VMware VMware Certifications 2V0-41.23 Questions & Answers

• Question 101:

  An administrator wants to validate the BGP connection status between the Tier-O Gateway and the upstream physical router.

  What sequence of commands could be used to check this status on NSX Edge node?

  A. set vrf show logical-routers show bgp

  B. show logical-routers get vrf show ip route bgp

  C. get gateways vrf get bgp neighbor

  D. enable get vrf show bgp neighbor

  Correct Answer: C

  The sequence of commands that could be used to check the BGP connection status between the Tier-O Gateway and the upstream physical router on NSX Edge node is get gateways, vrf , get bgp neighbor. These commands can be executed on the NSX Edge node CLI after logging in as admin6. The first command, get gateways, displays the list of logical routers (gateways) configured on the Edge node, along with their IDs and VRF numbers7. The second command, vrf , switches to the VRF context of the desired Tier-O Gateway, where is the VRF number obtained from the previous command7. The third command, get bgp neighbor, displays the BGP neighbor summary for the selected VRF, including the neighbor IP address, AS number, state, uptime, and prefixes received8. The other options are incorrect because they either use invalid or incomplete commands or do not switch to the correct VRF context. References: NSX-T Command-Line Interface Reference, NSX Edge Node CLI Commands, Troubleshooting BGP on NSX-T Edge Nodes

• Question 102:

  DRAG DROP

  Drag and drop the NSX graphic element icons on the left found in an NSX Intelligence visualization graph to Its correct description on the right.

  Select and Place:

  Correct Answer:

  

  

• Question 103:

  DRAG DROP

  Sort the rule processing steps of the Distributed Firewall. Order responses from left to right.

  Select and Place:

  

  Correct Answer:

  

  The correct order of the rule processing steps of the Distributed Firewall is as follows:

  Packet arrives at vfilter connection table. If matching entry in the table, process the packet.

  If connection table has no match, compare the packet to the rule table. If the packet matches source, destination, service, profile and applied to fields, apply the action defined.

  If the rule table action is allow, create an entry in the connection table and forward the packet.

  If the rule table action is reject or deny, take that action. This order is based on the description of how the Distributed Firewall works in the web search results1. The first step is to check if there is an existing connection entry for the packet in

  the vfilter connection table, which is a cache of flow entries for rules with an allow action. If there is a match, the packet is processed according to the connection entry. If there is no match, the packet is compared to the rule table, which

  contains all the security policy rules. The rules are evaluated from top to bottom until a match is found. The match criteria include source, destination, service, profile and applied to fields. The action defined by the matching rule is applied to

  the packet. The action can be allow, reject or deny. If the action is allow, a new connection entry is created for the packet and the packet is forwarded to its destination. If the action is reject or deny, the packet is dropped and an ICMP

  message or a TCP reset message is sent back to the source.

• Question 104:

  DRAG DROP

  Match the NSX Intelligence recommendations with their correct purpose.

  Select and Place:

  

  Correct Answer:

  

  Security policy recommendations: Are East-West distributed firewall (DFW) security policies in the application category12.

  Security group recommendations: Are VMs or physical servers whose traffic flows were analyzed for the time period and the boundary you had specified12. Service recommendations: Are service objects that were used by applications in the

  VMs or physical servers that you had specified, but the services are not yet defined in the NSX inventory12.

  https://docs.vmware.com/en/VMware-NSX-Intelligence/4.1/user-guide/GUID-BA3B0D67-4AA8-439E-A845-4598DAD6B9D0.html

• Question 105:

  HOTSPOT

  Which two items must be configured to enable OSPF for the Tler-0 Gateway in the Image? Mark your answers by clicking twice on the image.

  Hot Area:

  

  Correct Answer:

  

  The correct answer is to enable the OSPF toggle and to add an Area Definition for the Tier-0 gateway in the image. These two items are required to configure OSPF on the Tier-0 gateway, as explained in the web search results123. To mark your answers by clicking twice on the image, you can double-click on the toggle switch next to OSPF to turn it on. The switch should change from gray to blue, indicating that the option is enabled. Then, you can double-click on the Set button next to Area Definition to add an area definition. A pop-up window should appear where you can specify the area ID and type.

  1. Click the OSPF toggle to enable OSPF

  2. In the Area Definition field, click Set to add an area definition https://docs.vmware.com/en/VMware-NSX-T-Data-Center/3.2/administration/GUID-5BEC626C-5312-467D-B873-8E117349E9FC.html

• Question 106:

  HOTSPOT

  An administrator configured NSX Advanced Load Balancer to load balance the production web server traffic, but the end users are unable to access the production website by using the VIP address.

  Which of the following Tier-1 gateway route advertisement settings needs to be enabled to resolve the problem? Mark the correct answer by clicking on the image.

  Hot Area:

  

  Correct Answer:

  

  The correct answer is to enable the option All LB VIP Routes on the Tier-1 gateway route advertisement settings. This option allows the Tier-1 gateway to advertise the NSX Advanced Load Balancer LB VIP routes to the Tier-0 gateway and

  other peer routers, so that the end users can reach the production website by using the VIP address1. The other options are not relevant for this scenario.

  To mark the correct answer by clicking on the image, you can click on the toggle switch next to All LB VIP Routes to turn it on. The switch should change from gray to blue, indicating that the option is enabled. See the image below for

  reference:

• Question 107:

  HOTSPOT An administrator configured NSX Advanced Load Balancer to redistribute the traffic between the web servers. However, requests are sent to only one server Which of the following pool configuration settings needs to be adjusted to resolve the problem? Mark the correct answer by clicking on the image.

  Hot Area:

  

  Correct Answer:

  

  Load Balancing Algorithm

  You specify the following parameters during the creation of a server pool:

  Name: A unique name for the server pool.

  Cloud: The cloud connector details for the NSX environment.

  VRF Context: Virtual Routing Framework (VRF) is a method to isolate traffic in a system. VRF is also called a route domain in the load balancer community. A global VRF context is created by default. Network administrators might create

  custom VRF contexts to isolate traffic between different tenants or subsets.

  Default Server Port: New connections to servers will use this destination service port. The default port is 80.

  Load-balancing algorithm: The selected load-balancing algorithm controls how the incoming connections are distributed among the servers in the pool.

  Tier-1 gateway (logical router): Specify the Tier-1 gateway that you want to attach the server pool to. This value matches the Tier-1 gateway specified for the virtual service and VIP.