy and manage Kubernetes applications in the cloud. It provides a single control plane for managing multiple Kubernetes clusters, allowing customers to easily deploy and manage their applications across multiple clusters and environments." [1]

[1] https://www.vmware.com/products/tanzu-kubernetes-grid.html

VMware High Availability (HA) is a feature of the VMware Cloud platform that monitors the health of virtual machines and restarts virtual machines on other hosts if they crash or become unresponsive. This ensures that the virtual machines are always available and that no downtime is experienced. The default response is to restart the impacted virtual machine on other hosts in the same SDDC Cluster, however, this can be customized to suit the needs of the customer.

References: [1]https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.availability_and_scalability.doc/GUID-C7E2C2A2-B9A8-4CD0-A2F2-EA6C08C8D95B.html [2] https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.admin.doc/GUID-F9C7F1B8-4855-4C3A-A723-C9A2F7CDBFFB.html

https://docs.aws.amazon.com/whitepapers/latest/sddc-deployment-and-best-practices/deploying-vmware-cloud-on-aws-sddc.html This must be a RFC1918 private address space (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16) with CIDR block sizes of /16, /20, or /23. The management CIDR block cannot be changed after the SDDC is deployed. Choose a range of IP addresses that does not overlap with the AWS subnet you are connecting to. If you plan to connect the SDDC to an on-premises DC or another environment, the IP subnet must be unique within your enterprise network infrastructure. Choose a CIDR that will give you future scalability.

Kubernetes is an open-source container orchestration system that provides automated deployment, scaling, and management of containers. It can be used to set up an automated restart policy for containers in the event of a failure, ensuring that containers are automatically restarted when they fail.

VMware Stage Manager User's Guide

https://www.vmware.com/pdf/stagemanager1_Users_Guide.pdf

Compatible top of rack switches are necessary to ensure that the data center is able to support the VMware Cloud on Dell EMC or VMware Cloud on AWS Outposts deployments [1]. The switches must support 10GE and 25GE ports, as well as Layer 3 routing protocols such as OSPF and BGP.

Dedicated subnets for SDDC management network are also needed for the deployment of VMware Cloud on Dell EMC or VMware Cloud on AWS Outposts [1]. The SDDC management network will be used for communication between the VMware Cloud components and the data center, and must be isolated from the customer network.

https://blogs.vmware.com/management/2022/08/forwarding-vsphere-audit-and- authentication-events-from-vrealize-log-insight-to-a-siem.html

Managing Costs:

With its capacity and cost management features, vRealize Operations Cloud can predict future demand and provide actionable recommendations to help in managing costs.

Reclamation of Existing Resources:

Assess workload status and resource contention in data centers across your environment:

• Determine the time remaining until CPU, memory, or storage resources run out.
• Realize cost savings when underutilized VMs are identified and reclaimed to be deployed more effectively.

Future Infrastructure Requirements

Run what-if scenarios:

• Identify how much capacity remains after you add or remove VMs or hosts.
• Add hyperconverged infrastructure (HCI) nodes.
• Get a recommendation based on the cost relative to workload placement on different hosts, clusters, data centers, and even different clouds.

Cloud Migration Planning:

Migration planning shows you the capacity and cost information after the migration to a cloud-based infrastructure.

Cost Overview

vRealize Operations Cloud supports costing for private clouds, public clouds, and VMware Cloud infrastructure.

You can track expenses for a single virtual machine, and identify how these expenses attribute to the overall cost associated with your private cloud accounts and VMware Cloud infrastructure accounts.

On the Cost Overview home page in vRealize Operations Cloud, you can find details about the costs associated with your VMware Cloud infrastructure accounts, public cloud accounts, and your private cloud accounts.

You can view the Total Cost of Ownership, Potential Savings, and Realized Savings for your VMware Cloud infrastructure cloud accounts and vSphere private cloud accounts, and Total Cost of Ownership for your private cloud accounts.

The problem could be that the new password is not synchronized with the password that is displayed for the Default vCenter user account. The administrator must make sure that the same password is used in both the vSphere Client and the VMware Cloud console in order for the user to access the account. Changing the password in one place does not automatically change it in the other, so this must be done manually.

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws-operations/GUID-7F72EA90-5BFA-404F-A2EC-B93070A52A67.html

Management Gateway (MGW) The MGW is a Tier 1 router that handles routing and firewalling for vCenter Server and other management appliances running in the SDDC. Management gateway firewall rules run on the MGW and control access to management VMs. In a new SDDC, the Internet connection is labelled Not Connected in the Overview tab and remains blocked until you create a Management Gateway Firewall rule allowing access from a trusted source.

Private L2 VPN: To migrate running VMs between SDDCs in different geographical locations.

You use a private layer 2 (L2) VPN to extend an on-premises network to your cloud SDDC. This extended network is a single subnet with a single broadcast domain.

You can use L2 VPNs to migrate VMs to and from your cloud SDDC, for disaster recovery, or for dynamic access to cloud computing resources (often called cloud bursting).

VM migrations across an L2 VPN support VLAN tagging and GENEVE frame encapsulation when migrating between a cloud SDDC to another SDDC.

The L2 VPN tunnel extends layer 2 networks across geographic sites. VMs can move across sites (using vSphere vMotion) and keep the same IP addresses using an L2 VPN.

This role is designed to give administrators access to manage virtual machines, networks, and other settings within the folder. The CloudAdmin role will also give the junior administrators access to all global permissions that are associated with the Development folder.

"The CloudAdmin role is designed to give administrators access to manage a single folder. This role grants access to manage virtual machines, networks, and other settings within the folder. Additionally, this role grants access to all global permissions that are associated with the folder. For example, if the folder has global permissions that allow users to create or delete virtual machines, the CloudAdmin role will grant access to those permissions within the folder."

The CloudAdmin user can grant other users or groups read-only access to VMware Cloud on AWS vCenter management objects such as the Mgmt-ResourcePool, Management VMs folder, Discovered Virtual Machines folder, vmc-hostswitch, and vsanDatastore. Because this read-only access does not propagate to management objects, you cannot grant it as a Global Permission and instead must explicitly grant it for each management object. VMware Cloud on AWS runs a script once a day that updates any newly-created management objects (such as objects in a new cluster) so that the CloudAdmin user and CloudAdminGroup SSO group have the updated role applied. The script itself does not grant additional access to any user or group, so you'll need to wait until it completes before the CloudAdmin can use this workflow to grant read-only access to those objects.

Graphical user interface, text, application, email Description automatically generated