2V0-17.25 interview questions & answers

VCF bundles vSphere (ESXi + vCenter) for compute, vSAN for storage, NSX for networking and security, and SDDC Manager to deploy and lifecycle-manage it all as one stack. SDDC Manager is the differentiator — it automates bring-up, patching and certificate rotation across the whole platform.

The management domain is the first domain SDDC Manager deploys and runs the management components (vCenter, NSX managers, SDDC Manager). Workload (VI) domains carry the actual tenant/application VMs and have their own vCenter and resources. Separating them keeps management lifecycle and failures isolated from production workloads.

vSAN pools local disks across hosts into a shared datastore and protects data with storage policies. FTT (Failures To Tolerate) sets how many host/disk failures an object survives — FTT=1 with RAID-1 keeps two copies plus a witness, so you need enough hosts. You set protection per-VM through policy, not per-LUN.

NSX provides software-defined networking: logical switches (overlay/Geneve), distributed routing, and crucially a distributed firewall that enforces micro-segmentation at each VM's vNIC — east-west security without hair-pinning to a physical firewall. It also brings load balancing, VPN and multi-site networking in software.

Through SDDC Manager Lifecycle Management: download the bundle, run it against the management domain first, then workload domains, in the supported order and sequence it enforces. It respects vSAN and cluster health and does hosts in a rolling fashion so workloads keep running. You do not patch each component by hand.

HA restarts VMs on surviving hosts after a host failure — it is about recovery. DRS balances load by vMotioning VMs across hosts based on resource use, and can place VMs at power-on — it is about efficiency. They complement each other: DRS keeps things balanced, HA brings them back after a failure.

The witness holds metadata (not data) to break ties so the cluster can tell a real failure from a network partition and keep a quorum. In stretched or 2-node clusters the witness lives at a third site/host; without it a split-brain could corrupt or down the datastore.

Confirm both hosts share the VM's storage and networks, have a vMotion-enabled VMkernel on the same subnet with working MTU (jumbo frames must match end to end), compatible CPU (or EVC enabled on the cluster), and enough resources on the target. The task error and vpxd logs usually name the exact blocker.

Use the NSX distributed firewall with security groups built on tags/VM attributes rather than IPs, and default-deny east-west traffic, allowing only required flows. Because the rule is enforced at each VM's vNIC, a compromised VM cannot move laterally even within the same subnet.

Size for usable capacity after the FTT policy overhead (RAID-1 doubles, RAID-5/6 adds parity), keep ~25-30% slack free for rebuilds and so vSAN can self-heal, and account for dedup/compression realistically. Plan host count so losing one still meets the FTT policy, and monitor with vSAN health and skyline.