Eric Sloof

VMware Cloud Foundation 9.1 changes the upgrade discussion in an important way. Moving forward no longer has to mean deploying every element of the full private-cloud stack in one operation. An organization can modernize its vSphere and operations layer first, converge existing infrastructure into VCF, or upgrade an established VCF environment through lifecycle management.

That flexibility is useful, but it does not make sequencing optional. VCF 9.1 provides more routes to the destination while imposing clear rules on the order in which components must move. Choosing the wrong workflow can create licensing failures, missing binaries or blocked lifecycle operations. Broadcom therefore describes the component sequence as mandatory, not advisory.

The practical message is simple: do not wait for a perfect full-stack design before starting. Select a supported path for the environment you have today, reserve the required management resources and follow the prescribed sequence.

This article covers the VCF 9.1 family. Always check the current release notes before execution because maintenance releases can add dependencies or change the applicable build numbers.

VCF 9.1 distinguishes deployment, convergence and upgrade

The first planning decision is to identify the operation correctly. Broadcom documents three primary ways to build a VCF 9.1 environment.

These are not interchangeable words. A standalone vSphere estate is converged into VCF. An existing VCF instance is upgraded. A new environment is deployed. This distinction determines the tooling, prerequisites and component order.

The supported route depends on the components already present

VCF 9.1 supports several starting states, but the presence of NSX is the main dividing line. A vSphere-only environment can take an incremental route. Once NSX is part of the source environment, the VCF Installer conversion workflow becomes mandatory.

The critical point is that VCF 9.1 is not a single upgrade path. It is a decision tree based on the source architecture.

Path 1: Modernize vSphere first without deploying the full VCF stack

A vSphere 8.x environment can move to vCenter Server 9.1, ESX 9.1 and VCF Operations 9.1 before the organization is ready for a complete VCF deployment. This is the shortest route to newer vSphere capabilities such as VMware vSphere Kubernetes Service, NVMe memory tiering and the current vSAN platform.

Where Aria Operations 8.18.x is already present, upgrade it in place to VCF Operations 9.1. Where it is absent, install VCF Operations first. The license server is then deployed through the VCF Operations workflow, followed by the vCenter and host upgrades. Broadcom explicitly supports this route for customers that want vSphere 9.1 but are not yet ready to deploy the complete VCF 9.1 stack.

This approach is strategically useful because it separates immediate infrastructure modernization from a larger private-cloud transformation. It also prevents architecture workshops from becoming an excuse to postpone necessary platform updates.

Path 2: Converge an existing vSphere environment into VCF 9.1

A vSphere 8 environment can become the management-domain foundation for a VCF 9.1 instance. Depending on the source, the convergence workflow can include an existing vCenter Server, ESXi hosts, vSAN, Aria Operations, Aria Suite Lifecycle and Aria Automation components.

For a vSphere-only source, the broad sequence is:

1.Install or upgrade to VCF Operations 9.1.

2.Upgrade vCenter Server and the hosts to the required 9.1 versions.

3.Deploy VCF Installer and download the required binaries.

4.Run the conversion workflow to establish the VCF 9.1 environment.

5.Apply the VCF Operations entitlement through the centralized license service.

The target architecture adds the VCF management layer around the reused infrastructure. That target can include VCF Automation, VCF Operations, SDDC Manager, vCenter, ESX and NSX at version 9.1.

This is not a cosmetic registration exercise. The conversion introduces management services, lifecycle control, identity integration, licensing and potentially new NSX and automation components. Treat it as an architecture change with an upgrade component, not as a simple product update.

Path 3: Converge vSphere plus NSX through VCF Installer

An environment containing vSphere 8.x and NSX 4.x must use the VCF Installer convergence workflow. Broadcom's guidance is unambiguous: when NSX is present, there is no supported path based on upgrading the components independently.

The high-level order shown for this route is:

1.Deploy VCF Installer.

2.Download the required VCF binaries.

3.Convert/import the existing vSphere and NSX environment into VCF 9.1.

4.License VCF Operations.

5.Upgrade NSX.

6.Upgrade vSphere.

VCF 9.1 broadens what can be carried through this process. Existing NSX Federation deployments remain supported, while 9.1 adds conversion/import support for environments with NSX bare-metal Edge nodes. The release also adds transition support for vCenter High Availability and Day-0 deployment of the VMware Identity Broker.

These additions remove several design conditions that previously forced customers into manual remediation or delayed adoption. They do not remove the need for compatibility validation. Firmware, server hardware, network interface cards, storage controllers and third-party integrations still need to match the target vSphere and VCF support matrices.

Path 4: Upgrade VCF 5.2.x or 9.0.x through lifecycle management

Existing VCF 5.2.x and 9.0.x deployments use the lifecycle path rather than VCF Installer conversion. Both source versions can move to the VCF 9.1 target architecture. The first major step is VCF Operations.

If Aria Operations is already deployed, upgrade it to VCF Operations 9.1. If it is absent, install VCF Operations 9.1 first. The remaining management-domain sequence is then:

1.Upgrade SDDC Manager.

2.Download the VCF 9.1 binaries.

3.Deploy VCF Management Services.

4.Upgrade NSX in the management cluster.

5.Upgrade vSphere in the management cluster.

6.Upgrade the workload domains.

7.Deploy or enable the required Automation, Logs and Networks services.

Workload domains can follow later as a Day-N operation, but the management-domain order is controlled. Do not improvise by upgrading whatever component has the most convenient maintenance window.

VCF 9.0 customers also need to account for architectural consolidation. The standalone Fleet Management Appliance is removed in 9.1. Its lifecycle functions move into VCF Management Services as Fleet Lifecycle and SDDC Lifecycle services. The external VMware Identity Broker architecture from 9.0 is also consolidated into VCF Management Services.

Licensing changes at the same time. VCF 9.1 moves from individual product license keys to a keyless subscription entitlement backed by a centralized VCF License Server. The license server is mandatory and needs forward and reverse DNS records.

Lifecycle management is substantially more granular

The new pathways are only part of the story. VCF 9.1 also reduces the operational cost of staying current after the transition.

Component-version visibility is centralized in VCF Operations. Administrators can compare current and target versions for SDDC Manager, NSX, vCenter Server and ESX hosts from one lifecycle view. Additional domain components, including VMware HCX, can also be handled through this model.

Host selection is more precise. Instead of treating every cluster upgrade as an indivisible operation, administrators can select specific hosts. This helps when a host fails a pre-check, when capacity limits require staged maintenance or when a problematic server would otherwise block the complete cluster.

NSX Edge sequencing is decoupled. VCF 9.1 provides more control over whether host or Edge upgrades run first. That flexibility makes it easier to align the network data plane with application and capacity constraints. NSX Manager upgrades are also designed to reduce management-plane interruption to a sub-second interval according to the VCF 9.1 training material.

vCenter maintenance becomes less disruptive. Reduced Downtime Upgrade deploys a new appliance, synchronizes data while the existing vCenter remains active and limits the outage to the final switchover. During that upgrade, VCF 9.1 can select the deployment size, adjust storage sizing and allow a manual switchover. Quick Patch provides a faster path for compatible fixes and can minimize or avoid service interruption. It is not universal: administrators must confirm in the release notes whether a specific patch supports the quick-patch mechanism.

The result is not “zero maintenance.” The result is smaller failure domains, shorter control-plane interruptions and more freedom to stage work around actual capacity.

Management Services change the infrastructure prerequisites

The move to VCF 9.1 introduces a common runtime for lifecycle and operational services. This is mandatory for VCF and optional for vSphere Foundation. The minimum management-services pool contains 12 IP addresses. Broadcom recommends allowing expansion to 30 addresses for high availability and future scale-out. The ranges must be on the management network and do not have to be contiguous.

The internal VCF Services Runtime network uses 198.18.0.0/15 by default. If that range overlaps with an existing management network, the deployment specification must use one of the supported alternatives before installation.

The overall IP and DNS plan must also include Fleet Services, Instance Services, the License Server, the Identity Broker, SDDC Manager and the VCF Operations Cloud Proxy. A full VCF Automation deployment requires additional addresses. This is exactly the kind of detail that turns into a failed deployment when it is left until the implementation window.

VCF 9.1 can deploy VCF Operations and VCF Automation on a custom distributed virtual port group or NSX segment. Their deployment can also be deferred during the initial planning phase and completed later. This supports a phased design, but “deferred” must not be confused with “unnecessary.”

Dual-stack support still contains IPv4 islands

VCF 9.1 supports dual-stack deployment for selected traffic types, but it does not support an IPv6-only software stack. All dual-stack component names must resolve to both IPv4 and IPv6. External services such as DNS and NTP must support IPv4 or dual-stack operation.

Several components remain IPv4-only, including VCF Automation, the License Server and the NSX overlay. There is also no automatic fallback when the preferred IPv6 path fails, so manual intervention may be required. In other words, dual stack is a deployment option; it is not the elimination of IPv4.

Constraints that can invalidate an otherwise sound plan

Enhanced Linked Mode requires special attention. In a vSphere-only environment, every vCenter in the Enhanced Linked Mode ring must first move to 9.1 before the ring can be broken using the newer non-disruptive method. In a vSphere-plus-NSX environment, the vCenter must be separated from the ring while it is still on vSphere 8.x, before the VCF conversion.

VxRail support is equally specific. An existing VCF 5.2-on-VxRail deployment can upgrade to VCF 9.1 with Dell assistance. That support statement does not authorize conversion of a standalone vSphere-on-VxRail environment into VCF.

VCF 9.1 can also create a workload domain management plane without immediately adding a vSphere cluster. This is useful for staged deployments, but it comes with a hard lifecycle restriction: the domain cannot be patched or upgraded while it has no cluster. Any other domain sharing that NSX Manager is blocked from patching and upgrading as well. This design should therefore be temporary and deliberate.

A practical pre-upgrade checklist

Before opening a change window, validate the following:

• Classify the operation correctly as a deployment, convergence or upgrade.
• Inventory vCenter Server, ESXi or ESX hosts, vSAN, NSX, Aria Operations, Aria Automation, Aria Suite Lifecycle, Identity Manager, Log Insight and Operations for Networks.
• Confirm the exact source builds, not only the marketing version.
• Validate hardware, firmware, drivers, third-party integrations and target interoperability.
• Use the VCF Upgrade Planning Tool to generate a path for the actual starting state.
• Reserve all management IP addresses and create forward and reverse DNS records before deployment.
• Check for overlap with the VCF Services Runtime network.
• Resolve the Enhanced Linked Mode design before starting a vSphere-plus-NSX conversion.
• Decide whether VCF Operations and VCF Automation will be deployed immediately or deferred.
• Run pre-checks early enough to remediate failed hosts without blocking the maintenance window.
• Read the release notes for the exact target maintenance release and apply every stated dependency.

Conclusion

VCF 9.1 makes platform adoption more practical because it supports incremental modernization as well as full-stack convergence. A vSphere-only customer can move to the 9.1 compute and operations layer first. A vSphere-plus-NSX customer can reuse the existing environment through VCF Installer. Existing VCF 5.2.x and 9.0.x deployments can move forward through lifecycle management.

The flexibility is real, but so are the constraints. NSX changes the available path. Enhanced Linked Mode changes the preparation. VCF Management Services change the IP plan. The centralized license service changes entitlement handling. The component sequence remains mandatory.

The right strategy is therefore not to ask, “How do we upgrade everything?” Start with a more precise question: “What is our exact starting state, and which supported VCF 9.1 workflow matches it?” Once that answer is correct, the rest becomes an engineering exercise instead of a recovery exercise.

References

[1] Upgrade Sequence and Related Issues for VMware Cloud Foundation and vSphere Foundation 9.1

[2] VMware Cloud Foundation 9.1.1.0 Release Notes

[3] Paths to Building 9.1.x Environments

[4] Modernizing the Private Cloud: Why VCF 9.1 Lifecycle Management Is a Game Changer

[5] VCF Upgrade Planning Tool

Last week I successfully passed the VCAP Operations and VCAP VKS exams. With that, my full set of VCF 9 discipline-aligned VCAP certifications is - for now - complete. All five core disciplines are covered: Operations, Automation, Networking, Storage, and VKS. This feels like the right moment to reflect on what this journey means, and to look ahead at where it leads.

The five disciplines

The 2025 VCAP expansion was the largest in VMware's history: eleven new exams across both role-based and domain-specific tracks. For VCF 9, the five discipline certifications each validate deep, hands-on expertise in a specific technical domain within the platform.

• Storage 
• Networking 
• Automation 
• Operations 
• VKS 

The VKS certification deserves a special mention. Within the new VCF certification framework, the Kubernetes-focused VCAP is a mandatory component on the path to VCDX. This reflects the growing role of modern application platforms - The Kubernetes Supervisor - as an integral part of VMware Cloud Foundation, not an optional add-on.

A fundamentally changed certification landscape

Broadcom has completely overhauled the VMware certification program. Where it once revolved around product-specific knowledge, the new framework is explicitly role- and platform-oriented. Instead of validating isolated component expertise, it now asks professionals to demonstrate understanding of VMware Cloud Foundation as an integrated platform - compute, storage, networking, automation, and observability working as one cohesive system.

This shift is most visible at the VCAP level. The discipline-based VCAPs validate deep technical expertise per domain. The role-based VCAPs - Administrator, Architect, and Support - validate how that knowledge is applied in practice, depending on your day-to-day responsibilities. Together, they form the foundation for the highest level in the program: the VMware Certified Distinguished Expert, or VCDX.

The path from VCAP to VCDX

The formal path to VCDX starts with a role-based VCP as the foundation. From there, candidates complete a set of advanced VCAP certifications - including at least one role-based VCAP and the VKS track. The final step is a live defense, a practical session where architectural insight, problem-solving capability, and real operational experience take center stage. This is not about ticking boxes. It is about proving that you can operate at the highest technical level in real-world VCF environments.

Next milestone: the role-based VCAPs

With all five discipline tracks completed, the focus now shifts to the three role-based VCAPs: Administrator (3V0-11.26), Architect (3V0-12.26), and Support (3V0-13.26). Broadcom has recently announced these as coming very soon - each following the same format of 60 questions over 135 minutes, with a passing score of 300 on a scaled system.

What makes these exams interesting is that they evaluate the same technical foundations from entirely different angles. The Administrator exam focuses on operational execution - lifecycle management, automation workflows, day-2 operations. The Architect exam focuses on design decisions - workload domain strategies, resilience patterns, capacity planning. The Support exam focuses on diagnostic methodology - root cause analysis, log interpretation, structured troubleshooting across the full VCF stack.

For anyone working hands-on with VCF environments, these three tracks represent a logical and valuable next step. They validate not just what you know, but how you apply it.

Why this matters

VCF adoption is accelerating - in sovereign cloud initiatives, in regulated industries, and in large enterprise environments looking for the combination of public cloud automation with full infrastructure control. Organizations need verifiable, role-specific expertise. The new VCAP structure delivers exactly that assurance.

For me personally, this is about more than credentials. Each exam builds the technical foundation needed to contribute meaningfully to the community, to deliver sharp troubleshooting sessions at events like VMUG Connect Amsterdam and Minneapolis, and ultimately to approach the VCDX defense with genuine depth across every relevant domain of the platform.

Next step: VCAP Administrator · Architect · Support → VCDX. Can't wait.

Day 1 – Monday: The Journey Begins

The week started early on Monday with a full morning of work before our departure. We kicked things off with a Scrum/Agile training session — a surprisingly energetic start to what would become an intense but unforgettable week.

After lunch, around 13:00, we left Odijk and began our drive toward Frankfurt. I travelled together with Erwin and Floris, with whom I manage the Atos Private Cloud for the Dutch National Police. The first part of the drive went smoothly, but at some point we hit a major traffic jam caused by a serious accident. Luckily, the police were redirecting cars off the motorway, allowing us to take an alternate secondary route. The people in front of us, who weren’t diverted in time, were stuck there for hours — so we were fortunate.

Eventually, we arrived in Frankfurt and checked into our hotel. Instead of staying at the Sheraton, we chose a Best Western nearby — about a 20-minute walk from the venue. It was significantly cheaper, and to be honest, the Sheraton looked a bit dated. Our hotel turned out to be perfectly fine and comfortable. After a good dinner and some rest, we were ready for the real start of VMware Explore the next morning.

Tuesday marked the official start of VMware Explore Frankfurt, and we decided to walk from our hotel to the Sheraton — a pleasant 20-minute stroll to wake up and build excitement for the day.

One of the most memorable moments happened right at the start of the keynote.

Earlier this summer, I recorded a short video for VMware, and it had already premiered during VMware Explore Las Vegas — but this was the first time I saw it live on the big screen at an event I was physically attending.

It was still a great feeling to see myself featured in the keynote, and several people recognized me immediately. It even led to a fun moment where I shook hands with Joe Baguley, who mentioned he had seen me appear in multiple Explore videos over the past months.

The keynote also highlighted several new developments, but the announcement that grabbed the most attention was the expanded partnership with Cisco. It was positioned as one of the major strategic directions moving forward — definitely something to keep an eye on.

While boarding the bus for the evening program, I ran into Brad Tompkins, Executive Director of VMUG. I told him about the first-ever VMUG meeting, which took place in Gouda in the Netherlands at the small training company XTG — organised by Bouke Groeneschij. We had around 45 attendees, and Erwin was there with me as well. Brad loved the story and shared something exciting in return:

The Global VMUG Connect 2026 event will take place in Amsterdam, at the RAI, from March 17–19 — a full three-day international VMUG summit in our home country.

Evening Event at Eintracht Frankfurt Stadium

The bus ride to the stadium started with, unsurprisingly, another traffic jam — but eventually we arrived at the Eintracht Frankfurt Arena, where we were welcomed in one of the Skyboxes with drinks and appetisers. We received a full behind-the-scenes stadium tour:
 

• the players’ dressing rooms

• the mixed zone

• pitch-side views

• even the dugout where the trainers sit during matches

After the tour, we returned to the Skybox for a great dinner and a glass of wine.

During the evening, I ran into Duncan Epping, had a nice chat with Jan-Willem Lammers, met former students from Deltares in Delft, and spoke with several participants from my recent VCF 9 training — many of whom proudly told me they had all passed their exam.

I also bumped into Daniel Krieger, who also had appeared in the keynote video earlier that day. Daniel is a well-known figure in the VMware community — a Cloud Architect at evoila, Broadcom Knight for NSX/vSphere, long-time vExpert, homelabber, and someone with a seriously impressive technical résumé.

We had a great conversation. He told me he actually had to look twice when he recognised me, and later wrote a kind LinkedIn post about our meeting. It was fun talking to him in person after having seen him online so often, and a great example of the spontaneous connections that make Explore so special.

Back to the hotel

With great food, good conversations, and countless familiar faces, the second day of VMware Explore ended on a high note — full of energy, community, and excitement for what Wednesday would bring.

As the evening eventually came to an end, we boarded the bus back to the Sheraton Hotel. Inside the lobby we ran into several Broadcom colleagues, we shared stories from the past and laughed about old memories. It was one of those spontaneous late-evening moments that perfectly captures the spirit of Explore — reconnecting, reminiscing, and enjoying the community beyond the sessions and keynotes.

After saying goodbye, we made the short walk back to our own hotel, while Frankfurt was still buzzing with conference energy all around us. Not long after that, we finally called it a night — ready to recharge and gather enough energy for an exciting Wednesday.

Wednesday was filled with deep-dive technical content, and we moved from session to session, each offering a different angle on the evolution of VMware Cloud Foundation. We started with “New to VMware Cloud Foundation Networking with VMware NSX?”, a clear and accessible walkthrough of how NSX decouples networking from physical infrastructure. It demonstrated how the software-defined approach simplifies operations, increases flexibility and enables the level of automation that modern datacenters demand. It was a strong reminder of why NSX continues to be such a fundamental pillar of VCF.

From there, we joined “Choosing Your Path to VMware Cloud Foundation: A Technical Guide for Migration,” which focused on the various proven, non-disruptive ways organisations can transition from traditional vSphere environments to full VCF deployments. The speakers highlighted practical migration paths, how to minimise downtime, and how to use the right tools to accelerate time-to-value — very relevant for real-world projects.

Next, we attended “What Is New in VMware vSphere 9,” a forward-looking exploration of the latest updates to the compute engine behind VCF. The session covered new technologies, lifecycle improvements, automation enhancements and architectural changes practitioners should be aware of. It provided a clear picture of how vSphere is continuing to evolve.

One of the highlights of the afternoon was Duncan Epping’s session, “Three Times the Performance, Half the Latency: vSAN Express Storage Architecture Deep Dive for VMware Geeks.” Duncan delivered his signature style of clear, detailed and passionate explanation, breaking down how ESA now performs compression and global deduplication fully in-line and across the cluster — achieving significant space savings without adding performance overhead. It was both inspiring and technically rich.

We rounded off the afternoon with “A Deep Dive into Memory Tiering with NVMe,” a fascinating look at one of the most exciting new developments in both vSphere and VCF. The session explained how memory tiering combines DRAM with NVMe-based memory to create a more cost-efficient and scalable architecture. The presenters walked through how it works, configuration details, advanced tuning options and the TCO benefits this new approach introduces. It’s clear that memory architecture is evolving just as rapidly as compute, storage and networking.

By the end of this series of sessions, it was obvious how VMware is innovating across every layer of the VCF stack — and Wednesday’s deep dives perfectly captured that momentum.

After the final sessions on Wednesday, we drove back home — this time without hitting any traffic at all. The drive was smooth, relaxed, and a good moment to decompress after three intense days. At some point I grabbed a can of Monster for an extra energy boost, which, combined with all the excitement and adrenaline of the week, turned out to be a questionable decision: I barely slept that night.

Part of that restlessness came from knowing that I had a presentation the next day at the Atos headquarters in Amstelveen, where I would be teaching a mini-masterclass on network virtualisation. The focus was primarily on NSX, but I also had to cover networking concepts in AWS, Google Cloud, and Azure — and those three aren’t exactly my strongest specialisations. So when I woke up early on Thursday morning, I spent the first hours polishing slides, refining examples, and making sure the content flowed well.

The session started at 13:00 and the room filled up quickly — about 16 colleagues from different Atos business units, including several participants from India. Because of the international audience, the entire presentation had to be delivered in English, which added an extra layer of challenge after a long week.

Despite the lack of sleep and the tight preparation window, the session went extremely well. It ran for more than two hours, and the audience was highly engaged throughout. I received a lot of thoughtful questions — especially on cloud-native networking, segmentation models and cross-cloud routing — which made the session lively and interactive.

By the end of the afternoon, I drove home with a genuinely satisfied feeling. Everyone told me they found the session insightful and valuable, and it was a great way to close off an already unforgettable week.

Day 5 – Friday: Back to Business, Back to Reality

By Friday morning, it was time to switch back into “normal work mode” — or at least as normal as things ever get in a week filled with upgrades, designs, travel and presentations. After the excitement of VMware Explore and the Atos session the day before, Friday became a day of focus and hands-on engineering.

The main task of the morning was assisting with an NSX Manager cluster upgrade along with the upgrade of several Edge nodes. It was one of those changes that requires precision and close coordination, but everything went smoothly. Once that was under control, I spent part of the afternoon working on a low-level design for an FTP server that will be used as the backup target for NSX configuration files — something that will help strengthen operational resilience in the environments we manage.

It felt good to get my hands back into the technical details again after a week full of keynotes, community sessions and travel.

A Well-Deserved Evening Break

After wrapping up work, I switched gears completely. Friday evening, I went to Pathé De Kuip with my son to watch The Running Man. It was the perfect way to decompress: big screen, good popcorn, and some father-son time after a packed week.

And because sitting all day is never ideal — especially after a long road trip and multiple conference days — I also squeezed in a quick workout at Basic-Fit, just to keep the body moving and reset for the weekend.

By the time I got home, the week had officially come to an end — a week full of learning, community, reconnecting, catching up with old friends, travel, teaching, upgrades, movies, and just enough chaos to make it all truly memorable.

VMware has introduced a new industry-recognized certification: the VMware Certified Professional – Private Cloud Security Administrator (VCP-VCF Admin). This certification is designed for IT professionals responsible for securing VMware Cloud Foundation (VCF) environments using VMware vDefend.

What does the certification cover?

The VCP – Private Cloud Security Administrator validates your ability to secure a private cloud environment using:

• distributed and gateway firewalls

• advanced threat prevention

• security intelligence

• zero-trust architecture with VMware vDefend

How to earn the certification

The certification path includes two steps:

Step 1: Gain experience and complete training

• Take the VMware vDefend Security for VCF 5.x Administrator training course

• Gain hands-on experience with VMware vDefend in real-world scenarios

Step 2: Pass the certification exam

• Exam title: VMware vDefend Security for VCF 5.x Administrator (6V0-21.25)

• Duration: 90 minutes

• Number of questions: 75

• Passing score: 70%

• Format: multiple-choice and multiple-select

• Language: English

• Price: $250 USD

• Exam registration: available through the VMware certification portal

My experience

I took the exam last Friday and successfully passed it. It was a tough exam, featuring a number of nuanced and tricky questions that tested both theoretical knowledge and practical insight. Proper preparation is key — if you're planning to take the exam, I strongly recommend reviewing the NSX 4.x training again, even though “vDefend” is now the updated branding for NSX security features within VCF.

Also worth noting: the description on the Credly badge for this certification currently suggests that attending the training course alone is sufficient to earn the badge. This is incorrect — passing the certification exam is required. Furthermore, the training is only available to VMware partners and paying customers, making self-study and hands-on lab experience even more critical.

What’s new: Detailed Score Report

Another recent and useful addition is the provisional examination score report, which breaks down your performance per domain, based on the sections listed in the official exam guide. This provides valuable insight into your strengths and areas for improvement.

For example, my section scores included:

• VMware vDefend Firewall Architecture: 75%

• Lateral Protection with vDefend: 100%

• Security Automation: 50%

• IDPS & Threat Prevention: 83%

• Network Detection and Response (NTA/NDR): 78%

This detailed feedback makes the exam not just a validation but also a learning opportunity — helping professionals identify which NSX security components may need further study or practice. The Exam Guide contains the full list.

It’s also highly recommended to study the sample questions provided in the official exam guide very carefully — some of them (or very similar variants) may appear on the actual exam. Reviewing these questions can give you a clear idea of how VMware frames its scenarios and where the focus areas lie.

Recently, I took the Exam 2V0-13.24: VMware Cloud Foundation 5.2 Architect exam, and I can confidently say—it’s a beast. The exam consists of 60 questions, and if you’re lucky, you’ll have about half an hour left to review your answers. During my review, I changed so many responses that I eventually just clicked "Finish" because I was afraid I might second-guess my initial, more accurate answers.

My Preparation: What Worked for Me

For preparation, I relied on the vSphere and NSX design training courses. Additionally, the VCF Design Guide was a valuable resource. However, you definitely shouldn't overlook topics like Aria Automation and Aria Operations. It also doesn’t hurt to explore HCX, and vSphere IaaS Control Plane is another subject that shouldn’t be ignored.

I went into the exam with relatively little preparation, mainly to see what kinds of questions would be asked. Honestly, I didn’t expect to pass but wanted to gain insight into how I could better prepare. To my surprise, I passed!

What Helped Me Succeed?

I must admit, the exam really pushed me to my limits. Fortunately, with over 15 years of experience delivering design training, I had a bit of an advantage when it came to concepts like risks, assumptions, and constraints. It’s also crucial to quickly identify whether a question is related to performance, availability, or recoverability. Understanding terms like RTO (Recovery Time Objective) and MTD (Maximum Tolerable Downtime) is equally important.

On top of that, you need to know the deployment types possible with VCF—whether it’s Stretched, Isolated, or a combination of both. These details can really make a difference during the exam.

A Fair but Tough Exam

One thing I appreciate about this exam is that it’s fair. There are no tricky word games or double negatives—it's all about your knowledge and understanding. But is it challenging? Absolutely.

If you’re planning to take the VCF Architect exam, I highly recommend focusing not only on the technical aspects but also on design principles and best practices. Good luck!

VMware Cloud Foundation 5.2 Architect Exam (2V0-13.24)

Schedule exam

View exam guide

Exam Prep