An architect is designing a VMware Cloud Foundation (VCF) Single Sign-On (SSO) architecture for a...

C and E provide the centralized SSO architecture required while minimizing operational complexity. The VCF Identity Broker can provide identity services across a fleet containing multiple VCF instances , eliminating the need to deploy and manage an independent identity stack for every VCF instance. Broadcom describes the external Identity Broker model as providing identity services across a VCF Fleet, with centralized SSO covering VCF Operations, vCenter, NSX, and other platform components. ( VMware Blogs )

Deploying the Identity Broker with the first VCF instance at DC01 (C) establishes the centralized identity service. E then allows additional VCF instances within the same private cloud to consume that existing VIDB rather than introducing redundant identity infrastructure at every site.

This architecture also supports REQ02 . VCF Identity Broker federates authentication to supported enterprise identity providers, including SAML-based providers, Entra ID, Okta, and others. Multi-factor authentication can therefore be enforced by the corporate identity provider and applied across the VCF management stack. ( VMware Blogs )

A unnecessarily duplicates VIDB infrastructure and increases administration. B similarly creates additional identity components without a requirement for separate identity domains. D incorrectly references a VIDB hosted at DC02 when the centralized design establishes the first VIDB at DC01.

Study Guide References/Topics: VCF Single Sign-On; VCF Identity Broker; Fleet-Level Identity Management; Multi-Instance VCF Design; Identity Federation; MFA/Two-Factor Authentication; Centralized Management Services.