3V0-21.23 · Question #14
An architect is finalizing the design for a new vSphere platform based on the following information: - All Windows virtual machines will be hosted on a dedicated cluster for licensing purposes…
The correct answer is C. Deploy a vCenter Server for the management cluster with a dedicated SSO domain. Option C is correct because the two Active Directory domains reside in separate forests with no trusts, and the design requires Integrated Windows Authentication (IWA). When IWA is used, vCenter's SSO ties authentication to a specific AD domain - since the management and…
Question
An architect is finalizing the design for a new vSphere platform based on the following information:
- All Windows virtual machines will be hosted on a dedicated cluster for licensing purposes.
- All Linux virtual machines will be hosted on a dedicated cluster for licensing purposes.
- All management virtual machines will be hosted on a dedicated cluster.
- A total of ten physical sites will be used to host virtual machines.
- In the event of one physical datacenter becoming unavailable, the manageability of the virtual
infrastructure in the remaining data centers should not be impacted.
- Access to configure the management virtual machines via vCenter Server must be controlled
through the management Active Directory domain.
- Access to configure the Windows and Linux virtual machines must be controlled through the
resource Active Directory domain.
- The management and resource Active Directory domains are part of separate Active Directory
forests and do not have any trusts between them.
- The design will use Active Directory with Integrated Windows Authentication.
How should the architect document the vCenter Server configuration for this design?
Options
- ADeploy a vCenter server for the management cluster.
- BDeploy a vCenter Server for the management cluster.
- CDeploy a vCenter Server for the management cluster with a dedicated SSO domain.
- DDeploy a vCenter Server for the management cluster with a dedicated SSO domain.
How the community answered
(49 responses)- A12% (6)
- B4% (2)
- C80% (39)
- D4% (2)
Explanation
Option C is correct because the two Active Directory domains reside in separate forests with no trusts, and the design requires Integrated Windows Authentication (IWA). When IWA is used, vCenter's SSO ties authentication to a specific AD domain - since the management and resource domains cannot authenticate across forest boundaries, the management vCenter Server must have a dedicated SSO domain to isolate its authentication context to the management AD forest only.
Why A is wrong: It uses lowercase "vCenter server" - incorrect VMware product naming ("vCenter Server" is the proper designation), which alone disqualifies it in a documentation context.
Why B is wrong: While it correctly names "vCenter Server," it omits the dedicated SSO domain - a critical architectural requirement given the untrusted, separate-forest AD topology. Without a dedicated SSO domain, there is no clean boundary enforcing which AD forest handles authentication for management access.
Why D is wrong: As presented, D appears identical to C (likely a transcription artifact in this question), but in similar exam scenarios a wrong variant typically implies sharing an SSO domain across vCenter Servers in different authentication contexts, which would violate the forest-trust isolation requirement.
Memory tip: Think "separate forests = separate SSO" - whenever two AD environments have no trust relationship and use IWA, each vCenter serving a distinct domain boundary needs its own dedicated SSO domain to enforce proper authentication isolation.
Topics
Community Discussion
No community discussion yet for this question.