VMware Cloud on AWS Master Specialist Practice Exam 2025: Latest Questions

An administrator is validating the default management components provided in a new VMware Cloud on AWS SDDC. Which component provides centralized identity and authentication for vCenter Single Sign-On within the SDDC?

A network engineer needs to allow on-premises workloads to reach a segment in VMware Cloud on AWS over the existing private connectivity. Which connectivity option is designed to provide private routing between the on-premises data center and the SDDC using the customer’s network edge?

A team plans to migrate 50 virtual machines from an on-premises vSphere environment to VMware Cloud on AWS with minimal disruption and the ability to perform a planned cutover. Which built-in service is most appropriate for this migration approach?

An operator wants to investigate performance issues in an SDDC and needs to quickly view host and cluster health, resource utilization, and triggered alerts. Which interface is the primary starting point for these operational insights in VMware Cloud on AWS?

A company wants to connect multiple VMware Cloud on AWS SDDCs in different AWS Regions and on-premises sites to enable scalable any-to-any routing without building numerous point-to-point connections. Which VMware Cloud on AWS feature best meets this requirement?

A security team requires micro-segmentation between application tiers running on the same VMware Cloud on AWS segment. They want policy based on workload attributes and enforced at the vNIC level. Which capability should be used?

An architect is designing an SDDC that must maintain vSphere availability during an ESXi host failure while also tolerating a single disk group failure on a vSAN datastore. Which combination best aligns with this requirement?

A migration lead is planning to move workloads to VMware Cloud on AWS using HCX. The source environment uses non-routable subnets that must remain unchanged after migration for application compatibility. Which HCX feature best addresses this requirement?

After configuring an SDDC’s on-premises connectivity, workloads in a VMware Cloud on AWS compute segment cannot reach a specific on-premises subnet. Other on-premises subnets are reachable. Routing appears correct on the on-premises router. Which NSX component is the MOST likely place to verify whether the missing subnet is being advertised/learned and permitted for routing to the segment?

A customer needs to provide VMware Cloud on AWS workloads with access to multiple AWS native services privately, without traversing the public internet. They also want to avoid exposing the SDDC networks directly to the AWS VPC CIDR. Which design is MOST appropriate?

An administrator needs to provide local egress to the internet for a subset of workloads in an SDDC while keeping other workloads using the default egress path. Which VMware Cloud on AWS component provides this capability?

A customer configures a policy-based VPN from the on-premises data center to VMware Cloud on AWS. The tunnel establishes, but workloads in VMC cannot reach an on-premises subnet unless a static route is manually added. Which configuration change is the best practice to avoid manual route management?

A cloud administrator needs to ensure that only a specific group of administrators can create or modify NSX Distributed Firewall rules in a VMware Cloud on AWS SDDC. Which approach best meets this requirement?

A customer plans to migrate several on-premises workloads to VMware Cloud on AWS but wants to keep the original IP addresses to minimize application changes. The workloads must remain reachable from on-premises during and after migration. Which solution best meets the requirement?

A customer reports intermittent connectivity from on-premises to a workload in VMware Cloud on AWS. The VPN tunnel shows as UP, but only some subnets can reach the workload. Which step is the most appropriate next action to isolate the issue?

A customer uses VMware Cloud on AWS and needs to grant an AWS account access to an S3 bucket from workloads in the SDDC without exposing the bucket to the public internet. Which design is the recommended approach?

A customer wants to monitor vSAN capacity trends and receive proactive alerts for potential capacity exhaustion in VMware Cloud on AWS. Which tool/feature best fits this requirement?

A customer needs to migrate 200 VMs to VMware Cloud on AWS with minimal downtime. Many VMs are business-critical and must be moved with near-zero disruption, while others can tolerate brief downtime. Which HCX migration methods should be used to best meet these mixed requirements?

A security team requires micro-segmentation for east-west traffic between application tiers in VMware Cloud on AWS. They also require that policy follows the workload even if it is migrated to another segment within the SDDC. Which approach best satisfies this requirement?

After a planned change, workloads in a routed segment can no longer reach a specific on-premises subnet over a Direct Connect connection. Other on-premises subnets remain reachable. The Direct Connect and BGP sessions are up. What is the MOST likely cause?

A customer wants to quickly validate that east-west traffic between workloads in the same VMware Cloud on AWS SDDC can be inspected and controlled without forcing traffic to the on-premises data center. Which capability best satisfies this requirement?

An administrator is configuring DNS resolution for workloads in a VMware Cloud on AWS SDDC. Workloads must resolve on-premises internal DNS zones, and on-premises clients must resolve a new DNS zone hosted in the SDDC. What is the recommended approach?

A team uses HCX to migrate VMs from on-premises to VMware Cloud on AWS. Several VMs fail to migrate because their MAC addresses must be preserved due to a licensing dependency. Which HCX migration method should be selected?

A VMware Cloud on AWS administrator needs to provide an on-demand, short-lived access method for a third-party vendor to troubleshoot a single VM. The vendor must not receive access to vCenter or NSX Manager, and the access should be revocable immediately after the work is completed. Which solution best meets this requirement?

After configuring a route-based VPN from on-premises to a VMware Cloud on AWS SDDC, on-premises users can reach SDDC workloads, but SDDC workloads cannot initiate connections back to certain on-premises subnets. The VPN shows as UP. Which is the most likely cause?