VMware VMware Certifications 2V0-71.23 Questions & Answers

• Question 1:

  Which command has a valid syntax for scaling VMware Tanzu Kubernetes Grid cluster using Tanzu CLI?

  A. tanzu cluster scale --controlplane 5 --worker 10 -- namespace=

  B. tanzu cluster scale --controlplane-machine-count 5 --worker-machine- count 10

  C. tanzu scale --controlplane-machine-count 5 --worker-machine-count 10 --namespace=

  D. tanzu scale --controlplane 5 　worker 10

  Correct Answer: B

  The command that has a valid syntax for scaling VMware Tanzu Kubernetes Grid cluster using Tanzu CLI is tanzu cluster scale --controlplane- machine-count 5 --worker-machine-count 10. The tanzu cluster scale command allows users to manually scale the number of control plane and worker nodes in a cluster5. The -- controlplane-machine-count flag specifies the desired number of control plane nodes, while the --worker-machine-count flag specifies the desired number of worker nodes5. The other commands are invalid because they either use incorrect flags or omit the namespace flag when required5. References: Scale Clusters - VMware Docs

• Question 2:

  What is the correct procedure to attach a management cluster using the Tanzu Mission Control web console?

  A. On the Clusters page, select the "Management Clusters" tab. Click "Register Management Cluster", and select the type of management cluster to register.

  B. On the Clusters page, select "Attach Cluster" and then select the "Management Cluster" option, complete the form, and click the "Connect" button.

  C. On the Administration page, select "Attach Cluster" and then select the "Management Cluster" option, complete the form, and click the "Connect" button.

  D. On the Administration page, select the "Management Clusters" tab. Click "Register Management Cluster", and select the type of management cluster to register.

  Correct Answer: D

  The correct procedure to attach a management cluster using the Tanzu Mission Control web console is to go to the Administration page, select the Management Clusters tab, click Register Management Cluster, and select the type of management cluster to register. A management cluster is a Kubernetes cluster that runs the Cluster API components and can be used to create and manage workload clusters3. VMware Tanzu Mission Control supports registering two types of management clusters: Tanzu Kubernetes Grid management clusters and vSphere with Tanzu Supervisor Clusters4. By registering a management cluster with Tanzu Mission Control, you can enable lifecycle management of its workload clusters, assign them to cluster groups, apply policies, and monitor their health and performance4. References: Register a Management Cluster with Tanzu Mission Control - VMware Docs, Management Clusters - The Cluster API Book

• Question 3:

  Which component must be installed upfront to deploy VMware Tanzu Kubernetes Grid management cluster?

  A. Tanzu CLI

  B. Cluster API

  C. Kubeadm

  D. External DNS

  Correct Answer: A

  The Tanzu CLI is a command-line tool that enables users to interact with VMware Tanzu products and services. It must be installed upfront to deploy VMware Tanzu Kubernetes Grid management cluster, as it provides commands to create, configure, scale, upgrade, and delete management clusters on different platforms. The Tanzu CLI also allows users to create workload clusters from the management cluster, and to perform various operations on both types of clusters. References: VMware Tanzu CLI Documentation, [Deploying Management Clusters with the Tanzu CLI]

• Question 4:

  What is the correct resource hierarchy order in VMware Tanzu Mission Control?

  A. Root -> Cluster Groups -> Clusters

  B. Organization -> Cluster Groups -> Namespaces

  C. Organization -> Clusters -> Cluster Groups

  D. Organization -> Cluster Groups -> Clusters

  Correct Answer: D

  The correct resource hierarchy order in VMware Tanzu Mission Control is Organization -> Cluster Groups -> Clusters. An organization is the root of the resource hierarchy and represents a customer account in Tanzu Mission Control. A cluster group is a logical grouping of clusters that can be used to apply policies and manage access. A cluster is a Kubernetes cluster that can be attached or provisioned by Tanzu Mission Control. A cluster belongs to one and only one cluster group, and a cluster group belongs to one and only one organization. References: VMware Tanzu Mission Control Concepts, Resource Hierarchy

• Question 5:

  What are two possible counts of control plane nodes in a Tanzu Kubernetes Grid Workload Cluster? (Choose two.)

  A. 3

  B. 5

  C. 2

  D. 0

  E. 1

  Correct Answer: AE

  The control plane nodes are the nodes that run the Kubernetes control plane components, such as the API server, the scheduler, the controller manager, and etcd. The control plane nodes are responsible for managing the cluster state and orchestrating workload operations. The possible counts of control plane nodes in a Tanzu Kubernetes Grid workload cluster are 1 or 3. The control plane must have an odd number of nodes to ensure quorum and high availability. A single control plane node is suitable for development or testing purposes, while three control plane nodes are recommended for production clusters23. References: Deploy Workload Clusters - VMware Docs, Concepts and References - VMware Docs

• Question 6:

  Which statement about Tanzu Mission Control policies is correct?

  A. Policies can be configured using a tag selector to restrict the scope of the policy.

  B. Policies can only be applied to clustergroups.

  C. Policies allow management and operation of the security posture of Kubernetes clusters, and other organizational objects.

  D. Policies can be enforced using Kubernetes resources (NetworkPolicy, ResourceQuota etc) or using the Kyverno admission controller.

  Correct Answer: C

  Policies are one of the features of Tanzu Mission Control that allow you to manage the operation and security posture of your Kubernetes clusters and other organizational objects. Policies allow you to provide a set of rules that govern your

  organization and all the objects it contains. The policy types available in Tanzu Mission Control include access policy, image registry policy, network policy, quota policy, security policy, and custom policy. Policies can be applied at the

  individual, group, or organizational level to control access, image registries, networking, resource consumption, security context, and more18.

  The other options are incorrect because:

  Policies can be configured using a tag selector to restrict the scope of the policy is false. Policies can be configured using a label selector, not a tag selector, to include or exclude certain objects from the policy. A label is a key/value

  pairattached to a Kubernetes object that allows you to specify identifying attributes for that object. A selector provides the means to identify the objects that have a given label18.

  Policies can only be applied to clustergroups is false. Policies can be applied to various levels of the Tanzu Mission Control resource hierarchy, such as organization, cluster group, workspace, cluster, and namespace18. Policies can be

  enforced using Kubernetes resources (NetworkPolicy, ResourceQuota etc) or using the Kyverno admission controller is false. Policies are enforced by Tanzu Mission Control using its own admission controller and webhook server. Kyverno is

  an open-source policy engine for Kubernetes that is not related to Tanzu Mission Control.

  References: Policy-Driven Cluster Management, [Kyverno]

• Question 7:

  Which Kubernetes object must be used to be able to upgrade a pod without disrupting services?

  A. ReplicaSet

  B. Service

  C. Container

  D. Deployment

  Correct Answer: D

  A Deployment is a Kubernetes object that allows you to perform a rolling update without disrupting services. A Deployment manages a ReplicaSet or a Pod and provides declarative updates for them. You can describe the desired state of

  your application using a Deployment, and it will change the actual state to the desired state at acontrolled rate. A Deployment also allows you to roll back to a previous version if something goes wrong during the update14.

  The other options are incorrect because:

  A ReplicaSet is a Kubernetes object that ensures that a specified number of pod replicas are running at any given time. It does not provide any mechanism for updating or rolling back pods15.

  A Service is a Kubernetes object that defines a logical set of pods and a policy to access them. It does not provide any mechanism for updating or rolling back pods16.

  A Container is not a Kubernetes object, but rather a component of a Pod. A Pod is the smallest deployable unit of computing in Kubernetes. A Pod can contain one or more containers that share storage and network resources. A Pod does

  not provide any mechanism for updating or rolling back itself or its containers17. References: Deployments, ReplicaSets, Services, Pods

• Question 8:

  Which L7 ingress mode leverages the integration between NSX Advanced Load Balancer and Antrea?

  A. L7 ingress in NodePort mode

  B. L7 ingress in ClusterIP mode

  C. L7 ingress in NodePortLocal mode

  D. L7 ingress in Nodelntegration mode

  Correct Answer: C

  L7 ingress in NodePortLocal mode is an ingress mode that leverages the integration between NSX Advanced Load Balancer and Antrea. NSX Advanced Load Balancer (NSX ALB) is a solution that provides L4 and L7 load balancing and ingress control for Kubernetes clusters5. Antrea is a Kubernetes networking solution that implements the Container Network Interface (CNI) specification and uses Open vSwitch (OVS) as the data plane6. In NodePortLocal mode, the ingress backend service must be ClusterIP mode, and Antrea assigns a unique port on each node for each pod that serves as a backend for the service. The network traffic is routed from the client to the NSX ALB Service Engine (SE), and then directly to the pods without going through the nodes or kube-proxy. This mode reduces network latency and improves performance by avoiding extra hops7. The following diagram illustrates how the network traffic is routed in NodePortLocal mode: !NodePortLocal mode diagram The other options are incorrect because: L7 ingress in NodePort mode is an ingress mode that does not leverage the integration between NSX ALB and Antrea. In this mode, the ingress backend service must be NodePort mode, and the network traffic is routed from the client to the NSX ALB SE, and then to the cluster nodes, before it reaches the pods. The NSX ALB SE routes the traffic to the nodes, and kube-proxy helps route the traffic from the nodes to the target pods. This mode requires an extra hop for kube-proxy to route traffic from node to pod7. L7 ingress in ClusterIP mode is an ingress mode that does not leverage the integration between NSX ALB and Antrea. In this mode, the ingress backend service must be ClusterIP mode, and Antrea assigns a virtual IP (VIP) for each service. The network traffic is routed from the client to the NSX ALB SE, and then to one of the VIPs assigned by Antrea, before it reaches the pods. The NSX ALB SE routes the traffic to one of the VIPs, and kube-proxy helps route the traffic from the VIPs to the target pods. This mode requires an extra hop for kube-proxy to route traffic from VIPs to pod7. L7 ingress in Nodelntegration mode is not a valid ingress mode for NSX ALB. References: NSX Advanced Load Balancer, Antrea, NSX ALB as L7 Ingress Controller

• Question 9:

  An administrator was requested to create a pod with two interfaces to separate the application and management traffic for security reasons.

  Which two packages have to be installed in VMware Tanzu Kubernetes Grid cluster to satisfy the requirement? (Choose two.)

  A. multus

  B. external-dns

  C. cert-manager

  D. qrafana

  E. contour

  Correct Answer: AE

  Multus is an open-source container network interface plugin for Kubernetes that enables attaching multiple network interfaces to pods. Contour is an open-source Kubernetes ingress controller that provides dynamic configuration updates and makes use of the Envoy proxy as a data plane. By installing these two packages in a VMware Tanzu Kubernetes Grid cluster, an administrator can create a pod with two interfaces and use Contour to route the application and management traffic to different networks. The other options are incorrect because: external-dns is a package that synchronizes exposed Kubernetes services and ingresses with DNS providers. It does not provide multiple interfaces for pods. cert-manager is a package that automates the management and issuance of TLS certificates from various sources. It does not provide multiple interfaces for pods. qrafana is not a valid package name. The correct spelling is Grafana, which is a package that provides visualization and analytics for metrics collected by Prometheus. It does not provide multiple interfaces for pods. References: Install Multus and Whereabouts for Container Networking, Install Contour for Ingress

• Question 10:

  Which Kubernetes object controls what traffic is allowed to and from selected pods and network endpoints?

  A. Ingress

  B. NetworkPolicv

  C. PodSecurityPolicy

  D. ISecret

  Correct Answer: B

  A NetworkPolicy is a Kubernetes object that controls what traffic is allowed to and from selected pods and network endpoints6. NetworkPolicy objects contain the following information:

  The pods that are affected by this policy (the pod selector) The traffic that is allowed for these pods (the ingress and egress rules) The network entities that are allowed or denied for this traffic (the selectors and IP blocks)

  By default, all pods in a cluster can communicate with each other and with any external network endpoint. A NetworkPolicy allows you to restrict this behavior by defining rules for pod isolation and network access. A NetworkPolicy is enforced

  by a network plugin that supports it6.

  The other options are incorrect because:

  An Ingress is a Kubernetes object that manages external access to services in a cluster, typically HTTP7. It does not control what traffic is allowed to and from selected pods and network endpoints.

  A PodSecurityPolicy is a Kubernetes object that controls security-sensitive aspects of pod specification, such as running as privileged or using host networking8. It does not control what traffic is allowed to and from selected pods and network

  endpoints.

  A Secret is a Kubernetes object that stores sensitive information, such as passwords or keys, in an encrypted form9. It does not control what traffic is allowed to and from selected pods and network endpoints. References: Network Policies,

  Ingress, Pod Security Policies, Secrets