Study guide
5.5 VCF Deployment Components & Additional Required Infrastructure
VMware Certified Professional - VMware Cloud Foundation Administrator VCP-VCF 2V0-17.25
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Private Cloud Vision & Architecture
1.1 Private Cloud Principles & The Modern Cloud Operating Model 1.2 VMware Cloud Foundation Architecture & Full-Stack Value Proposition 1.3 Private Cloud Use Cases, Service Models & Workload Strategy
2 Chapter 2: VMware Compute Fundamentals
2.1 ESXi Host & vCenter Architecture and Deployment 2.2 vSphere Cluster Design, High Availability (HA), and DRS 2.3 Virtual Machine Deployment, Advanced Hardware, & Management 2.4 Managing Virtual Machines Through vCenter: Day-2 Operations
3 Chapter 3: VMware Storage Fundamentals
3.1 vSphere Core Storage Architecture: VMFS, NFS, & vVols 3.2 vSAN Architecture: Express Storage Architecture (ESA) vs. Original Storage Architecture (OSA) 3.3 vSAN Cluster Deployment, Storage Pools, & Disk Configurations 3.4 Storage Policy-Based Management (SPBM), Fault Tolerance, & Space Efficiency 3.5 vSAN Resilience & Data Availability: FTT, Fault Domains, and Stretched Clusters 3.6 vSAN Space Efficiency: Compression, Deduplication, TRIM/UNMAP & Reclamation
4 Chapter 4: VMware Network Fundamentals
4.1 VCF Network Architecture & NSX Core Components 4.2 NSX Virtual Network Fabrics, Transport Nodes, & Geneve Overlays 4.3 Edge Clusters, Tier-0/Tier-1 Gateway Routing, & Uplink Connectivity 4.4 NSX Distributed Firewall (DFW) & Distributed Network Services 4.5 VCF 9.0 Virtual Private Clouds (VPCs) & Transit Gateway Connectivity
5 Chapter 5: VCF Deploy and Configure
5.1 VCF Deployment Models: Standard vs. Consolidated & Prerequisites 5.2 VCF Installer Bring-Up & Management Domain Deployment 5.3 VI Workload Domain Deployment, Commissioning Hosts, & Storage Attachment 5.4 vSphere Supervisor Configuration & vSphere Kubernetes Service (VKS) Integration 5.5 VCF Deployment Components & Additional Required Infrastructure 5.6 Deploying & Configuring the VCF Network Gateway 5.7 VCF Networking Deployment: NSX Instances, Transport Fabric & Edge Clusters 5.8 Workload Domain Storage: Principal vs. Supplemental Storage
6 Chapter 6: VCF Manage & Lifecycle Operations
6.1 VCF Fleet Management & Existing vCenter Import Workflows 6.2 Identity Federation, VCF Identity Broker, & RBAC 6.3 Certificate & Password Lifecycle Management in VCF Operations 6.4 Lifecycle Management (LCM), Upgrade Bundles, & Drift Remediation 6.5 License Management in VMware Cloud Foundation
7 Chapter 7: VCF Operations: Architecture, Metrics & Health Diagnostics
7.1 VCF Operations Architecture, Cluster Nodes, & Deployment Options 7.2 Metrics, Properties, Symptom Definitions, & Alerting Mechanics 7.3 Health Diagnostics, Troubleshooting Workflows, & Operational Policies
8 Chapter 8: VCF Operations: Monitoring, Logs & Compliance
8.1 Dashboards, Views, & Management Reporting in VCF Operations 8.2 Storage, Network, and Workload Application Monitoring 8.3 Log Analytics & Troubleshooting with VCF Operations for Logs 8.4 Security Compliance Benchmarks, Hardening, & Configuration Drift 8.5 VCF Operations for Networks: Flow Analytics, Path Troubleshooting & Micro-Segmentation Planning
9 Chapter 9: VCF Consume & Automate: Architecture, Tenancy & Networking
9.1 VCF Automation Architecture, Services, & Automation Use Cases 9.2 Regions, Cloud Zones, Projects, & Multi-Org Tenancy 9.3 Provider Networking, Org Networks, & Content Library Integration
10 Chapter 10: VCF Consume & Automate: Templates, Extensibility & Governance
10.1 Cloud Templates (Blueprints), Schema, & Infrastructure as Code 10.2 Extensibility: Action-Based Extensibility (ABX) & Orchestrator Workflows 10.3 Governance Policies: Approvals, Leases, Resource Quotas, & Day-2 Actions 10.4 Supervisor-Based Services, vSphere Kubernetes Service (VKS), & Modern App Consumption
5.5 VCF Deployment Components & Additional Required Infrastructure
Key Takeaways Explain This Topic AI
The official exam guide names the VCF component set a minimally qualified candidate must know: vCenter, ESX, vSphere Supervisor, vSAN, NSX, VCF Identity Broker, VCF Automation, VCF Operations, VCF Operations for Logs, VCF Fleet Management, VCF Operations for Networks, and VCF Operations HCX.
Components divide into instance-scoped services that exist once per VCF instance and fleet-scoped services that span every instance under one management plane.
The additional infrastructure a deployment depends on but does not deploy is DNS with matching forward and reverse records, NTP, a physical fabric meeting the MTU requirement, VLANs, and depot or proxy access for binaries.
DNS and NTP failures are the two most common causes of a blocked bring-up, because certificates and Single Sign-On both depend on consistent names and synchronised time.
Broadcom expects candidates to hold foundational knowledge of Kubernetes, hardware, storage, networking, DNS, NTP, and certificates before attempting the exam.
Last updated: September 2026
5.5 VCF Deployment Components & Additional Required Infrastructure
Exam Focus: Two distinct blueprint objectives sit behind this section — "identify the components of a VCF Deployment" and "identify the additional components required to complete the deployment of a VMware Cloud Foundation-based private cloud". They sound similar but test opposite things. The first asks what VCF is ; the second asks what VCF depends on and does not supply .
The Component Set Broadcom Expects You to Know
The official exam guide's description of the minimally qualified candidate lists the components by name. Treat that list as the authoritative scope:
vCenter, ESX, vSphere Supervisor, vSAN, NSX, VCF Identity Broker, VCF Automation, VCF Operations, VCF Operations for Logs, VCF Fleet Management, VCF Operations for Networks, and VCF Operations HCX.
Note three things about that list immediately:
The hypervisor is ESX , not ESXi. VCF 9.0 dropped the trailing "i".
Several familiar products appear under VCF-prefixed names because the Aria and vRealize branding is gone. VCF Operations for Logs is the former Aria Operations for Logs and vRealize Log Insight; VCF Operations for Networks is the former Aria Operations for Networks and vRealize Network Insight.
VCF Identity Broker replaces the Workspace ONE Access role in the identity path.
Instance-Scoped Versus Fleet-Scoped
The most useful mental model is not an alphabetical list but a scope boundary. Some components exist once per VCF instance ; others span the whole fleet .
Scope Components Implication
Instance-scoped vCenter, ESX hosts, vSAN, NSX Manager cluster, NSX Edge, vSphere Supervisor, SDDC Manager One set per VCF instance. A second instance gets its own.
Fleet-scoped VCF Operations, VCF Operations for Logs, VCF Operations for Networks, VCF Automation, VCF Identity Broker, VCF Fleet Management Shared across instances. A new instance can register against existing ones rather than deploying duplicates.
This boundary explains a behaviour covered in the bring-up section: the VCF Installer can either deploy new VCF Operations nodes and a new VCF Automation instance, or leverage instances that already exist . Choosing to reuse is what makes a second instance part of a fleet instead of an isolated island with its own parallel operations stack.
The VCF Operations Node Roles
VCF Operations is itself a cluster with distinct node roles — a primary , a replica that provides high availability for the primary, and data nodes that scale collection and analytics capacity. The installer can deploy all three.
What VCF Does Not Deploy: The External Dependencies
The second objective is where candidates lose marks, because the answer is a list of things the platform assumes are already correct.
1. DNS — Forward and Reverse
Every appliance FQDN must resolve forward (A record) and reverse (PTR record) , and the two must agree. VCF issues and validates certificates against names; a missing PTR or a mismatched pair fails validation before deployment begins. This is the single most common bring-up blocker.
2. NTP
Every host and appliance must reach a common, reliable time source. Time skew breaks certificate validity windows and Single Sign-On token exchange, and the symptoms surface far from the cause — an SSO login failure weeks later traced back to a drifting host.
3. Certificate Services
Components start on certificates signed by the internal VMware Certificate Authority. Replacing them with enterprise-trusted certificates requires a reachable CA — Microsoft ADCS or an external PKI — plus a signing template and a service account.
4. The Physical Network Fabric
VCF assumes a correctly built underlay:
MTU of at least 1700 bytes end to end between tunnel endpoints, because Geneve encapsulation adds at least 50 bytes. Jumbo frames at 9000 are the common standard.
VLANs provisioned and trunked for management, vSAN, vMotion, and host overlay traffic.
Routed connectivity between the subnets carrying tunnel endpoints.
5. Binary and Depot Access
The installer must obtain the software bill of materials, either from the Broadcom depot in a connected environment or through an offline bundle where the site is disconnected. Where a proxy stands between the environment and the depot, it must be declared.
6. Identity Source
Federating VCF to an enterprise identity provider requires that provider to exist and be reachable, along with the service accounts and group structure that role assignments will target.
Candidate Prerequisites Broadcom States
The exam guide also sets an experience expectation that doubles as a study checklist. Candidates should have at least one year of general IT experience plus at least six months working with either VCF or its individual components , and foundational knowledge of Kubernetes, hardware, storage, networking, DNS, NTP, and certificates . The recurrence of DNS, NTP, and certificates in that list is not accidental — they are exactly the external dependencies above.
Exam Watch: Key Scenarios and Candidate Traps
Important
Read whether the question asks what VCF is or what VCF needs. "Which components make up the deployment" wants NSX, vSAN, VCF Operations. "Which additional components must be in place to complete the deployment" wants DNS, NTP, the physical fabric, and depot access.
Tip
When a deployment fails at validation, work the dependency list in order. DNS both directions, then time skew, then MTU, then disk cleanliness. That sequence resolves the overwhelming majority of blocked bring-ups and mirrors how validation itself is ordered.