VMware VMware Certifications 2V0-71.23 Questions & Answers

• Question 51:

  Which statement is true about Tanzu package CLI plugin?

  A. It cannotbe used to add additional package repositories apart from tanzu-standard.

  B. It can be used to manage packages in public repositories.

  C. It is intended only for CLI-managed packages.

  D. It can be used to install auto-managed packages.

  Correct Answer: C

  The Tanzu package CLI plugin is a tool that allows users to install and manage Tanzu packages on their clusters. Tanzu packages are Kubernetes resources that encapsulate the deployment and configuration of software components, such as Contour, Prometheus, Grafana, and more1. The Tanzu package CLI plugin is intended only for CLI- managed packages, which are packages that users can install and update manually using the Tanzu CLI commands2. The Tanzu package CLI plugin cannot be used to install or manage auto-managed packages, which are packages that are automatically installed and updated by Tanzu Kubernetes Grid as part of the cluster lifecycle2. The other options are incorrect because: It cannot be used to add additional package repositories apart from tanzu-standard is false. The Tanzu package CLI plugin can be used to add, list, update, or delete package repositories, which are sources of Tanzu packages3. Users can add custom package repositories or use the default tanzu-standard repository that comes with Tanzu Kubernetes Grid4. It can be used to manage packages in public repositories is false. The Tanzu package CLI plugin can only be used to manage packages in the repositories that are added to the target cluster3. Users cannot use the Tanzu package CLI plugin to manage packages in public repositories that are not added to the cluster. It can be used to install auto-managed packages is false. As mentioned above, the Tanzu package CLI plugin cannot be used to install or manage auto-managed packages. References: Tanzu Packages, Tanzu Package Types, tanzu package repository, Add a Package Repository

• Question 52:

  What is the object in Kubernetes used to grant permissions to a cluster wide resource?

  A. ClusterRoleBinding

  B. RoleBinding

  C. RoleReference

  D. ClusterRoleAccess

  Correct Answer: A

  The object in Kubernetes used to grant permissions to a cluster-wide resource is ClusterRoleBinding. A ClusterRoleBinding is a cluster-scoped object that grants permissions defined in a ClusterRole to one or more subjects, such as users, groups, or service accounts5. A ClusterRole is a cluster-scoped object that defines a set of permissions on cluster-scoped resources (like nodes) or namespaced resources (like pods) across all namespaces5. For example, a ClusterRoleBinding can be used to allow a particular user to run kubectl get pods --all-namespaces by granting them the permissions defined in a ClusterRole that allows listing pods in any namespace6. References: Using RBAC Authorization | Kubernetes, Cluster Roles and Cluster Roles Binding in Kubernetes | ANOTE.DEV

• Question 53:

  What two steps are required to visualize API connectivity and enable API protection in VMware Tanzu Service Mesh? (Choose two.)

  A. Activate API Discovery for the Global Namespace

  B. Create API Security Policy for the Global Namespace

  C. Enable Threat Detection Policy for the Global Namespace

  D. Set a Distributed Firewall policy for the Global Namespace

  E. Create an Autoscaling policy for API for the Global Namespace

  Correct Answer: AB

  To visualize API connectivity and enable API protection in VMware Tanzu Service Mesh, the administrator needs to perform two steps: Activate API Discovery for the Global Namespace. This allows Tanzu Service Mesh to automatically discover the APIs signatures between microservices running inside or outside the mesh. API Discovery creates a custom API schema for each API that is close to OpenAPI spec 3.0. Tanzu Service Mesh graph renders the detected APIs in the Enforcing mode by default, which means that any new API is considered as a violated API unless accepted by the administrator1 Create API Security Policy for the Global Namespace. This allows the administrator to block or allow layer 4 and layer 7 traffic, as well as create granular policies that provide API and data segmentation, OWASP 10 attack defense, schema validation, geofencing, data compliance, and egress controls. The administrator can create the API Security policy through the Tanzu Service Mesh Console UI or by using the Tanzu Service Mesh API Explorer2 References: 1: https:// docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu- service-mesh-enterprise/GUID-E6FB9FB3-FDB3-4D2B-B5CB-614608EEF537.html 2: https://docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu-service-mesh- enterprise/GUID-5B635420-3BD2-4EC1-B67E-2015F991A91C.html

• Question 54:

  Where can an administrator register the vSphere management cluster in VMware Tanzu Mission Control?

  A. In the VMware Tanzu Mission Control web console or CLI

  B. In the vSphere Management Cluster with Jcubeccl

  C. In the vSphere Client - Workload Cluster settings

  D. In the vSphere Namespace with Jcubeccl

  Correct Answer: A

  To register the vSphere management cluster in VMware Tanzu Mission Control, an administrator can use either the web console or the CLI of VMware Tanzu Mission Control. The web console provides a graphical user interface to perform the registration, while the CLI provides a command-line interface to run a script that automates the registration process. Both methods require the administrator to have access to the vSphere management cluster and to provide some information such as the cluster name, context, and namespace. The registration process creates a service account and a secret in the vSphere management cluster, and generates a kubeconfig file that is used by VMware Tanzu Mission Control to connect to the cluster. References: VMware Tanzu Mission Control Documentation, Registering a vSphere Management Cluster

• Question 55:

  Which two statements about the NSX Advanced Load Balancer are correct? (Choose two.)

  A. It can only be used if Antrea CNI is installed on the workload cluster.

  B. It can be configured as the VIP endpoint for the management cluster on vSphere.

  C. It only supports the service type LoadBalancer.

  D. It is natively integrated with Tanzu Kubernetes Grid Amazon Web Services EC2 deployments.

  E. It can be configured as a load balancer for workloads in the clusters that are deployed on vSphere.

  Correct Answer: BE

  Two statements about the NSX Advanced Load Balancer are correct: It can be configured as the VIP endpoint for the management cluster on vSphere. The VIP endpoint is the IP address that clients use to access the Kubernetes API server on the management cluster. By default, this IP address is assigned by DHCP, but it can also be configured manually or by using a load balancer. Using a load balancer provides high availability and scalability for the VIP endpoint. NSX Advanced Load Balancer can be used as the load balancer provider for the VIP endpoint by creating a virtual service that points to the control plane nodes of the management cluster5. It can be configured as a load balancer for workloads in the clusters that are deployed on vSphere. Workload clusters are Kubernetes clusters that run user workloads on vSphere with Tanzu. Workload clusters require a load balancer to expose services of type LoadBalancer to external clients. NSX Advanced Load Balancer can be used as the load balancer provider for workload clusters by deploying an Avi Kubernetes Service (AKS) pod on each cluster node. The AKS pod acts as an ingress controller that communicates with the NSX Advanced Load Balancer Controller and creates virtual services for each service of type LoadBalancer6. The other options are incorrect because: It can only be used if Antrea CNI is installed on the workload cluster is false. Antrea is one of the supported Container Network Interface (CNI) plugins for workload clusters on vSphere with Tanzu, but it is not mandatory to use it with NSX Advanced Load Balancer. Other CNI plugins, such as Calico or Flannel, can also work with NSX Advanced Load Balancer7. It only supports the service type LoadBalancer is false. NSX Advanced Load Balancer supports other service types as well, such as ClusterIP and NodePort. These service types can be used to expose services within or across clusters without requiring an external load balancer8. It is natively integrated with Tanzu Kubernetes Grid Amazon Web Services EC2 deployments is false. NSX Advanced Load Balancer is not natively integrated with Tanzu Kubernetes Grid Amazon Web Services EC2 deployments. Tanzu Kubernetes Grid on AWS uses the AWS Elastic Load Balancing service as the default load balancer provider for both management and workload clusters9. References: Configure the VIP Endpoint for the Management Cluster, Deploy and Configure NSX Advanced Load Balancer as a Load Balancer for Workload Clusters, Supported CNI Plugins, Service Types, Load Balancing on AWS

• Question 56:

  A Tanzu Mission Control administrator would like to enforce the following container controls:

  1.

  Only allows container images that match the specified names or tags.

  2.

  Ensure that the container image is not tampered with.

  Which type of policy can be used?

  A. Access

  B. Security

  C. Image Security

  D. Image Registry

  E. Network

  Correct Answer: C

  The type of policy that can be used to enforce the container controls is image security. Image security policies allow users to define rules for validating container images before they are deployed on clusters. Users can specify image names, tags, signatures, or digests to whitelist or blacklist images based on their source and integrity. Users can also enable or disable image scanning for vulnerabilities and configure the severity threshold for admission decisions. References: Image Security Policy - VMware Docs, Image Policy - VMware Docs

• Question 57:

  What project does Contour leverage for the data plane?

  A. NSX Load Balancer

  B. Istio

  C. Envoy

  D. Prometheus

  Correct Answer: C

  Contour is an open-source Kubernetes ingress controller that provides dynamic configuration updates and makes use of the Envoy proxy as a data plane1. Envoy is an open-source edge and service proxy that can handle large volumes of

  network traffic between services in a cloud-native environment2. Contour leverages Envoy's advanced features such as load balancing, health checking, dynamic service discovery, circuit breaking, rate limiting, and more3. Contour also

  integrates with Envoy's external authorization filter to support external authentication and authorization providers4.

  The other options are incorrect because:

  NSX Load Balancer is a VMware solution that provides L4 and L7 load balancing and ingress control for Kubernetes clusters5. It is not the data plane for Contour. Istio is an open-source service mesh that provides a uniform way to connect,

  secure, control, and observe services in a distributed system6. It is not the data plane for Contour.

  Prometheus is an open-source systems monitoring and alerting toolkit that can collect metrics from various sources, including Kubernetes clusters7. It is not the data plane for Contour.

  References: Contour Overview, Envoy Overview, Contour Architecture, External Authorization Support, NSX Advanced Load Balancer, Istio Overview, Prometheus Overview

• Question 58:

  What Kubernetes project does vSphere with Tanzu Supervisor Cluster use to automate the lifecycle management of Tanzu Kubernetes Grid Clusters?

  A. Grafana

  B. Cluster API

  C. Contour

  D. Kubeadm

  Correct Answer: B

  The Kubernetes project that vSphere with Tanzu Supervisor Cluster uses to automate the lifecycle management of Tanzu Kubernetes Grid Clusters is Cluster API. Cluster API is a Kubernetes project that provides declarative APIs for cluster creation, configuration, and management. Cluster API uses a set of custom resource definitions (CRDs) to represent clusters, machines, and other objects. Cluster API also relies on providers to implement the logic for interacting with different infrastructure platforms5. vSphere with Tanzu Supervisor Cluster uses Cluster API to deploy and manage Kubernetes clusters on vSphere 7 across multiple vCenter Server instances and/or multiple data centers via Tanzu Mission Control6. References: Taking Kubernetes to the People: How Cluster API Promotes Self ... - VMware, kubernetes-sigs/cluster-api - GitHub

• Question 59:

  What are three capabilities of VMware Aria Operations for Applications (formerly known as Tanzu Observability)? (Choose three.)

  A. Create Alerts

  B. Set Application Container security policy

  C. Set Service Level Objectives

  D. Create Kubernetes Clusters

  E. Create Charts and Dashboards

  F. Create Queries

  Correct Answer: AEF

  VMware Aria Operations for Applications (formerly known as Tanzu Observability) is a unified observability platform that provides full-stack visibility using metrics, traces, and logs across distributed applications, application services, container services, and multi-cloud environments. Some of the capabilities of VMware Aria Operations for Applications are: Create alerts: Users can monitor for certain behaviors and get smart notifications based on query conditions. Users can create alerts independently or directly from charts, and use advanced and accurate alerting powered by AI/analytics and query language1. Create charts and dashboards: Users can visualize their data based on query results in various chart types (such as line plot, point plot, table, pie chart, etc.) and organize them in dashboards. Users can also interact with charts and dashboards in real time, such as zoom in, zoom out, change the time window, change the focus, and so on1. Create queries: Users can use the Wavefront Query Language (WQL) to extract the information they need from their data. Users can use the Chart Builder for easy query creation or the Query Editor for advanced query editing. Users can also use functions, operators, variables, macros, and expressions to manipulate their data1. References: VMware Aria Operations for Applications Documentation, Unified Observability Platform by VMware Aria Operations for Applications

• Question 60:

  Which three can be configured in a VM Class in VMware vSphere with Tanzu? (Choose three.)

  A. Network

  B. Operating system

  C. CPU

  D. Memory

  E. PCI devices

  F. Storage

  Correct Answer: CDF

  A VM class in VMware vSphere with Tanzu specifies the CPU, memory, and resource reservations for a VM10. vSphere with Tanzu offers several preconfigured VM classes which you can use as is, edit, or delete. You can also create custom

  VM classes in your vCenter Server instance and it will be available to all Supervisor Clusters and the namespaces created in these clusters11.

  When you create or edit a VM class, you can configure the following attributes:

  Name: A unique DNS compliant name that identifies the VM class. vCPU Count: The number of virtual CPUs (vCPUs) for a VM. This is a VM hardware configuration.

  CPU Resource Reservation: The guaranteed minimum CPU resource allocation for a VM. This value is expressed in percentage (%). Memory: The memory configured for a VM in MB, GB, or TB. This is a VM hardware configuration.

  Memory Resource Reservation: The guaranteed minimum memory resource allocation for a VM. This value is expressed in percentage (%). Storage: The storage configured for a VM in MB, GB, or TB. This is a VM hardware configuration.

  The other options are incorrect because:

  Network is not an attribute that can be configured in a VM class. Network configuration is done at the namespace level by using network policies12. Operating system is not an attribute that can be configured in a VM class. Operating system

  configuration is done at the image level by using content libraries.

  PCI devices are not an attribute that can be configured in a VM class. PCI devices are not supported by vSphere with Tanzu.

  References: VM Classes, Create a Custom VM Class, Network Policies, [Content Libraries]