VMware VMware Certifications 2V0-71.23 Questions & Answers

• Question 41:

  Which two resources can External DNS create records for? (Choose two.)

  A. Virtual machines

  B. Kubernetes pods

  C. Kubernetes services

  D. Kubernetes nodes

  E. Contour HTTP Proxy

  Correct Answer: CE

  Kubernetes services and Contour HTTP Proxy are two resources that External DNS can create records for. External DNS is a Kubernetes controller that synchronizes exposed Kubernetes resources with DNS providers. It supports creating DNS records for Kubernetes services of type LoadBalancer or NodePort, as well as Ingress resources. Contour HTTP Proxy is a custom resource definition (CRD) that provides an alternative way to configure HTTP routes on Kubernetes clusters. External DNS can also create DNS records for Contour HTTP Proxy resources, as long as they have an associated service of type LoadBalancer or NodePort. References: kubernetes- sigs/external-dns - GitHub, Contour HTTPProxy User Guide

• Question 42:

  What are four policy types supported by VMware Tanzu Mission Control? (Choose four.)

  A. Security policy

  B. Pod security policy

  C. Access policy

  D. Cluster group policy

  E. Network policy

  F. Custom policy

  G. Workspace policy

  Correct Answer: ACEF

  Four policy types that are supported by VMware Tanzu Mission Control are:

  Security policy: Security policies allow you to manage the security context in which deployed pods operate in your clusters by imposing constraints on your clusters that define what pods can do and which resources they have access to6.

  Access policy: Access policies allow you to use predefined roles to specify which identities (individuals and groups) have what level of access to a given resource7. Network policy: Network policies allow you to use preconfigured templates to

  define how pods communicate with each other and other network endpoints8. Custom policy: Custom policies allow you to implement additional business rules, using templates that you define, to enforce policies that are not already

  addressed using the other built-in policy types9.

  References: Policy-Driven Cluster Management - VMware Docs

• Question 43:

  Which statement correctly describes the Cluster API?

  A. It is a specialized toolset to bring declarative, Kubernetes-style APIs to cluster creation, configuration, and management in the Kubernetes ecosystem.

  B. It enables pod networking and enforces network Kubernetes policies.

  C. It is responsible for scanning language-specific packages in container images, such as Java, Python, Go, and others.

  D. It is a native Kubernetes certificate management controller that adds certificates and certificate issuers as resource types in Kubernetes clusters.

  Correct Answer: A

  The statement that correctly describes the Cluster API is that it is a specialized toolset to bring declarative, Kubernetes-style APIs to cluster creation, configuration, and management in theKubernetes ecosystem. Cluster API is a Kubernetes sub-project that provides declarative APIs and tooling to simplify provisioning, upgrading, and operating multiple Kubernetes clusters5. Cluster API uses a set of custom resource definitions (CRDs) to represent clusters, machines, and other objects. Cluster API also relies on providers to implement the logic for interacting with different infrastructure platforms5. References: Introduction - The Cluster API Book

• Question 44:

  Which two package management tools can be used to configure and install applications on Kubernetes? (Choose two.)

  A. Grafana

  B. Fluent bit

  C. Carvel

  D. Helm

  E. Multus

  Correct Answer: CD

  Two package management tools that can be used to configure and install applications on Kubernetes are: Carvel. Carvel is a set of tools that provides a simple, composable, and flexible way to manage Kubernetes configuration, packaging, and deployment. Carvel includes tools such as kapp, which applies and tracks Kubernetes resources in a cluster; ytt, which allows templating YAML files; kbld, which builds and pushes images to registries; kpack, which automates image builds from source code; and vendir, which syncs files from different sources into a single directory. Carvel is integrated with VMware Tanzu Kubernetes Grid and can be used to deploy and manage applications on Tanzu clusters. Helm. Helm is a tool that helps users define, install, and upgrade complex Kubernetes applications using charts. Charts are packages of pre-configured Kubernetes resources that can be customized with values. Helm uses a client- server architecture with a command line tool called helm and an in-cluster component called Tiller. Helm can be used to deploy applications from the official Helm charts repository or from custom charts created by users or vendors. Helm is also integrated with VMware Tanzu Kubernetes Grid and can be used to deploy and manage applications on Tanzu clusters. References: : https://carvel.dev/ : https://docs.vmware.com/en/VMware-Tanzu-Kubernetes- Grid/1.6/vmware-tanzu-kubernetes-grid-16/GUID-tkg-carvel.html : https://helm.sh/ : https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/1.6/vmware-tanzu- kubernetes-grid-16/GUID-tkg-helm.html

• Question 45:

  Which method describes how Kubernetes clusters are upgraded?

  A. Use rolling upgrade

  B. In-place upgrade of each node

  C. Use canary upgrade

  D. Deploy a new cluster with upgraded Kubernetes release

  Correct Answer: A

  A rolling upgrade is a method of upgrading a Kubernetes cluster without downtime by gradually replacing nodes or components with newer versions. A rolling upgrade ensures that there is no disruption to the availability and functionality of the cluster during the upgrade process. A rolling upgrade can be performed manually or using tools such as kubeadm or kops5. The other options are incorrect because: In-place upgrade of each node is a method of upgrading a Kubernetes cluster by stopping each node or component and updating it to the newer version. This method can cause downtime and disruption to the cluster during the upgrade process. Use canary upgrade is not a valid method of upgrading a Kubernetes cluster. A canary upgrade is a technique for deploying new versions of applications or services by gradually exposing them to a subset of users or traffic before rolling them out to everyone6. It is not applicable to cluster upgrades. Deploy a new cluster with upgraded Kubernetes release is not a method of upgrading a Kubernetes cluster, but rather creating a new one. This method canbe costly and time-consuming, as it requires migrating all the resources and configurations from the old cluster to the new one. References: Upgrade A Cluster, Canary deployments

• Question 46:

  An administrator will enable workload management in vSphere using NSX Advanced Load Balancer.

  Which two components does the administrator need to prepare on NSX Advanced Load Balancer in advance? (Choose two.)

  A. NSX Controller

  B. Service Engine Group

  C. Provide connectivity to NSX manaqer

  D. NSX Advanced Load Balancer Controller

  E. Avi Kubernetes Operator

  Correct Answer: BD

  To enable workload management in vSphere using NSX Advanced Load Balancer, an administrator needs to prepare two components on NSX Advanced Load Balancer in advance: the Service Engine Group and the NSX Advanced Load Balancer Controller1. The Service Engine Group is a logical group of Service Engines that share the same configuration and resources. A Service Engine is a virtual machine that handles the data plane operations of NSX Advanced Load Balancer, such as load balancing, health monitoring, SSL termination, and more2. The administrator needs to configure a Service Engine Group for each Supervisor Cluster that will use NSX Advanced Load Balancer as the load balancer provider1. The NSX Advanced Load Balancer Controller is a virtual machine that handles the control plane operations of NSX Advanced Load Balancer, such as configuration, analytics, orchestration, and management2. The administrator needs to deploy and configure the NSX Advanced Load Balancer Controller VM in the management network of the vSphere environment where workload management will be enabled1. The other options are incorrect because: The NSX Controller is not a component of NSX Advanced Load Balancer, but rather a component of NSX-T Data Center. The NSX Controller is a clustered virtual appliance that provides the control plane functions for logical switching and routing3. It is not required for enabling workload management in vSphere using NSX Advanced Load Balancer. Providing connectivity to NSX Manager is not a component of NSX Advanced Load Balancer, but rather a prerequisite for enabling workload management in vSphere using NSX-T Data Center. The NSX Manager is a virtual appliance that provides the management plane functions for NSX-T Data Center3. It is not required for enabling workload management in vSphere using NSX Advanced Load Balancer. The Avi Kubernetes Operator is not a component of NSX Advanced Load Balancer, but rather an optional tool that can be used to automate the installation and configuration of NSX Advanced Load Balancer on Kubernetes clusters4. It is not

  required for enabling workload management in vSphere using NSX Advanced Load Balancer.

  References: Install and Configure the NSX Advanced Load Balancer for vSphere with Tanzu with NSX, NSX Advanced Load Balancer Architecture, NSX-T Data Center Architecture, Avi Kubernetes Operator

• Question 47:

  An administrator has a VMware Tanzu Kubernetes Grid management cluster named tanzu- mc0l which needs to be upgraded.

  Which command can be used to upgrade this cluster?

  A. kubectl management-cluster upgrade

  B. tanzu mc upgrade

  C. tanzu config use-context tanzu-mc01-admin@tanzu-mc01

  D. kubectl tanzu-mc01 upgrade

  Correct Answer: B

  The tanzu mc upgrade command is used to upgrade a management cluster to a newer version of Tanzu Kubernetes Grid. The command requires the name of the management cluster as an argument, and optionally the version to upgrade to.

  For example, toupgrade the management cluster named tanzu-mc01 to version v1.4.0, the command would be:

  tanzu mc upgrade tanzu-mc01 --version v1.4.0

  The other options are incorrect because:

  kubectl management-cluster upgrade is not a valid command. The kubectl command is used to interact with Kubernetes clusters, not to upgrade them.

  tanzu config use-context tanzu-mc01-admin@tanzu-mc01 is a command to switch the current context to the admin context of the management cluster named tanzu- mc01. It does not upgrade the cluster.

  kubectl tanzu-mc01 upgrade is not a valid command. The kubectl command does not accept a cluster name as an argument, and there is no upgrade subcommand. References: VMware Tanzu for Kubernetes Operations Getting Started,

  Upgrading Management Clusters

• Question 48:

  Which kinds of objects does the Kubernetes RBAC API declare?

  A. CloudPolicyObject

  B. Role, ClusterRole, RoleBinding and ClusterRoleBinding

  C. Container type and Container object

  D. ClusterObject and ClusterNode

  Correct Answer: B

  The Kubernetes RBAC API declares four kinds of Kubernetes object: Role, ClusterRole, RoleBinding and ClusterRoleBinding. These objects are used to define permissions and assign them to users or groups within a cluster. A Role or ClusterRole contains rulesthat represent a set of permissions on resources or non-resource endpoints. A RoleBinding or ClusterRoleBinding grants the permissions defined in a Role or ClusterRole to a set of subjects (users, groups, or service accounts). A RoleBinding applies only within a specific namespace, while a ClusterRoleBinding applies cluster-wide. The other options are incorrect because: CloudPolicyObject is not a valid Kubernetes object type. It might be confused with NetworkPolicy, which is an object type that defines how pods are allowed to communicate with each other and other network endpoints. Container type and Container object are not valid Kubernetes object types. They might be confused with Pod, which is an object type that represents a group of one or more containers running on a node. ClusterObject and ClusterNode are not valid Kubernetes object types. They might be confused with Cluster and Node, which are concepts that describe the logical and physical components of a Kubernetes cluster. References: Using RBAC Authorization, Kubernetes RBAC: Concepts, Examples and Top Misconfigurations

• Question 49:

  Which VMware product UI allows browsing Global Namespace Topology?

  A. NSX Advanced Load Balancer

  B. NSX

  C. Tanzu Service Mesh Advanced

  D. Tanzu Mission Control

  Correct Answer: C

  VMware Tanzu Service Mesh Advanced is the VMware product UI that allows browsing Global Namespace Topology. A Global Namespace is a logical group of services that span multiple clusters and clouds, providing consistent service

  discovery, security, and observability10. A Global Namespace Topology is a graphical representation of the services and their connections in a Global Namespace, showing the key metrics and health status of each service11. To browse the

  Global Namespace Topology, an administrator can use the Tanzu Service Mesh Console, which is the web-based user interface for managing Tanzu Service Mesh12.

  The other options are incorrect because:

  NSX Advanced Load Balancer is a VMware product that provides load balancing, web application firewall, and container ingress services for applications across various data centers and clouds13. It does not allow browsing Global

  Namespace Topology.

  NSX is a VMware product that provides network virtualization and security for applications across various data centers and clouds. It does not allow browsing Global Namespace Topology.

  Tanzu Mission Control is a VMware product that provides centralized management and governance for Kubernetes clusters across multiple teams and clouds. It does not allow browsing Global Namespace Topology.

  References: Global Namespaces, View the Topology of Services in a Global Namespace or a Cluster, Tanzu Service Mesh Console Overview, NSX Advanced Load Balancer Overview, [NSX-T Data Center Overview], [Tanzu Mission Control

  Overview]

• Question 50:

  What are the three Cluster API providers being used in VMware Tanzu Kubernetes Grid? (Choose three.)

  A. CAPI

  B. CAPz

  C. CAPM

  D. CAP

  E. CAPV

  F. CAPA

  Correct Answer: BEF

  Cluster API is a Kubernetes project that provides declarative APIs for cluster creation, configuration, and management. Cluster API uses a set of custom resource definitions (CRDs) to represent clusters, machines, and other objects. Cluster API also relies on providers to implement the logic for interacting with different infrastructure platforms. VMware Tanzu Kubernetes Grid uses Cluster API to deploy and manage Kubernetes clusters on various platforms. The three Cluster API providers being used in VMware Tanzu Kubernetes Grid are: CAPZ: Cluster API Provider for Azure. This provider enables Cluster API to create Kubernetes clusters on Microsoft Azure4. CAPV: Cluster API Provider for vSphere. This provider enables Cluster API to create Kubernetes clusters on vSphere 6.7 or later5. CAPA: Cluster API Provider for AWS. This provider enables Cluster API to create Kubernetes clusters on Amazon Web Services5. References: VMware Tanzu Kubernetes Grid Documentation, Taking Kubernetes to the People: How Cluster API Promotes Self ... - VMware