VMware VMware Certifications 2V0-641 Questions & Answers

• Question 31:

  Which service cannot be included in a Security Policy using Service Composer?

  A. Endpoint Services

  B. Firewall Rules

  C. Virtual Private Network Services

  D. Network Introspection Services

  Correct Answer: C

• Question 32:

  Which action is not an option for adding Virtual Machines to a Security Group?

  A. Adding Virtual Machines to a Security Group and nesting it within another Security Group.

  B. Defining Dynamic Membership in the Security Group.

  C. Adding Virtual Machines to a Security Policy and associating it with a Security Group.

  D. Selecting objects to include within a Security Group.

  Correct Answer: C

• Question 33:

  Which Virtual Machine cannot be protected by the Distributed Firewall?

  A. A Virtual Machine connected to a vDS Portgroup running on an ESXi 5.1 host.

  B. A Virtual Machine connected to a vSS Portgroup running on an ESXi 5.5 host.

  C. A Virtual Machine connected to a vDS Portgroup running on an ESXi 5.5 host.

  D. A Virtual Machine connected to a logical switch running on an ESXi 5.1 host.

  Correct Answer: D

• Question 34:

  Which two options are valid SpoofGuard operational modes? (Choose two.)

  A. Allow Local Address as Valid Address in This Namespace

  B. Allow and Approve DHCP Requests Regardless of Enabled Mode

  C. Automatically Trust IP Assignments on Their First Use

  D. Manually Inspect and Approve All IP Assignments Before Use

  Correct Answer: CD

• Question 35:

  An administrator wants to perform Activity Monitoring on a large group of virtual machines in an NSX

  environment.

  How would this task be accomplished with minimal administrative effort?

  A. Create a PowerCLI script to enable virtual machine data collection on each virtual machine.

  B. Create a security group in Service Composer and add the virtual machines to the security group.

  C. Add the virtual machines to the pre-defined Activity Monitoring security group in Service Composer.

  D. Add the virtual machines to a VM folder in vCenter Server and enable data collection.

  Correct Answer: C

• Question 36:

  An administrator has deployed NSX in an environment containing a mix of vSphere 5 hosts. The implementation includes the Distributed Firewall Service, but the administrator finds that rules are not being applied to all affected virtual machines.

  What two conditions would cause this behavior? (Choose two.)

  A. Some hosts have not been prepared for NSX.

  B. Only ESXi 5.5 and later hosts can push the rules to the virtual machines.

  C. Only ESXi 5.1 and later hosts can push the rules to the virtual machines.

  D. Some hosts are blocking the port used for rule distribution.

  Correct Answer: AC

• Question 37:

  If a Security Group is the Source for a General Logical Firewall Rule, which Virtual Machines will be affected by the rule?

  A. Each Virtual Machine defined in the Security Group.

  B. Each Virtual Machine defined in the Source and Destination fields of the Logical Firewall Rule.

  C. Each Virtual Machine identified in the Applied To field of the Logical Firewall Rule.

  D. Each Virtual Machine identified in the Destination field of the Logical Firewall Rule.

  Correct Answer: C

• Question 38:

  An administrator wishes to control traffic flow between two virtual machines. The virtual machines are in the same subnet, but are located on separate ESXi hosts. The administrator deploys an Edge Firewall to one of the hosts and verifies the default firewall rule is set to deny, but the two virtual machines can still communicate with each other.

  What task will correct this issue?

  A. Configure both ESXi host firewalls to deny traffic from the virtual machine on the other host.

  B. Deploy another Edge Firewall on the host running the second virtual machine.

  C. Remove any other firewall appliances that may exist on either of the ESXi hosts.

  D. Deploy a Distributed Firewall with firewall rules to prevent traffic between the virtual machines.

  Correct Answer: D

• Question 39:

  Which is not a valid Destination option for a General Logical Firewall rule?

  A. Datacenter

  B. Virtual App

  C. MAC Set

  D. Network

  Correct Answer: C

• Question 40:

  How are Logical Firewall rules applied to affected virtual machines?

  A. They are pushed by the NSX Controllers to all the ESXi hosts in the same Transport Zone.

  B. They are pushed by the NSX Manager to the ESXi hosts running the source and/or destination virtual machines.

  C. They are pushed by the NSX Controllers to the ESXi hosts running the destination virtual machines.

  D. They are pushed by the NSX Manager to all the ESXi hosts in the NSX environment.

  Correct Answer: B