2V0-33.22 VMware Cloud Professional Questions and Answers

The three types of gateways that can be found in VMware Cloud on AWS are Option A: Distributed Tier-1, Option B: Standard Tier-1, and Option D: Compute Tier-1.

Distributed Tier-1 gateways are used for secure access between on-premises networks and the VMware Cloud on AWS SDDC network. Standard Tier-1 gateways are used for secure access between the VMware Cloud on AWS SDDC network and the public internet. Compute Tier-1 gateways are used for secure access between the workloads running on the VMware Cloud on AWS SDDC and the public internet.

For more information, please refer to the official VMware documentation on VMware Cloud on AWS Gateways: https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.networking/GUID-1F2D1BFC-F5C7-4534-8B49-39F9D08E7F1A.html

VMware High Availability (HA) is a feature of the VMware Cloud platform that monitors the health of virtual machines and restarts virtual machines on other hosts if they crash or become unresponsive. This ensures that the virtual machines are always available and that no downtime is experienced. The default response is to restart the impacted virtual machine on other hosts in the same SDDC Cluster, however, this can be customized to suit the needs of the customer.

References: [1]https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.availability_and_scalability.doc/GUID-C7E2C2A2-B9A8-4CD0-A2F2-EA6C08C8D95B.html [2] https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.admin.doc/GUID-F9C7F1B8-4855-4C3A-A723-C9A2F7CDBFFB.html

To deploy an instance of Azure VMware Solutions, an administrator must take the following two steps:

• Create a support request with Microsoft Azure Support to create a host quota. This is required because Azure VMware Solution hosts are dedicated bare-metal servers that are not shared with other customers1. The host quota determines the number and size of hosts that can be provisioned in a subscription1. The host quota can be requested for an eligible Azure plan, such as Microsoft Enterprise Agreement or Cloud Solution Provider2.
• Deploy and configure Microsoft Azure ExpressRoute. This is required because Azure VMware Solution uses ExpressRoute to connect the private cloud to the Azure virtual network and the on-premises network3. ExpressRoute provides a secure, high-bandwidth, and low-latency connection that enables seamless workload migration and hybrid cloud scenarios3. The administrator must deploy and configure an ExpressRoute circuit, a virtual network gateway, and a virtual network3. References: 1: Deploy and configure Azure VMware Solution, 2: Plan the Azure VMware Solution deployment, 3: Tutorial: Deploy an Azure VMware Solution private cloud

https://blogs.vmware.com/virtualblocks/2021/09/28/operational-air-gaps/

Operational isolation (operational “air-gapping”) is critical to DR. VMware Cloud DR was designed from the very beginning for its systems and repository to be operationally isolated and for instantiating isolated recovery environments.

https://blogs.vmware.com/management/2020/01/the-cloud-operating-model.html

Aligning and connecting people, process, and technologies across layers of the IT and business organizations is an important success factor for cloud deployments. https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/docs/vmw-idc-enabling-a-cloud-operating-model-for-software-defined-infrastructure.pdf

CloudHealth by VMware is a cloud cost governance platform that provides budget management, cost reporting, and cost forecasting from a single platform. It provides comprehensive visibility and control to manage cloud costs in hybrid and multi-cloud environments. CloudHealth by VMware also provides cost optimization, resource optimization, and real-time alerting capabilities to help organizations make cost-effective decisions to reduce cloud costs.

VMware Tanzu Kubernetes Grid is described as a comprehensive solution for operating Kubernetes-based applications in production, as well as creating, scaling and managing clusters. It provides a centralized control plane for managing the lifecycle operations of Tanzu Kubernetes clusters. (Source: https://tanzu.vmware.com/kubernetes )

Management Gateway (MGW) The MGW is a Tier 1 router that handles routing and firewalling for vCenter Server and other management appliances running in the SDDC. Management gateway firewall rules run on the MGW and control access to management VMs. In a new SDDC, the Internet connection is labelled Not Connected in the Overview tab and remains blocked until you create a Management Gateway Firewall rule allowing access from a trusted source.

https://kb.vmware.com/s/article/80949

Tanzu Kubernetes Grid (TKG) provides a command line tool called tkg-support-bundler which can be used to collect the necessary information and logs for troubleshooting and support cases. The command can be run on the TKG CLI and it will gather all the necessary information and logs from the TKG control plane and worker nodes, and package them into a single compressed bundle file. This bundle file can then be provided to VMware support for further analysis.

VMware Tanzu Mission Control provides a central platform to manage and view all Tanzu Kubernetes clusters and workloads running in the environment. It allows administrators to set policies across multiple clusters, set up cluster identities, monitor cluster health and performance, and much more. Tanzu Mission Control also provides access to a variety of cloud-native tools, such as Kubernetes Dashboard, Helm, and Kubeapps.

Publishing Applications with VMware Horizon 7

https://vcdx.vmware.com/content/dam/digitalmarketing/vmware/ru/pdf/techpaper/vmware-horizon-7-application-publishing.pdf

VMware Technical Support Guide

https://www.vmware.com/pdf/techsupportguide.pdf

Quick-Start Tutorial for VMware Dynamic Environment Manager ...

https://techzone.vmware.com/resource/quick-start-tutorial-vmware-dynamic-environment-manager

"VMware Tanzu® Mission ControlTM is a centralized management platform for consistently operating, managing, and securing Kubernetes infrastructure and modern applications across teams and clouds. It provides a global view of all of the Kubernetes clusters. You can use the resource hierarchy to manage and enforce consistent policies across Kubernetes clusters. "

This role is designed to give administrators access to manage virtual machines, networks, and other settings within the folder. The CloudAdmin role will also give the junior administrators access to all global permissions that are associated with the Development folder.

"The CloudAdmin role is designed to give administrators access to manage a single folder. This role grants access to manage virtual machines, networks, and other settings within the folder. Additionally, this role grants access to all global permissions that are associated with the folder. For example, if the folder has global permissions that allow users to create or delete virtual machines, the CloudAdmin role will grant access to those permissions within the folder."

The CloudAdmin user can grant other users or groups read-only access to VMware Cloud on AWS vCenter management objects such as the Mgmt-ResourcePool, Management VMs folder, Discovered Virtual Machines folder, vmc-hostswitch, and vsanDatastore. Because this read-only access does not propagate to management objects, you cannot grant it as a Global Permission and instead must explicitly grant it for each management object. VMware Cloud on AWS runs a script once a day that updates any newly-created management objects (such as objects in a new cluster) so that the CloudAdmin user and CloudAdminGroup SSO group have the updated role applied. The script itself does not grant additional access to any user or group, so you'll need to wait until it completes before the CloudAdmin can use this workflow to grant read-only access to those objects.

This would enable the user to have the necessary permissions to deploy virtual machines - and thus, would ensure that all of the necessary virtual machines are deployed in a timely and efficient manner.

• VMware Cloud on AWS Documentation: "Deployment of virtual machines"
• VMware Cloud on AWS Documentation: "Creating virtual machines with the VMware Cloud on AWS console"
• VMware Cloud on AWS Documentation: "Managing virtual machines with the VMware Cloud on AWS console"

Hybrid Linked Mode allows you to link your cloud vCenter Server instance with an on-premises vCenter Single Sign-On domain. https://docs.vmware.com/en/VMware-Cloud- on-AWS/services/com.vmware.vsphere.vmc-aws-manage-data-center-vms.doc/GUID-91C57891-4D61-4F4C-B580-74F3000B831D.html

Hybrid Linked Mode is the solution that meets the requirement of viewing and managing workloads across both an on-premises environment and a VMware Cloud on AWS SDDC. Hybrid Linked Mode allows customers to link their on-premises vCenter Server with their VMware Cloud on AWS vCenter Server and use a single interface to manage both environments1. Hybrid Linked Mode also enables customers to perform cold and live migrations of workloads between on-premises and cloud SDDCs2. Hybrid Linked Mode leverages the existing vCenter Single Sign-On domain and does not require any additional components or licenses1. References: 1: Hybrid Linked Mode - VMware Docs, 2: VMware Cloud on AWS Documentation

The CloudAdmin role has the privileges necessary to create and manage SDDC workloads and related objects such as storage policies, content libraries, vSphere tags, and resource pools

The CloudAdmin role has the following privileges in SDDC Version 1.18.

ContentLibrary.AddCertToTrustStore

ContentLibrary.AddLibraryItem

ContentLibrary.CheckInTemplate

ContentLibrary.CheckOutTemplate

ContentLibrary.CreateLocalLibrary

ContentLibrary.CreateSubscribedLibrary

ContentLibrary.DeleteCertFromTrustStore

ContentLibrary.DeleteLibraryItem

ContentLibrary.DeleteLocalLibrary

ContentLibrary.DeleteSubscribedLibrary

ContentLibrary.DownloadSession

ContentLibrary.EvictLibraryItem

ContentLibrary.EvictSubscribedLibrary

ContentLibrary.GetConfiguration

ContentLibrary.ImportStorage

ContentLibrary.ProbeSubscription

ContentLibrary.ReadStorage

ContentLibrary.SyncLibrary

ContentLibrary.SyncLibraryItem

ContentLibrary.TypeIntrospection

ContentLibrary.UpdateConfiguration

ContentLibrary.UpdateLibrary

ContentLibrary.UpdateLibraryItem

ContentLibrary.UpdateLocalLibrary

ContentLibrary.UpdateSession

ContentLibrary.UpdateSubscribedLibrary

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vsphere.vmc-aws-manage-data-center-vms.doc/GUID-DFB3C048-5728-4DE9-9380-7240748875C3.html

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws-networking-security/GUID-0E34C56D-C49C-49B6-A9CF-FBFAF14A126C.html

To allow HTTPS access to a specific VM through the public Internet for VMware Cloud on AWS, the administrator should take the following two steps:

• Request a public IP address in the VMware Cloud console. This is required because the VM needs a public IP address to be reachable from the Internet1. The administrator can request a public IP address from the Networking & Security tab in the VMware Cloud console1. The public IP address is allocated from the AWS pool and is associated with the SDDC1.
• Configure a DNAT rule translating a public IP address to an internal IP address. This is required because the VM has an internal IP address assigned by the SDDC DHCP server, and the DNAT rule maps the public IP address to the internal IP address of the VM2. The administrator can configure a DNAT rule from the Networking & Security tab in the VMware Cloud console2. The DNAT rule must specify the public IP address as the source, the internal IP address as the destination, and the HTTPS service (TCP 443) as the applied to2. References: 1: Request a Public IP Address - VMware Docs, 2: Configure NAT Rules - VMware Docs

"The VMware HCX on-premises deployment requires five IP addresses: two for the WAN appliance, two for the vMotion feature, and one for the management network." 

In this scenario, the cloud administrator is utilizing the vMotion feature of VMware HCX to migrate several dozen workloads from an on-premises location to a VMware public cloud. They are also stretching three networks for the migration. When using vMotion, two IP addresses will be needed per vMotioned virtual machine: one for the source and one for the target. For the migration of several dozen workloads, this will require several dozens of IP addresses. Additionally, the administrator is also utilizing the capabilities of the WAN appliance to optimize migration traffic. In order to optimize the traffic, one IP address will be needed for the WAN appliance on the on-premises site, and another IP address will be needed for the WAN appliance on the public cloud side. Therefore, the total number of IP addresses that need to be reserved for the on-premises deployment of VMware HCX is the number of IP addresses required for the virtual machines plus one IP address for the WAN appliance on the on-premises site plus another IP address for the WAN appliance on the public cloud side, which totals to five IP addresses.

Example B illustrates the benefit of cloud computing where an organization can manage its cloud resources by using different cloud providers that are separate and isolated from each other. This allows the organization to make use of features and services offered by different cloud providers in order to benefit from the best of different services.

Example C illustrates the benefit of cloud computing where a business can store infrequently accessed data in the cloud in order to benefit from reduced on-premises storage costs, as cloud storage is usually cheaper than on-premise storage.

Example E illustrates the benefit of cloud computing where a developer can code an application in a cloud-based environment, and, with a few simple commands, deploy the application on the business website. This eliminates the need for the developer to set up and manage the application on their own, as the cloud platform handles the deployment and hosting of the application.

Example F illustrates the benefit of cloud computing where a large amount of storage can be made available in seconds using a cloud option. This is useful for businesses that require a large amount of storage but don't have the resources to set up and manage their own storage solution.

For more information on the benefits of cloud computing, see the VMware official documentation at https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.getting-started/GUID-F0A2F338-A6A7-49AD-B158-CFFCA2F29C1B.html.

The two use cases that can be met with VMware Cloud on Dell EMC and VMware Cloud on AWS Outposts are Option C: Applications needing local data processing and/or low latency integrations, and Option D: Critical workloads that use restricted data.

VMware Cloud on Dell EMC and VMware Cloud on AWS Outposts both provide local data processing and low latency integrations, making them ideal for applications that require quick and efficient access to data. Additionally, the highly secure infrastructure of both solutions make them a great choice for critical workloads that use restricted data.

For more information, please refer to the official VMware documentation on VMware Cloud on Dell EMC: https://www.vmware.com/products/vmware-cloud-on-dellemc.html And the official VMware documentation on VMware Cloud on AWS Outposts: https://www.vmware.com/products/vmware-cloud-on-aws-outposts.html

Managing Costs:

With its capacity and cost management features, vRealize Operations Cloud can predict future demand and provide actionable recommendations to help in managing costs.

Reclamation of Existing Resources:

Assess workload status and resource contention in data centers across your environment:

• Determine the time remaining until CPU, memory, or storage resources run out.
• Realize cost savings when underutilized VMs are identified and reclaimed to be deployed more effectively.

Future Infrastructure Requirements

Run what-if scenarios:

• Identify how much capacity remains after you add or remove VMs or hosts.
• Add hyperconverged infrastructure (HCI) nodes.
• Get a recommendation based on the cost relative to workload placement on different hosts, clusters, data centers, and even different clouds.

Cloud Migration Planning:

Migration planning shows you the capacity and cost information after the migration to a cloud-based infrastructure.

Cost Overview

vRealize Operations Cloud supports costing for private clouds, public clouds, and VMware Cloud infrastructure.

You can track expenses for a single virtual machine, and identify how these expenses attribute to the overall cost associated with your private cloud accounts and VMware Cloud infrastructure accounts.

On the Cost Overview home page in vRealize Operations Cloud, you can find details about the costs associated with your VMware Cloud infrastructure accounts, public cloud accounts, and your private cloud accounts.

You can view the Total Cost of Ownership, Potential Savings, and Realized Savings for your VMware Cloud infrastructure cloud accounts and vSphere private cloud accounts, and Total Cost of Ownership for your private cloud accounts.

IPFIX (Internet Protocol Flow Information Export) is a standard for the format and export of network flow information for troubleshooting, auditing, or collecting analytics information. Port mirroring lets you replicate and redirect all of the traffic coming from a source. The mirrored traffic is sent encapsulated within a Generic Routing Encapsulation (GRE) tunnel to a collector so that all of the original packet information is preserved while traversing the network to a remote destination.

Use Traceflow to inspect the path of a packet. Traceflow traces the transport node-level path of a packet. The trace packet traverses the logical switch overlay, but is not visible to interfaces attached to the logical switch. In other words, no packet is actually delivered to the test packet’s intended recipients.

vRealize Log Insight is a log collection and analytics virtual appliance that enables administrators to collect, view, manage and analyze syslog data. Log Insight provides real-time monitoring of application logs, network traces, configuration files, messages and performance data.

When a VPN is established between the data center and the SDDC Instance, it allows the organization to create a private and secure connection between their on-premises infrastructure and their workloads running in the cloud. By advertising a 0.0.0.0/0 route, the organization is essentially routing all traffic to the VPN tunnel, which means that all traffic including traffic destined for the data center and internet traffic, will be sent through the VPN tunnel to the company's data center.

It is important to note that this configuration depends on the company's network architecture and security policies, and that there may be other alternatives that better fit the organization's needs.

The VMware technology that ensures availability of the VMs in your SDDC and uses multiple ESXi hosts to provide rapid recovery from outages and cost-effective high availability for applications is B. vSphere HA. vSphere HA is an agentless cluster-level availability solution that enables rapid recovery from outages and cost-effective high availability for applications. vSphere DRaaS, vSphere DPM, and vSphere eDRS are not suitable for this purpose.

https://cloud.google.com/vmware-engine/docs/concepts-vmware-components Node Considerations

You can specify the number of hosts to add or remove to or from their cluster.

Private cloud initial setup happens in ~30 minutes.

Additional hosts can be added in ~15 minutes.

A three-node cluster is the minimum for production.

You can have up to 32 hosts per cluster.

You can have up to 64 hosts per private cloud.

The statement that most accurately describes the service features of VMware Cloud on Dell EMC is C. An SDDC includes a minimum of one rack with three hosts. You can add hosts to the rack, up to the maximum supported by the rack. An SDDC consists of a rack with a minimum of three hosts, which can then be expanded up to the maximum supported by the rack. VMware Site Recovery is not included as part of the initial service offering.

VMware Cloud on Dell EMC provides a service that enables customers to run their VMware-based workloads on Dell EMC's hardware, in a jointly-engineered and fully-supported environment. The service allows customers to deploy a fully-configured VMware SDDC on Dell EMC VxRail or VxRack SDDC systems, with the option to add more hosts to the rack as needed.

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws-operations/GUID-1A175E91-2317-4261-A63E-B398D92ECE8D.html vMotion Requirements for SDDCs With NSX:Networking speed and latency: Migration with vMotion requires sustained minimum bandwidth of 250 Mbps between source and destination vMotion vMkernel interfaces, and a maximum latency of 100 ms round trip between source and destination.

On-premises vSphere version: Your on-premises vSphere installation must be vSphere 6.7U2 or higher. See VMware Knowledge Base article 56991 for more information.

On-premises DVS version:  6.0 or higher.

On-premises NSX version: any

Note: SDDCs configured with NSX do not support hot vMotion to or from on-premises VXLAN encapsulated networks (NSX for vSphere) or Geneve Datacenter Overlay networks (NSX).

IPsec VPN: Configure an IPsec VPN for the management gateway.

See Configure a VPN Connection Between Your SDDC and On-Premises Data Center in the VMware Cloud on AWS Networking and Security guide.

Direct Connect: Direct Connect over a private virtual interface between your on-premise data center and your VMware Cloud on AWS SDDC is required for migration with vMotion.

See Using AWS Direct Connect with VMware Cloud on AWS.

Hybrid Linked Mode: Hybrid Linked Mode is required to initiate migration from the vSphere Client. It is not required to initiate migration using the API or PowerCLI.

See "Hybrid Linked Mode" in Managing the VMware Cloud on AWS Data Center.

L2 VPN: Configure a Layer 2 VPN to extend virtual machine networks between your on-premises data center and cloud SDDC. Routed networks are not supported. See VMware Cloud on AWS Networking and Security. VMware Cloud on AWS firewall rules Ensure that you have created the necessary firewall rules as described in Required Firewall Rules for vMotion.

On-premises firewall rules: Ensure that you have created the necessary firewall rules as described in Required Firewall Rules for vMotion.

Virtual machine hardware and settings: Ensure that these requirements are met for virtual machine hardware.

• Virtual machine hardware version 9 or later is required for migration with vMotion from the on-premises data center to the cloud SDDC.
• EVC is not supported in the VMware Cloud on AWS SDDC.
• VMs that are created in the cloud SDDC or that have been power-cycled after migration to the cloud SDDC can't be migrated back to the on-premises data center with vMotion unless the on-premises EVC baseline is Broadwell. You can relocate these VMs after powering them off, as long as their virtual machine hardware version is compatible with the on-premises data center.
• Migration of VMs with DRS or HA VM overrides is not supported. For more information on VM overrides, see Customize an Individual Virtual Machine.

Important: Source switch configurations (including NIOC, spoofguard, distributed firewall, and Switch Security) and runtime state are not applied at the destination as part of migration in either direction. Before you initiate vMotion, apply the source switch configuration to the destination network.

In order for a virtual machine to be migrated using VMware vSphere vMotion, the versions of VMware vSphere need to match between the on-premises data center and the cloud SDDC, and a Layer 2 connection needs to be configured between them. Additionally, cluster-level Enhanced vMotion Compatibility (EVC) must be configured in both the on-premises data center and the cloud SDDC. IPsec VPN and AWS Direct Connect do not need to be configured for the migration to occur.

Hybrid Linked Mode can tolerate a time skew of up to ten minutes between the on-premises data center and the cloud SDDC. The maximum latency between your cloud SDDC and on-premises data center cannot exceed 100 msec roundtrip.

https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vsphere.vmc-aws-manage-data-center-vms.doc/GUID-BE75F0F1-2864-4926-97FE-37E635471C43.html

https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/index.html Tanzu Kubernetes Grid provides packaged services such as networking, authentication, ingress control, and logging that a production Kubernetes environment requires.

The two use cases that apply to NSX logical routing are A. You must provide external connectivity to VMs and containers, and B. Your organization must provide connectivity between VMs and containers that are connected to different segments. NSX logical routing allows you to provide external connectivity to VMs and containers, and to provide layer 3 connectivity between VMs and containers that are connected to different segments. It does not provide layer 2 connectivity between VMs and microservices or intrinsic security for VMs connected to different segments.

https://blogs.vmware.com/cloud/2019/07/02/dhcp-dhcp-relay-vmware-cloud-aws/

To create a new network segment in the software-defined data center that utilizes the corporate DHCP server to provide IP addresses, the proper sequence is to create a DHCP relay profile, create a new segment attached to the Tier-1 gateway, and configure the segment DHCP config to utilize the new DHCP relay profile1. This is because the DHCP relay profile contains the IP address of the external DHCP server and the DHCP relay agent that forwards the DHCP requests and responses between the segment and the DHCP server1. The segment must be attached to the Tier-1 gateway, which is the edge device that provides routing and firewall services for the segment2. The segment DHCP config allows the administrator to specify the DHCP type, the DHCP relay profile, and the DHCP options for the segment3. References: 1: Configure Segment DHCP Properties - VMware Docs, 2: Create or Modify a Network Segment - VMware Docs, 3: Segment DHCP Config - VMware Docs

https://www.vmware.com/cloud-solutions/multi-cloud.html

Multi-Cloud Solutions Redefine the foundation of IT to power every application on any cloud. With Multi-Cloud solutions from VMware, you can migrate to the cloud without recoding your apps, modernize your infrastructure, and operate consistently across the data center, the edge, and any cloud.

Customer responsibility “Security in the Cloud” – Customers are responsible for the deployment and ongoing configuration of their SDDC, virtual machines, and data that reside therein. In addition to determining the network firewall and VPN configuration, customers are responsible for managing virtual machines (including in guest security and encryption) and using VMware Cloud on AWS User Roles and Permissions along with vCenter Roles and Permissions to apply the appropriate controls for users.

The responsibility for the encryption of virtual machines in VMware Cloud lies with the customer. The customer is responsible for configuring and managing any encryption or security related settings and configurations in the virtual machines, such as disk encryption or the configuration of security protocols. The VMware Cloud Provider Partner (VCPP) is responsible for the overall security of the cloud environment [1][2], including the encryption of data at rest, but the customer is responsible for configuring and managing the encryption settings within their virtual machines. Reference: https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.encryption/GUID-6F6921CA-44D6-4D9D-B0C0-12C18A545B7C.html

https://cloud.google.com/architecture/private-cloud-networking-for-vmware-engine

Dedicated Interconnect provides a private [1][2], dedicated connection between your on-premises network and Google’s network. It offers low latency, high bandwidth, and a secure connection. Partner Interconnect provides a connection to Google Cloud Platform through a partner’s network, such as a service provider or a carrier. It offers the same low latency, high bandwidth, and secure connection, but is slightly slower than Dedicated Interconnect.

References: [1] https://cloud.google.com/interconnect/docs/concepts/types [2] https://docs.vmware.com/en/VMware-Cloud-on-AWS/services/com.vmware.vmc-aws.networking.doc/GUID-6D3A8E3B-A7B1-4A05-A9A8-C4F4A4A4C1A2.html

A valid management network CIDR based on the requirements is 10.1.0.0/20, as this provides a range of 4096 IP addresses, which is more than enough for 30 hosts. A /23 CIDR only provides 512 IP addresses, which is not enough for 30 hosts, while a /24 CIDR provides 256 IP addresses and a /16 CIDR provides 65,536 IP addresses, which is more than is needed for the 30 hosts.

https://blogs.vmware.com/cloud/2019/10/03/selecting-ip-subnets-sddc/