In VMware Cloud Foundation 9.0, network security and segment integrity are maintained through Segment Security Profiles. These profiles are applied to NSX segments to define what type of traffic is permitted to originate from or be received by the virtual machines attached to that segment.
According to the VCF 9.0 (NSX) Networking and Security Guide:
The Default Segment Security Profile is designed with a "Zero Trust" approach for foundational services. One of its key default settings is DHCP Server Block, which is set to Yes. This is a security measure to prevent "rogue" DHCP servers from being accidentally or maliciously connected to a segment and disrupting the network by handing out unauthorized IP addresses.
When an administrator intentionally places a legitimate DHCP server on a segment:
Segment Security Profile: The "DHCP Server Block" feature resides specifically within the Segment Security Profile, not the IP Discovery profile (which handles how NSX learns IP addresses via ARP/DHCP snooping).
Cloning vs. Editing: In VCF 9.0, the "Default" profiles are system-defined. While some default settings can be edited in certain versions, the architectural best practice and documented procedure for production environments is to Clone the default profile. This creates a custom profile where the DHCP Server Block can be set to No, allowing the DHCP server's "Offer" and "ACK" packets to pass through the segment.
Application: Once the cloned profile is modified, it must be manually applied to the specific segment where the virtual desktops and the DHCP server reside.
Reference:
VMware Cloud Foundation 9.0 Administration Guide: Configuring Segment Security Profiles.
VMware NSX (VCF 9.0) Product Documentation: Managing Segment Profiles and DHCP Security.

VCF 9.0 introduces Log Data Transfer initiated from VCF Operations. The docs say: "You can transfer log data for up to 90 days from Aria Operations for Logs 8.x... The migrated logs are stored in VCF Operations for logs." and "To transfer logs... navigate to the Logs Data Transfer card in Administration > Control Panel... click the INITIATE TRANSFER button... You can select the duration of logs to transfer..." (emphasis added).
They further clarify that simple forwarding does not transfer already ingested logs: "Forward logs... does not transfer already ingested logs. Transfer historical logs up to 90 days... using the Log Data Transfer feature in VCF Operations." Hence, the correct action is to initiate the transfer in VCF Operations (Administration > Control Panel > Logs Data Transfer).

According to VMware Cloud Foundation 9.0 documentation for VCF Automation (Aria Automation integration):
To deploy workloads to specific NSX segments with VLAN-based selection and IPAM integration, the administrator must:
1,Configure Network IPAM Settings (Option C)
VCF Automation requires network segments to be associated with IPAM configuration:
"To enable automatic IP allocation for workloads, configure network profiles with gateway, subnet, and IP range details for the associated networks." This ensures automatic IP address allocation from the internal IPAM.
2,reate a Network Profile and Associate Segments (Option D)
VCF Automation uses Network Profiles to group NSX segments and associate them with projects:
"A network profile defines the networks available to a project and includes capability tags that are matched during workload deployment." Including all appdev segments in a dedicated network profile ensures logical isolation from other projects.
3,Use Capability Tags for VLAN Selection (Option F)
VCF Automation uses capability tags to match user input to infrastructure:
"Capability tags applied to networks can be matched in cloud templates to dynamically select networks based on user-defined inputs." By applying vlan:<number> tags to each segment, a self-service user can specify a VLAN number that determines which segment is selected during deployment.
Why Other Options Are Incorrect
A - Custom groups are not required for network selection.
B - Tagging segments alone is insufficient without associating them through a network profile.
E - Adding networks to the existing development project violates logical isolation requirements.
Document reference (VCF 9.0):
VMware Cloud Foundation 9.0 → VCF Automation → Projects and Network Profiles VMware Cloud Foundation 9.0 → Network Profiles and IPAM Configuration VMware Cloud Foundation 9.0 → Capability Tags and Network Selection

In VMware Cloud Foundation 9.0, configuration drift detection is handled through VCF Operations Configuration Management integrated with vSphere Configuration Profiles.
According to the VCF 9.0 documentation:
vCenter Version Requirement (D):
Configuration drift monitoring requires vCenter 8.0 Update 3 or later, as this introduces the enhanced configuration profile capabilities necessary for drift comparison.
Create a Configuration Template (E):
VCF Operations requires a defined baseline configuration template to compare cluster states against.
Assign the Template to a Policy (F):
Policies enforce and monitor configuration compliance. Assigning the template to a policy allows drift detection against the desired state.
Incorrect options:
vCenter 9.0 (A) is not required; 8.0 U3 is sufficient.
A collector (B) is not specifically required for drift detection.
Scheduling drift detection (C) is part of policy evaluation, not a standalone mandatory step.
Configuring vSphere Configuration Profiles (G) is beneficial but not mandatory for drift monitoring via VCF Operations.
Thus, the three required steps are: vCenter 8.0 U3 or later, create a configuration template, and assign it to a policy.
Reference:
VMware Cloud Foundation 9.0 - Operations Guide (Configuration Management and Drift Detection), vSphere 8.0 U3 Configuration Profiles Documentation.

Resetting identity management in VCF requires removal of existing identity configurations, including external identity providers and the Identity Broker configuration. The VCF documentation states that to reset identity services, administrators must remove the SSO configuration, including broker settings, and then reconfigure SSO.
Option B ensures complete cleanup of identity integrations.
Option C re-establishes identity management with the correct configuration.
Disabling (D) or reverting (E) is not a supported reset method. Leaving provisioned users/groups (A) would not fully reset identity management.