VCAP · VCF Automation · Exam 3V0-21.25 · VMware Cloud Foundation 9

This is the advanced VCF 9 exam about building a platform other people consume. Its blueprint publishes six objectives, which sounds small until you open them: there are forty-three sub-objectives underneath, and thirty-five of those sit in one section. Preparing for it by reading the six headings is the most common way to walk in under-prepared. Hence this workbook of 178 tasks, written against the forty-three.

FirstWhat this exam actually is

This one takes two documents to pin down. The blueprint, last updated 4 November 2025, carries the objectives but not the exam mechanics. The certification page carries the mechanics:

Sources: the official exam guide and the certification page, both published by Broadcom. Read them yourself before you book. Everything below is written against the objectives in the exam guide.

SecondWhere the weight actually sits

Count the headings and this blueprint looks evenly spread. Count what is underneath them and it is not spread at all:

Thirty-five of the forty-three are in section 4, and fifteen of those are Consumption alone: content libraries, images, subscriptions, blueprints, the service catalog, Day 2 actions, custom property groups, custom resources, custom resource actions, and five separate sub-objectives on VCF Operations Orchestrator. If you plan your revision by section headings you will give Consumption a seventh of your time instead of a third of it.

ThirdIf you already prepared for the Administrator exam

Then a quarter of this one is already done. I compared the two published blueprints line by line, and ten of the forty-three sub-objectives here appear word for word in 3V0-11.26:

Look at where they fall. All ten are in Provider Management and Organization Management, which is half of those two objectives covered. None of Consumption overlaps at all, and neither does the design objective or the monitoring one. So if you have sat the Administrator exam, the genuinely new ground is sections C and D, and then N to T of the workbook below: blueprints, the catalog, custom resources, Orchestrator and monitoring. That is where to spend your time.

Objective 2.1 here, the vSphere Supervisor and its networking, is the same ground that the VKS blueprint covers in its own objectives 2.1 and 2.2, in different words. Different exam, same platform underneath, and worth knowing if you have done that one.

FourthWhere to practise, and how

This is the least lab-friendly of the advanced VCF exams, because almost nothing in it runs without a real VCF 9 instance with a Supervisor behind it. Be realistic about that before you book. Three routes:

• A work or customer environment, for whatever your role authorises. If your employer runs VCF 9 with Automation, ask for a tenant organization of your own. One organization you can create, break and delete is worth more than any amount of reading here.
• VMware Hands-on Labs, free and in a browser. Check the current catalogue for VCF 9 Automation labs and confirm the version each one runs before you rely on it.
• Written work for the rest. The design objective, the tenancy models, the organization-type decisions and the component definitions are all written tasks. Sections A to D below can be done with a blank page and the documentation, and they carry five of the forty-three sub-objectives.

One piece of advice on sequence. Do not start at the Provider Management portal because it is first in the blueprint. Start by drawing the hierarchy, Region, Cloud Zone, Organization, Project and Namespace Class as nested objects, and keep that drawing beside you. Nearly every configuration task in this exam is navigation within that one picture, and people who lose marks here usually lost them by not knowing which level a setting belongs to.

Workbook178 tasks, in build order

Sections A and B are the platform underneath. C and D are written design work. E to H are the provider portal, I to M are the inside of an organization, N to T are consumption, Orchestrator and monitoring, and U is a set of timed drills. The numbers in grey at the right are the objectives, so a weak score report points you back at a group of tasks.

Objective 2.1. The platform VCF Automation sits on, so start here even if you came for the automation.

1. 1Draw a vSphere Supervisor and name every component it deploys.2.1›
2. 2Record how many control plane virtual machines a Supervisor creates and what each one does.2.1›
3. 3Write what a vSphere Namespace is, and why it is two things at once.2.1›
4. 4List what must be attached to a namespace before anything can be deployed into it.2.1›
5. 5Write the difference between a vSphere Pod, a VM created by VM Service, and a VKS cluster.2.1›
6. 6Record what a Supervisor Service is and name two of them.2.1›
7. 7Write what a vSphere Zone is and what a three-zone Supervisor protects against.2.1›
8. 8Record which Supervisor decisions cannot be changed after enablement.2.1›
9. 9Write how VCF Automation consumes the Supervisor, and which objects appear on each side.2.1›

The second half of objective 2.1, and the part that decides what Automation can offer.

1. 10Write the three workload networking options for a Supervisor and the load balancer choices each allows.2.1›
2. 11Record which networking option VCF Automation expects for the full set of services.2.1›
3. 12Draw the NSX objects created per namespace on a segment-backed Supervisor.2.1›
4. 13Draw the NSX objects created for a VPC-backed Supervisor.2.1›
5. 14Compare the object count of both models at a hundred namespaces.2.1›
6. 15Write where ingress and egress addresses come from in each model.2.1›
7. 16Record what a Transit Gateway does in the VPC model.2.1›
8. 17Write what changes for Automation if the Supervisor was built on vDS networking only.2.1›

Objective 3.1, the design section. Three sub-objectives, and all of them are choosing questions.

1. 18List the VCFA tenancy deployment models and write one line on what each is for.3.1›
2. 19Write which model you would choose for a single internal IT department, and why.3.1›
3. 20Write which model you would choose for a service provider with external customers, and why.3.1›
4. 21Write the difference between an All Apps organization and a VM Apps organization in one sentence each.3.1›
5. 22List what an All Apps organization can offer that a VM Apps organization cannot.3.1›
6. 23Given a tenant who only runs virtual machines, choose an organization type and justify it.3.1›
7. 24Given a tenant who needs Kubernetes namespaces and self-service networking, choose and justify.3.1›
8. 25Write what it costs to change organization type later, and design so you do not have to.3.1›

The third sub-objective of 3.1, and the vocabulary everything else is built from.

1. 26Write what a Region is in VCF Automation and what it maps to underneath.3.1›
2. 27Write what a Cloud Zone is and how it relates to a Region.3.1›
3. 28Write what a Quota controls and at which level it is set.3.1›
4. 29Draw Region, Cloud Zone, Organization and Project as nested objects, so the containment is unambiguous.3.1›
5. 30Write which of these the provider creates and which the tenant creates.3.1›
6. 31Write what happens to a deployment when the quota it draws from is exhausted.3.1›
7. 32Write what the remaining functional components are: flavors, VM classes, images and extensibility.3.1›
8. 33Design the Region and Cloud Zone layout for a two-site estate, and justify it.3.1›

Objective 4.1 begins. Eleven sub-objectives, the largest single block outside Consumption.

1. 34Sign in to the Provider Management portal and record what a provider administrator can see.4.1›
2. 35Configure the portal basics and record every setting that applies fleet-wide.4.1›
3. 36Configure the identity provider for the portal and sign in as a federated user.4.1›
4. 37Record what breaks if the identity provider is unreachable, and what still works.4.1›
5. 38Confirm the local provider account still works, and record where its credentials live.4.1›
6. 39Map a directory group to a provider role and test what that role can and cannot do.4.1›
7. 40Create a custom provider role and prove the boundary of one privilege you excluded.4.1›

Still objective 4.1. What the provider makes available before any tenant exists.

1. 41Create a Region in the Provider Management portal and record what it needs first.4.1›
2. 42Associate infrastructure with the Region and confirm it reports as available.4.1›
3. 43Create a second Region and record what is shared between them and what is not.4.1›
4. 44Create a provider content library and record where its storage comes from.4.1›
5. 45Publish an image into the provider content library.4.1›
6. 46Add a Kubernetes release to the library and confirm it becomes available to the Supervisor.4.1›
7. 47Record how an organization gets access to a provider library, and what the tenant sees.4.1›
8. 48Remove an item from the library and record what happens to deployments that used it.4.1›

The remaining provider-level configuration in objective 4.1.

1. 49Create a rights bundle and record what a rights bundle actually grants.4.1›
2. 50Use a rights bundle to give an organization access to VCF Operations Orchestrator.4.1›
3. 51Confirm from inside the organization that the Orchestrator access arrived.4.1›
4. 52Configure VCF Data Services in the Provider Management portal.4.1›
5. 53Record what Data Services offers a tenant and what it requires of the platform.4.1›
6. 54Configure provider-level certificate management and record which services present which certificate.4.1›
7. 55Replace a provider certificate and list everything that must be re-registered afterwards.4.1›
8. 56Configure organization branding and record what a tenant sees change.4.1›
9. 57Record which branding elements are set by the provider and which by the tenant.4.1›

The last of objective 4.1, and the most consequential actions in the portal.

1. 58Create a new organization and record every decision the wizard asks for.4.1›
2. 59Record which of those decisions cannot be changed afterwards.4.1›
3. 60Assign infrastructure to the organization and prove it cannot see another organization.4.1›
4. 61Enable the Provider Consumption Organization and record what it is for.4.1›
5. 62Deploy one workload through the PCO and write how it differs from a tenant organization.4.1›
6. 63Record who should use the PCO and who should not.4.1›
7. 64Delete a test organization and record what the platform warns you about first.4.1›
8. 65Record what is removed on deletion and what is left behind.4.1›

Objective 4.2 begins. The tenant side of identity.

1. 66Configure an identity provider inside a VCF All Apps organization.4.2›
2. 67Record why a tenant would want its own identity source rather than the provider one.4.2›
3. 68Map a directory group to an organization role and sign in as a member.4.2›
4. 69Configure the three common roles: organization owner, project member, viewer.4.2›
5. 70Create a custom organization role and test exactly what it can and cannot do.4.2›
6. 71Write the two layers of access: organization role, and project membership.4.2›
7. 72Record what happens to a user who is in the organization but in no project.4.2›

Still objective 4.2. What the organization connects to and what it holds.

1. 73Add the Git integration to a VCF All Apps organization and record what it enabled.4.2›
2. 74Add the Orchestrator integration and confirm it appears for project members.4.2›
3. 75Remove an integration and record what stops working.4.2›
4. 76Configure a certificate within the organization and record what presents it.4.2›
5. 77Create a secret in the organization and record where it can be used.4.2›
6. 78Record who can read a secret and who cannot, and test it.4.2›
7. 79Rotate a secret and confirm whatever used it still works.4.2›

Where tenants are actually bounded, and the heart of objective 4.2.

1. 80Create a Project and assign users, a region and a quota.4.2›
2. 81Sign in as a project member and confirm they see only their own project.4.2›
3. 82Create a second project and prove isolation between the two.4.2›
4. 83Exhaust a project quota and record the exact error a user receives.4.2›
5. 84Create a governance policy restricting which machine sizes may be deployed.4.2›
6. 85Test it from a user account with a disallowed size, and record the error.4.2›
7. 86Create a lease policy, deploy something, and watch the lease expire.4.2›
8. 87Record whether the owner was warned before expiry, and who can extend a lease.4.2›
9. 88Create an approval policy and approve a request as a different person.4.2›
10. 89Record where the audit trail of an approval is kept.4.2›
11. 90Write where you would deliberately not apply an approval policy, and why.4.2›

Its own sub-objective in 4.2, and the bridge from Automation to the Supervisor.

1. 91Create a Namespace Class and record everything it defines.4.2›
2. 92Set the CPU, memory and storage limits on the class.4.2›
3. 93Select the storage classes and VM classes the namespace may use.4.2›
4. 94Deploy a namespace from the class as a project member.4.2›
5. 95Open the resulting vSphere Namespace in vCenter and confirm the limits came from the class.4.2›
6. 96Write what a Namespace Class controls that a Project does not.4.2›
7. 97Change the class and record what happens to namespaces already deployed from it.4.2›

The networking sub-objectives of 4.2, including the ones easy to miss.

1. 98Create a VPC from within the organization.4.2›
2. 99Open NSX and list the objects created underneath it.4.2›
3. 100Create a VPC connectivity profile at organization level and record what it controls.4.2›
4. 101Attach two VPCs to the same profile and confirm they drew non-overlapping addresses.4.2›
5. 102Create a Private Transit Gateway IP Block and record what consumes it.4.2›
6. 103Create an IP Quota and record what it limits.4.2›
7. 104Exhaust an IP quota and record the error and where a provider would check it.4.2›
8. 105Write the difference between an IP block and an IP quota in one sentence each.4.2›
9. 106Record the regional network configuration an organization needs before any VPC can exist.4.2›

Objective 4.3 begins, the largest objective in the blueprint at fifteen sub-objectives.

1. 107Create an Organizational Content Library within a VCF All Apps organization.4.3›
2. 108Record how it differs from the provider content library.4.3›
3. 109Upload an image into the organization library.4.3›
4. 110Record the image formats accepted and the one you would standardise on.4.3›
5. 111Deploy something from the uploaded image to prove the library is usable.4.3›
6. 112Create a Subscription to a published library and confirm items arrive.4.3›
7. 113Record the difference between downloading content immediately and on demand.4.3›
8. 114Change something in the source library and confirm the subscriber picks it up.4.3›

Still 4.3. What a tenant actually does with the platform.

1. 115Deploy a virtual machine within a VCF All Apps organization.4.3›
2. 116Deploy a namespace and record which class it came from.4.3›
3. 117Deploy a VPC or network resource and record what was created underneath.4.3›
4. 118Deploy a Kubernetes cluster if the organization offers one, and record how long it took.4.3›
5. 119Record which resource types your organization can deploy and which it cannot.4.3›
6. 120Record where a deployment appears afterwards and what a user can do with it.4.3›

Three separate sub-objectives of 4.3, and where extensibility begins.

1. 121Create a Custom Property Group and record what it is for.4.3›
2. 122Use the property group in a deployment and confirm the values arrived.4.3›
3. 123Record the difference between a property group and a plain input on a blueprint.4.3›
4. 124Create a Custom Resource and record what it lets a tenant deploy that was not there before.4.3›
5. 125Record what a Custom Resource needs behind it to actually do anything.4.3›
6. 126Create a Custom Resource Action and attach it to a resource type.4.3›
7. 127Run the custom action against a deployed resource and confirm the result.4.3›
8. 128Write the difference between a Custom Resource Action and a Day 2 Action.4.3›

The centre of the Consumption objective.

1. 129Create a Blueprint that deploys a single resource.4.3›
2. 130Add inputs to the blueprint and record which a requester may change.4.3›
3. 131Version the blueprint and record what versioning gives you.4.3›
4. 132Publish the blueprint to the Service Catalog and share it with a project.4.3›
5. 133Sign in as an ordinary project member and request it from the catalog.4.3›
6. 134Confirm the requester could change only what the blueprint exposed.4.3›
7. 135Create a blueprint that deploys more than one resource with a dependency between them.4.3›
8. 136Break a blueprint deliberately, read the validation error, and fix it.4.3›
9. 137Record where a failed deployment reports its reason, and the first place you would look.4.3›
10. 138Withdraw a catalog item and record what happens to existing deployments.4.3›

Its own sub-objective, and the part tenants use most after the first week.

1. 139List the Day 2 Actions available on a deployed virtual machine.4.3›
2. 140Resize a deployment using a Day 2 Action and confirm the change.4.3›
3. 141Use a Day 2 Action to change the lease on a deployment.4.3›
4. 142Record which Day 2 Actions require approval and which do not.4.3›
5. 143Restrict a Day 2 Action with a policy and test it from a user account.4.3›
6. 144Record where Day 2 Actions are audited.4.3›
7. 145Destroy a deployment through a Day 2 Action and confirm what was cleaned up.4.3›

Five sub-objectives of 4.3 on their own. Treat Orchestrator as its own subject.

1. 146Deploy and configure VCF Operations Orchestrator for a VCF All Apps organization.4.3›
2. 147Confirm the organization can reach it, using the rights bundle from section G.4.3›
3. 148Identify the components of an Orchestrator workflow and write what each one does.4.3›
4. 149Write the difference between a workflow, an action and a policy in Orchestrator.4.3›
5. 150Create a Workflow that takes an input and produces an output.4.3›
6. 151Add a decision element to the workflow and test both branches.4.3›
7. 152Run the workflow and read its execution log, including a failed run.4.3›
8. 153Create an Action and call it from a workflow.4.3›
9. 154Record when you would write an Action rather than put the logic in the workflow.4.3›
10. 155Install a VCF Operations Orchestrator Plug-in.4.3›
11. 156Configure the plug-in and use one of its elements in a workflow.4.3›
12. 157Record what a plug-in adds, and what it costs in upgrade dependency.4.3›
13. 158Call a workflow from a blueprint or a Custom Resource Action, joining the two halves of this exam.4.3›

Objective 5.1, the whole of section 5 in three sub-objectives.

1. 159Confirm VCF Operations is collecting from VCF Automation.5.1›
2. 160Find the VCF Automation objects in VCF Operations and record what is reported about each.5.1›
3. 161Monitor Provider Management: what is healthy, what is degraded, what is at capacity.5.1›
4. 162Monitor an All Apps organization: its projects, deployments and quota consumption.5.1›
5. 163Build an alert on an Automation condition and trigger it deliberately.5.1›
6. 164Build a dashboard a provider administrator would actually use.5.1›
7. 165Build a view that shows a tenant what they are consuming.5.1›
8. 166Record which question each product answers: Operations, Operations for Logs, the portal itself.5.1›
9. 167Record what you would monitor to know a deployment failed before the tenant tells you.5.1›

Do this section twice in the final week, from a clean start, timing yourself.

1. 168Create an organization, assign infrastructure, and sign in as its administrator. 20 minutes.4.1›
2. 169Configure the organization identity provider and map two groups to two roles. 20 minutes.4.2›
3. 170Create a project with a quota, a governance policy and an approval policy. 25 minutes.4.2›
4. 171Create a Namespace Class and deploy a namespace from it. 20 minutes.4.2›
5. 172Create a VPC, a connectivity profile and an IP quota. 25 minutes.4.2›
6. 173Create a content library, upload an image, and deploy from it. 20 minutes.4.3›
7. 174Build a blueprint with inputs, publish it, and request it as an ordinary user. 30 minutes.4.3›
8. 175Build an Orchestrator workflow with an input, a decision and an action. 30 minutes.4.3›
9. 176Perform three Day 2 Actions on a deployment and record where each was audited. 15 minutes.4.3›
10. 177Build a monitoring view for a provider and one for a tenant. 20 minutes.5.1›
11. 178Write the Region, Cloud Zone, Organization, Project and Namespace Class hierarchy from memory. 10 minutes.3.1›

How to use itFive weeks, or four if you compress

Weeks 4 and 5 are the heavy ones, and that is deliberate: Consumption and Orchestrator together are more than a third of the blueprint. If you only have four weeks, take them from weeks 1 and 2, not from these. The provider portal is quick to learn and quick to re-learn. Orchestrator is not.

Two things to be able to do without notes by the end. Draw the hierarchy from memory, which is task 178. And write the Supervisor networking table from section B, the three workload networking options against the load balancers each allows, because it decides what Automation can offer a tenant and it eliminates wrong answers quickly.

Exam details are from the published Broadcom exam guide, last updated 4 November 2025, and are accurate at the time of writing. Broadcom revises blueprints regularly, so confirm the current version before you book. Practice tasks here are my own, written from the published objectives; they are not exam content.