5.5 VCF Deployment Components & Additional Required Infrastructure

5.5 VCF Deployment Components & Additional Required Infrastructure

Exam Focus: Two distinct blueprint objectives sit behind this section — "identify the components of a VCF Deployment" and "identify the additional components required to complete the deployment of a VMware Cloud Foundation-based private cloud". They sound similar but test opposite things. The first asks what VCF is; the second asks what VCF depends on and does not supply.

---

The Component Set Broadcom Expects You to Know

The official exam guide's description of the minimally qualified candidate lists the components by name. Treat that list as the authoritative scope:

vCenter, ESX, vSphere Supervisor, vSAN, NSX, VCF Identity Broker, VCF Automation, VCF Operations, VCF Operations for Logs, VCF Fleet Management, VCF Operations for Networks, and VCF Operations HCX.

Note three things about that list immediately:

• The hypervisor is ESX, not ESXi. VCF 9.0 dropped the trailing "i".
• Several familiar products appear under VCF-prefixed names because the Aria and vRealize branding is gone. VCF Operations for Logs is the former Aria Operations for Logs and vRealize Log Insight; VCF Operations for Networks is the former Aria Operations for Networks and vRealize Network Insight.
• VCF Identity Broker replaces the Workspace ONE Access role in the identity path.

---

Instance-Scoped Versus Fleet-Scoped

The most useful mental model is not an alphabetical list but a scope boundary. Some components exist once per VCF instance; others span the whole fleet.

This boundary explains a behaviour covered in the bring-up section: the VCF Installer can either deploy new VCF Operations nodes and a new VCF Automation instance, or leverage instances that already exist. Choosing to reuse is what makes a second instance part of a fleet instead of an isolated island with its own parallel operations stack.

The VCF Operations Node Roles

VCF Operations is itself a cluster with distinct node roles — a primary, a replica that provides high availability for the primary, and data nodes that scale collection and analytics capacity. The installer can deploy all three.

---

What VCF Does Not Deploy: The External Dependencies

The second objective is where candidates lose marks, because the answer is a list of things the platform assumes are already correct.

1. DNS — Forward and Reverse

Every appliance FQDN must resolve forward (A record) and reverse (PTR record), and the two must agree. VCF issues and validates certificates against names; a missing PTR or a mismatched pair fails validation before deployment begins. This is the single most common bring-up blocker.

2. NTP

Every host and appliance must reach a common, reliable time source. Time skew breaks certificate validity windows and Single Sign-On token exchange, and the symptoms surface far from the cause — an SSO login failure weeks later traced back to a drifting host.

3. Certificate Services

Components start on certificates signed by the internal VMware Certificate Authority. Replacing them with enterprise-trusted certificates requires a reachable CA — Microsoft ADCS or an external PKI — plus a signing template and a service account.

4. The Physical Network Fabric

VCF assumes a correctly built underlay:

• MTU of at least 1700 bytes end to end between tunnel endpoints, because Geneve encapsulation adds at least 50 bytes. Jumbo frames at 9000 are the common standard.
• VLANs provisioned and trunked for management, vSAN, vMotion, and host overlay traffic.
• Routed connectivity between the subnets carrying tunnel endpoints.

5. Binary and Depot Access

The installer must obtain the software bill of materials, either from the Broadcom depot in a connected environment or through an offline bundle where the site is disconnected. Where a proxy stands between the environment and the depot, it must be declared.

6. Identity Source

Federating VCF to an enterprise identity provider requires that provider to exist and be reachable, along with the service accounts and group structure that role assignments will target.

---

Candidate Prerequisites Broadcom States

The exam guide also sets an experience expectation that doubles as a study checklist. Candidates should have at least one year of general IT experience plus at least six months working with either VCF or its individual components, and foundational knowledge of Kubernetes, hardware, storage, networking, DNS, NTP, and certificates. The recurrence of DNS, NTP, and certificates in that list is not accidental — they are exactly the external dependencies above.

---

Exam Watch: Key Scenarios and Candidate Traps

[!IMPORTANT] Read whether the question asks what VCF is or what VCF needs. "Which components make up the deployment" wants NSX, vSAN, VCF Operations. "Which additional components must be in place to complete the deployment" wants DNS, NTP, the physical fabric, and depot access.

[!TIP] When a deployment fails at validation, work the dependency list in order. DNS both directions, then time skew, then MTU, then disk cleanliness. That sequence resolves the overwhelming majority of blocked bring-ups and mirrors how validation itself is ordered.