An architect is designing a private cloud infrastructure for two departments (HR and Finance) based on
VMware Cloud Foundation (VCF) and has been given the following requirements: HR and Finance
superusers require access to VCF Operations.
VCF Operations access, monitoring, and logging information must not be shared across departments.
Which design decision would meet the requirement?
Answer
- A. Deploy two VCF Fleet instances within the private cloud, one for HR and one for Finance.
- B. Configure two tenant instances within VCF Operations, one for HR and one for Finance.
- C. Deploy two VCF Operations instances within a VCF Fleet, one for HR and one for Finance. Correct
- D. Configure two sets of scopes and index partitions within VCF Operations, one for HR and one for Finance.
Explanation
To enforce strict separation of monitoring data, logs, and access control, deploying two separate VCFOperations instances is the recommended solution. This ensures that each department (HR and
Finance) has a completely isolated monitoring stack, including dashboards, alerts, log retention, and
user roles.
Although scopes and index partitions can provide some level of logical segregation within a single
instance, they do not guarantee complete security isolation, especially in environments with strict
compliance or multi-tenancy concerns. Deploying two separate instances ensures compliance with data
isolation and privacy requirements, making it the most secure and compliant option.
Reference: VMware Aria Operations Deployment Guide for Multi-Tenancy and Isolation
VMware Cloud Foundation 9.0 Logical Design Guide – Operations Segmentation Models