B is correct. Deploying a dedicated NSX instance for each workload domain creates an independent networking and security management boundary for each domain. VCF supports workload domains either sharing an NSX Manager cluster or using their own NSX instance; Broadcom ' s VCF API documentation explicitly states that subsequent workload domains can share the existing NSX Manager cluster or create their own . ( Broadcom Developer )

A dedicated NSX instance best satisfies all three requirements. First, it provides stronger logical and administrative isolation , because NSX objects, policies, transport configuration, gateways, and tenant-specific networking remain associated with that workload domain ' s network stack. Second, separate NSX instances provide distinct lifecycle boundaries, reducing coupling when network components must be maintained or upgraded. Third, tenant-specific customization can be performed without introducing configuration dependencies or policy conflicts in another workload domain.

D reduces infrastructure footprint but creates a shared NSX management and lifecycle dependency between the workload domains. C is designed for consistent multi-site/global networking and policy synchronization, which works against the requirement for independent tenant network stacks. A removes the NSX capabilities needed for tenant-specific software-defined networking and security.

Broadcom ' s current VCF documentation confirms that isolated workload domains may be deployed with either dedicated or shared NSX, making the dedicated model the appropriate choice when stronger tenancy isolation is required . ( VMware )

Study Guide References/Topics: VCF Workload Domain Network Design; Dedicated vs. Shared NSX Instances; Workload Domain Isolation; NSX Lifecycle Boundaries; Tenant-Specific Network Configuration.

B is the technical requirement because it specifies a concrete, verifiable technical security condition that the deployed solution must satisfy: the environment must undergo third-party penetration testing at least annually . This can be directly incorporated into security architecture, operational validation, and design acceptance criteria.

The other statements belong to different conceptual-design categories. A is primarily a business requirement/objective because reducing administrator effort describes the organizational outcome that the VCF solution should enable, typically through automation and simplified lifecycle management.

D is a constraint because the existing procurement agreement restricts the architect ' s technology choices by mandating use of specific existing server hardware.

C establishes a regulatory/compliance context . DORA and SOX influence technical and operational requirements, but simply stating that the organization is subject to those regulations does not itself define a specific technical capability that the VCF architecture must implement.

Broadcom ' s VCF Architect exam guide explicitly requires candidates to differentiate business and technical requirements and separately identify requirements, assumptions, constraints, and risks when producing a VCF design. ( Broadcom Docs )

Study Guide References/Topics: Conceptual Design; Business vs. Technical Requirements; Requirements and Constraints; Security Requirements; Compliance; Design Validation and Acceptance Criteria.

C and E provide the centralized SSO architecture required while minimizing operational complexity. The VCF Identity Broker can provide identity services across a fleet containing multiple VCF instances , eliminating the need to deploy and manage an independent identity stack for every VCF instance. Broadcom describes the external Identity Broker model as providing identity services across a VCF Fleet, with centralized SSO covering VCF Operations, vCenter, NSX, and other platform components. ( VMware Blogs )

Deploying the Identity Broker with the first VCF instance at DC01 (C) establishes the centralized identity service. E then allows additional VCF instances within the same private cloud to consume that existing VIDB rather than introducing redundant identity infrastructure at every site.

This architecture also supports REQ02 . VCF Identity Broker federates authentication to supported enterprise identity providers, including SAML-based providers, Entra ID, Okta, and others. Multi-factor authentication can therefore be enforced by the corporate identity provider and applied across the VCF management stack. ( VMware Blogs )

A unnecessarily duplicates VIDB infrastructure and increases administration. B similarly creates additional identity components without a requirement for separate identity domains. D incorrectly references a VIDB hosted at DC02 when the centralized design establishes the first VIDB at DC01.

Study Guide References/Topics: VCF Single Sign-On; VCF Identity Broker; Fleet-Level Identity Management; Multi-Instance VCF Design; Identity Federation; MFA/Two-Factor Authentication; Centralized Management Services.