VMware Certified Advanced Professional - Network Virtualization Deploy Advanced Practice Exam: Hard Questions 2025

An enterprise has three NSX-T Manager nodes behind a load balancer for VIP access. After a maintenance window, administrators notice intermittent failures when using API calls and UI actions that create or modify objects. The NSX Manager cluster shows healthy, but some tasks fail with authorization/session errors, and failures correlate with which load balancer member answers the request. Which load balancer configuration is the MOST likely root cause and best fix?

A provider deploys NSX-T with an overlay-backed Tier-0 (T0) that advertises routes to two upstream routers using BGP ECMP. After enabling an additional Edge Node and placing it in the same Edge Cluster, north-south traffic becomes asymmetric for some flows. Packet captures show return traffic from the physical network enters Edge Node 2, while the original outbound flow left via Edge Node 1. Some stateful services intermittently fail. Which architecture change BEST preserves ECMP while preventing stateful service breakage?

A tenant requires east-west connectivity between two segments attached to the same Tier-1 Gateway. The segments are overlay-backed and connected to the same transport zone. Hosts are prepared and show healthy tunnel status. However, VMs on different ESXi hosts cannot ping across segments, while VMs on the same host can. ARP works locally but inter-host connectivity fails. Which is the MOST likely missing configuration element in the data plane?

An organization uses a single Tier-0 Gateway with two uplinks to different physical routers (R1 and R2). They require deterministic egress such that traffic from Segment-A always exits via R1 and traffic from Segment-B always exits via R2, while still keeping both uplinks active for redundancy. Which NSX-T design MOST directly meets this requirement without resorting to static routes on physical routers?

A new overlay segment is created for a Kubernetes cluster. Nodes on the segment must obtain IPs via DHCP from an external DHCP server located in a VLAN network reachable through the Tier-0. The administrator configures a DHCP relay profile and applies it to the segment, but clients never receive leases. Routing is confirmed and the DHCP server sees no requests. Which additional requirement is MOST likely missing for DHCP relay to function in this design?

A security team mandates that all east-west traffic between application tiers must be allowed only via explicit L7 (FQDN/URL) policies. The environment is NSX-T with distributed firewall (DFW) enabled, but no guest agents are allowed and workloads include Linux and Windows. Which statement is MOST accurate about meeting this requirement solely with NSX-T DFW?

An application uses a Tier-1 NAT policy for outbound SNAT and a separate DNAT for inbound published services. After enabling stateful DFW rules on the workload segment, inbound connections to the DNAT VIP begin failing intermittently, while outbound traffic remains fine. The DNAT is configured on the Tier-1 Gateway. Which troubleshooting step is MOST likely to identify the root cause quickly?

A multi-tenant environment uses NSX-T Groups with dynamic membership based on VM tags to apply micro-segmentation. A new automation pipeline rapidly creates and deletes VMs, and security notices brief windows where new VMs can communicate broadly before intended rules apply. Which approach BEST reduces the exposure window while preserving automation and dynamic grouping?

After deploying NSX-T on vSphere, transport node status shows healthy, but overlay VM-to-VM traffic across hosts fails only when the source VM is on a specific ESXi host. Other hosts communicate normally. The affected host shows Geneve tunnels up. Which is the MOST targeted next step to isolate the fault domain?

An NSX environment integrates with vCenter. Administrators can create segments and groups, but inventory synchronization is inconsistent: some VMs never appear in NSX for tagging/group membership even though they exist in vCenter, and the issue persists after waiting. Other VMs sync normally. Which condition is MOST likely to cause this selective inventory visibility issue?