Study guide
9.4 Workload & Infrastructure Encryption
VMware vSphere Foundation 9.0 Administrator VCP-VVF, 2V0-16.25
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Exam Overview & Preparation Strategy
1.1 Exam Format, Passing Standard & Blueprint Structure 1.2 Preparation Strategy & Hands-On Lab Setup
2 Chapter 2: Virtualization & ESXi Host Fundamentals
2.1 Hypervisor Architecture & ESXi Operating Model 2.2 ESXi Deployment, DCUI & Initial Host Configuration 2.3 Workload Consolidation & Private Cloud Economics
3 Chapter 3: vCenter Server & Cluster Management
3.1 vCenter Server Appliance (VCSA) Architecture & Deployment 3.2 vSphere High Availability (HA) & Admission Control 3.3 Distributed Resource Scheduler (DRS) & EVC Configuration
4 Chapter 4: Virtual Machine Operations & Resource Management
4.1 Virtual Machine Provisioning, Templates & Content Libraries 4.2 Resource Allocation: Shares, Reservations & Limits 4.3 vMotion, Storage vMotion & Snapshot Management 4.4 Content Libraries, Publication & Template Versions
5 Chapter 5: vSphere Storage Architecture & Traditional Datastores
5.1 Block Storage Architecture, Fibre Channel & VMFS Datastores 5.2 NFS Datastores, Software iSCSI & Multipathing (NMP) 5.3 Storage Policy-Based Management (SPBM) Framework
6 Chapter 6: VMware vSAN Architecture & Storage Policies
6.1 vSAN Core Architecture: OSA vs Express Storage Architecture (ESA) 6.2 Deploying & Configuring a vSAN Cluster 6.3 vSAN Storage Policies, Resilience (FTT) & Fault Domains 6.4 vSAN Space Efficiency & Capacity Accounting
7 Chapter 7: vSphere Networking & Traffic Management
7.1 Standard Switches (vSS) vs Distributed Switches (vDS) 7.2 Port Groups, VMkernel Adapters & Traffic Isolation 7.3 NIC Teaming, Load Balancing, VLANs & NIOC
8 Chapter 8: VVF Deployment & Supervisor Configuration
8.1 VMware vSphere Foundation 9.0 Stack & Deployment Prerequisites 8.2 End-to-End VVF Deployment Workflow 8.3 Enabling & Configuring the vSphere Supervisor
9 Chapter 9: Identity, Licensing & Security Management
9.1 vCenter Single Sign-On (SSO), Identity Federation & RBAC 9.2 VVF 9.0 Core-Based Licensing & License Management 9.3 VMware Certificate Authority (VMCA) & TLS Configuration 9.4 Workload & Infrastructure Encryption
10 Chapter 10: Lifecycle Management with vLCM
10.1 vSphere Lifecycle Manager (vLCM) Image Architecture 10.2 Base Images, Vendor Add-ons & Hardware Support Managers (HSM) 10.3 Host Compliance Checks, Staging & Cluster Remediation
11 Chapter 11: VCF Operations: Performance, Capacity & Alerts
11.1 VCF Operations Architecture, Node Types & Adapters 11.2 Dashboards, Custom Views, Metrics & Reports 11.3 Capacity Planning, Rightsizing & Alert Policies
12 Chapter 12: VCF Operations for Logs & Compliance
12.1 VCF Operations for Logs Architecture & Ingestion 12.2 Interactive Log Analytics, Query Syntax & Dashboards 12.3 Security Hardening Compliance & Storage/App Monitoring
13 Chapter 13: Workload Consumption & Automation
13.1 vSphere VM Service: Classes, Images & Declarative Deployment 13.2 VMware Kubernetes Service & Workload Clusters 13.3 VCF Operations Orchestrator Workflows & Automation 13.4 Supervisor Services & vSphere Pods
14 Chapter 14: Operations Evidence, Policies & Financial Reporting
14.1 Metrics, Properties & Logs 14.2 Custom Views & Scheduled Reports 14.3 Effective Policies, Groups & Overrides 14.4 Cost Drivers, Pricing & Showback
15 Chapter 15: Log Integrations & Shared Operational Views
15.1 VVF Integrations & Log Events in Operations 15.2 Logs Dashboards, Queries & Sharing
16 Chapter 16: Guest Services & Application Monitoring
16.1 Configure Service Discovery 16.2 Application & Guest Monitoring
9.4 Workload & Infrastructure Encryption
Key Takeaways Explain This Topic AI
VM, vSAN-media, vSAN-transport and vMotion encryption protect different layers.
Create and back up Native Key Provider before using its protected workloads.
Encrypted data backups also need a recoverable key-provider design.
Encryption transitions and rekey operations have feature-specific power-state and recovery requirements.
Last updated: October 2026
Choose the Encryption Layer
Objective 2.2 includes securing workloads and infrastructure with encryption. VM encryption , vSAN data-at-rest encryption , vSAN data-in-transit encryption and encrypted vMotion protect different paths. Selecting one does not automatically establish the others. Start with the asset and threat: stolen storage media, exposure during migration, transport between storage hosts, or access to VM files outside their authorized context.
VM encryption protects supported VM files and disks through the vSphere encryption framework and an encryption policy. vSAN data-at-rest encryption operates at the storage layer and protects the datastore's media. It does not make the guest's network sessions encrypted. An HTTPS certificate protects a management endpoint; it is not the key that unlocks every encrypted virtual disk.
- Requirement Relevant control Separate dependency
- Protect encrypted VM files VM encryption policy Key-provider availability and authorization
- Protect data on vSAN media vSAN data-at-rest encryption Supported cluster configuration and key recovery
- Protect vSAN host-to-host data vSAN data-in-transit encryption Correct supported vSAN configuration
- Protect migration traffic Encrypted vMotion configuration Compatible source/destination and migration policy
Protect client-to-application traffic Application TLS or other approved protocol Guest/application certificate and configuration
Key Providers and Recovery
A key provider supplies the key material needed by supported encryption features. A standard external provider uses a supported Key Management Interoperability Protocol (KMIP) service and configured trust. Native Key Provider (NKP) is managed through vCenter and distributes the material needed by participating hosts. These models have different dependencies; neither removes the need to protect key backups and test recovery.
Create the provider through the supported vCenter workflow, validate trust and connectivity, and complete the required NKP backup before use. Protect the export and its password separately from the encrypted workloads. A backup of encrypted VM data is not sufficient if the required key material cannot be recovered. Account for a full-site outage, a new host and a restored vCenter, rather than testing only a VM reboot while the existing hosts retain keys.
A Data Encryption Key (DEK) protects data; a Key Encryption Key (KEK) protects the DEK in applicable storage encryption designs. Rekeying can involve changing a wrapping key or rewriting data with new encryption material. Follow the feature-specific shallow/deep rekey process and assess capacity, performance and recovery effects. Do not treat all rekey actions as a harmless certificate renewal.
Apply and Verify a VM Policy
First confirm the supported host, VM compatibility, datastore and guest/device prerequisites. Verify that a functioning key provider is selected and that the operator has the required cryptographic privileges. Create or choose an encryption-capable VM storage policy, then apply it to the supported VM home and disk objects under the documented power-state conditions. Some transitions require the VM to be powered off; do not promise that every encryption operation is online.
After the operation, inspect the encryption and policy state of the intended objects. Test a controlled power operation and a supported migration, then validate the backup product's encryption support. If an operation fails, determine whether the missing dependency is keys, privileges, unsupported device configuration, policy compatibility or storage capacity. Giving every operator full cryptographic access is not an appropriate substitute for identifying the failed requirement.
A virtual Trusted Platform Module ( vTPM ) introduces another protection and recovery consideration. Verify its encryption/key requirements and guest recovery procedures before cloning, restoring or moving a VM. Retain application or operating-system recovery material such as the approved disk-encryption recovery key. Removing a vTPM to make a migration succeed can break the guest's security/recovery expectations.
Encryption and Storage Efficiency
Data encrypted before reaching storage has less repeated/compressible content. VM encryption and storage-layer encryption therefore affect storage efficiency differently. Do not assume double encryption always improves the design. Broadcom's vSAN encryption FAQ distinguishes VM encryption from vSAN encryption and identifies restrictions for global deduplication in the documented 9.x configuration. Check the exact release and entitlement before combining features.
Worked Failure Scenario
A team restores encrypted VM disks onto replacement hosts but cannot power on the VM. The restored files demonstrate data preservation; they do not establish key availability. Check the provider registration, recovered key backup, host access and cryptographic privileges. Compare the error with a storage-policy incompatibility before changing the VM. Deleting encryption settings or resetting certificates blindly can make recovery harder.
For a complete lab exercise, record the chosen protection layer, provider, policy and recovery dependencies; deploy a disposable encrypted VM; verify its supported migration and backup; and test recovery using the documented key procedure. Store the result with the recovery runbook. Success means the authorized workload can be restored while its protected data remains inaccessible without the required keys.
Review Takeaways
VM, vSAN-media, vSAN-transport and vMotion encryption protect different layers.
Create and back up Native Key Provider before using its protected workloads.
Encrypted data backups also need a recoverable key-provider design.
Encryption transitions and rekey operations have feature-specific power-state and recovery requirements.