3V0-25.25: Advanced VMware Cloud Foundation 9.0 NetworkingDemo

By Broadcom · Question Mode

QuestionQ21

Unknown / not found in official Broadcom sources

An administrator is bringing a new research VPC into its R&D project.

Requirements include:

  • Application teams must remain isolated while still consuming shared DNS.
  • The physical core network exposes BGP only on VLAN 300-dc-edge-uplink-pg, which terminates on the Edge cluster.
  • Any north-south connectivity to the datacenter must pass through Edge.
  • East-west paths should stay on hosts where possible.
  • Direct Internet egress is not permitted.

Which combination of Transit Gateway (TGW) mode, VPC subnet type, and routing configuration satisfies these requirements?

  • A Distributed TGW with Private-VPC subnet, policy-based routing to shared services; static routes for datacenter services on each segment.
  • B Distributed TGW, external attachment for the datacenter core and Private-TGW Subnet to shared services; import datacenter routes via BGP on transport nodes and suppress export.
  • C Centralized TGW with Private-TGW Subnet to datacenter core and external to shared services; advertise all VPC routes but rely on upstream ACLs to block.
  • D Centralized TGW, external attachment on the Edge for datacenter core and Private-TGW Subnet to shared services; import only required datacenter prefixes and disable/filter export of VPC routes.
Explanation

Centralized external connectivity places the TGW and Tier-0 service routers on NSX Edge VMs, enabling the BGP connection on the Edge-terminated VLAN and ensuring datacenter north-south traffic traverses Edge. A Private-TGW subnet permits VPCs attached to the same TGW to consume shared DNS while retaining project-scoped routing and avoiding external advertisement. Importing only necessary datacenter prefixes and filtering or disabling VPC-route export enforces least-route exposure and prevents unintended egress.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!