01. In a VM Apps organization, an administrator created a custom resource action that runs an Orchestrator workflow to rotate a machine's local credentials. No day 2 policies are defined. The administrator completed these steps:
Entered a name and display name
Selected the deployed resource type and the workflow
Set the property bindings
Clicked Create
Users cannot see the action on their deployments. Which step was missed?
a) Editing the request parameters to build a request form
b) Turning on Activate between naming the action and selecting its type
c) Adding a Requires condition to the action
d) Changing the property bindings to in request
02. A provider runs VCF Automation at two sites. At site A, a custom theme for the Retail organization was finished by exporting it, editing its CSS by hand and importing it again. Retail now also has an organization at site B and needs exactly the same look there, including the CSS changes.
Which approach meets the requirement?
a) Export the finished theme as a ZIP at site A, import it at site B and assign it to the Retail organization there
b) Make the theme the default at site A so that it also covers the Retail organization at site B
c) Build a new custom theme at site B with the same portal name, logo, colors and links
d) Assign the site A theme directly to the Retail organization at site B
03. Last week a provider administrator edited the list of operations treated as blocking tasks and deselected several organization-related operations to reduce the number of approvals. Today the administrator deactivates an All Apps organization that has no region quotas and starts the deletion, but the deletion never completes.
Which setting in the Provider Management portal is most likely at fault?
a) The default blocking task timeout, which has not expired yet
b) The edited blocking task operation selections
c) The region network configuration, which must be removed before the organization is deleted
d) The rights bundle published to the organization, which still holds active rights
04. Team A owns a blueprint with named versions 1 to 3 and keeps editing its current draft, which right now matches version 3. Team B, in the same project, wants its own blueprint that starts from that content and evolves through its own versions without touching Team A's draft or version history.
Which approach meets this requirement?
a) Create version 4 from the current draft and have Team B edit it
b) Restore version 3 into the current draft and let Team B edit that draft
c) Clone the blueprint so that Team B edits and versions a separate copy of its own
d) Publish version 3 to the catalog and have Team B edit that item
05. An organization administrator in an All Apps organization is creating a secret that holds an SSH public key. Blueprints in projects Payments and Ledger must bind it, and blueprints in other projects must not. Project Audit may need it next quarter. The administrator also wants to be certain that the long key value was entered correctly.
Which two actions best meet these requirements?
(Choose two.)
a) Scope one secret to Payments and Ledger, and assign Audit later if needed
b) Import the key into the organization's Trusted Certificates so both projects can read it
c) Reveal the typed value before saving it
d) Create two organization-wide secrets with the same name, one per project
e) Give Audit members the Project Auditor role in Payments when they need to bind the key
06. A project user in an All Apps organization requested a blueprint that deploys a VM, a persistent volume and a custom resource built on a VCF Operations orchestrator workflow. She now needs to locate the custom resource to check its status and run its day 2 actions.
Where in the organization portal does she find it?
a) The blueprint's design canvas in Content Hub
b) The Subscriptions page under Build and Deploy
c) The Instances page's Volumes tab
d) The Custom Resources tab of the Instances page
07. Yesterday an organization administrator created an Approval policy scoped to project Orion. It gates the Delete day 2 action with Project Administrators as approvers, and Orion has a dedicated project administrator. Today a user's Delete request on a deployment created in Orion three months ago is waiting for approval. A colleague argues that the policy should affect only deployments requested after it was created.
What explains the observed behavior?
a) Approval policies cover only new deployments, so a different policy must be holding this Delete request
b) A newly added policy applies to current deployments as well as new ones
c) A Day 2 Action policy is holding the Delete request until an approver responds
d) The deployment's expired lease holds every day 2 request
08. Membership of the Atlas support team changes every few weeks in the corporate identity provider. Each engineer is added to project Atlas individually, and when one leaves, the deployments they own and the notifications about them stay tied to that person. The organization administrator must stop editing Atlas for every staffing change and make sure that any current team member can act on deployment notifications.
What should the administrator do?
a) Give the team's group the Atlas roles and deployment ownership
b) Import every engineer individually and let the Project Administrator update Atlas membership after each change
c) Make every engineer an Organization Administrator so that anyone can manage Atlas deployments
d) Create a separate project for each engineer so ownership never has to change hands
09. An All Apps organization uses a SAML identity provider. The organization administrator imported two groups and assigned each of them the Defer to Identity Provider role. Members of the Ops group receive Organization Administrator rights as intended. Members of the Audit group, whose token Roles attribute carries organization auditor, can sign in but have no rights at all.
What is the most likely cause?
a) The Roles attribute is read only for directly imported users, not for members of imported groups
b) The Audit group members were never added to a project, so their organization role grants nothing yet
c) The role name in the token does not match the Organization Auditor role name exactly, including its letter case
d) The Inherit roles from groups toggle is off for the Audit group's members
10. The default Private TGW IP block that the provider assigned to an All Apps organization overlaps a range already routed in the corporate network. The network team requires that this block itself be corrected rather than supplemented with another block. Editing the block's CIDR in place is refused.
How should the organization administrator correct the block?
a) Remove it from the default connectivity profile, edit it, then add it back
b) Ask the provider to replace it with an external IP block for the organization
c) Re-enter the range as private VPC CIDRs on each VPC
d) Set a Private - Transit Gateway IP quota so that VPCs leave the overlapping range unused