VMware 2V0-71.23 Online Practice Questions and Exam Preparation

VMware 2V0-71.23 Online Questions & Answers

• Question 11:

  Which two resources can External DNS create records for? (Choose two.)

  A. Virtual machines
  B. Kubernetes pods
  C. Kubernetes services
  D. Kubernetes nodes
  E. Contour HTTP Proxy
  C. Kubernetes services
  E. Contour HTTP Proxy

  ---

  Explanation/Reference:

  Kubernetes services and Contour HTTP Proxy are two resources that External DNS can create records for. External DNS is a Kubernetes controller that synchronizes exposed Kubernetes resources with DNS providers. It supports creating DNS records for Kubernetes services of type LoadBalancer or NodePort, as well as Ingress resources. Contour HTTP Proxy is a custom resource definition (CRD) that provides an alternative way to configure HTTP routes on Kubernetes clusters. External DNS can also create DNS records for Contour HTTP Proxy resources, as long as they have an associated service of type LoadBalancer or NodePort. References: kubernetes- sigs/external-dns - GitHub, Contour HTTPProxy User Guide

• Question 12:

  What is the correct resource hierarchy order in VMware Tanzu Mission Control?

  A. Root -> Cluster Groups -> Clusters
  B. Organization -> Cluster Groups -> Namespaces
  C. Organization -> Clusters -> Cluster Groups
  D. Organization -> Cluster Groups -> Clusters
  D. Organization -> Cluster Groups -> Clusters

  ---

  Explanation/Reference:

  The correct resource hierarchy order in VMware Tanzu Mission Control is Organization -> Cluster Groups -> Clusters. An organization is the root of the resource hierarchy and represents a customer account in Tanzu Mission Control. A cluster group is a logical grouping of clusters that can be used to apply policies and manage access. A cluster is a Kubernetes cluster that can be attached or provisioned by Tanzu Mission Control. A cluster belongs to one and only one cluster group, and a cluster group belongs to one and only one organization. References: VMware Tanzu Mission Control Concepts, Resource Hierarchy

• Question 13:

  Which component must be installed upfront to deploy VMware Tanzu Kubernetes Grid management cluster?

  A. Tanzu CLI
  B. Cluster API
  C. Kubeadm
  D. External DNS
  A. Tanzu CLI

  ---

  Explanation/Reference:

  The Tanzu CLI is a command-line tool that enables users to interact with VMware Tanzu products and services. It must be installed upfront to deploy VMware Tanzu Kubernetes Grid management cluster, as it provides commands to create, configure, scale, upgrade, and delete management clusters on different platforms. The Tanzu CLI also allows users to create workload clusters from the management cluster, and to perform various operations on both types of clusters. References: VMware Tanzu CLI Documentation, [Deploying Management Clusters with the Tanzu CLI]

• Question 14:

  An administrator was requested to create a pod with two interfaces to separate the application and management traffic for security reasons.

  Which two packages have to be installed in VMware Tanzu Kubernetes Grid cluster to satisfy the requirement? (Choose two.)

  A. multus
  B. external-dns
  C. cert-manager
  D. qrafana
  E. contour
  A. multus
  E. contour

  ---

  Explanation/Reference:

  Multus is an open-source container network interface plugin for Kubernetes that enables attaching multiple network interfaces to pods. Contour is an open-source Kubernetes ingress controller that provides dynamic configuration updates and makes use of the Envoy proxy as a data plane. By installing these two packages in a VMware Tanzu Kubernetes Grid cluster, an administrator can create a pod with two interfaces and use Contour to route the application and management traffic to different networks. The other options are incorrect because: external-dns is a package that synchronizes exposed Kubernetes services and ingresses with DNS providers. It does not provide multiple interfaces for pods. cert-manager is a package that automates the management and issuance of TLS certificates from various sources. It does not provide multiple interfaces for pods. qrafana is not a valid package name. The correct spelling is Grafana, which is a package that provides visualization and analytics for metrics collected by Prometheus. It does not provide multiple interfaces for pods. References: Install Multus and Whereabouts for Container Networking, Install Contour for Ingress

• Question 15:

  Which two statements about the NSX Advanced Load Balancer are correct? (Choose two.)

  A. It can only be used if Antrea CNI is installed on the workload cluster.
  B. It can be configured as the VIP endpoint for the management cluster on vSphere.
  C. It only supports the service type LoadBalancer.
  D. It is natively integrated with Tanzu Kubernetes Grid Amazon Web Services EC2 deployments.
  E. It can be configured as a load balancer for workloads in the clusters that are deployed on vSphere.
  B. It can be configured as the VIP endpoint for the management cluster on vSphere.
  E. It can be configured as a load balancer for workloads in the clusters that are deployed on vSphere.

  ---

  Explanation/Reference:

  Two statements about the NSX Advanced Load Balancer are correct: It can be configured as the VIP endpoint for the management cluster on vSphere. The VIP endpoint is the IP address that clients use to access the Kubernetes API server on the management cluster. By default, this IP address is assigned by DHCP, but it can also be configured manually or by using a load balancer. Using a load balancer provides high availability and scalability for the VIP endpoint. NSX Advanced Load Balancer can be used as the load balancer provider for the VIP endpoint by creating a virtual service that points to the control plane nodes of the management cluster5. It can be configured as a load balancer for workloads in the clusters that are deployed on vSphere. Workload clusters are Kubernetes clusters that run user workloads on vSphere with Tanzu. Workload clusters require a load balancer to expose services of type LoadBalancer to external clients. NSX Advanced Load Balancer can be used as the load balancer provider for workload clusters by deploying an Avi Kubernetes Service (AKS) pod on each cluster node. The AKS pod acts as an ingress controller that communicates with the NSX Advanced Load Balancer Controller and creates virtual services for each service of type LoadBalancer6. The other options are incorrect because: It can only be used if Antrea CNI is installed on the workload cluster is false. Antrea is one of the supported Container Network Interface (CNI) plugins for workload clusters on vSphere with Tanzu, but it is not mandatory to use it with NSX Advanced Load Balancer. Other CNI plugins, such as Calico or Flannel, can also work with NSX Advanced Load Balancer7. It only supports the service type LoadBalancer is false. NSX Advanced Load Balancer supports other service types as well, such as ClusterIP and NodePort. These service types can be used to expose services within or across clusters without requiring an external load balancer8. It is natively integrated with Tanzu Kubernetes Grid Amazon Web Services EC2 deployments is false. NSX Advanced Load Balancer is not natively integrated with Tanzu Kubernetes Grid Amazon Web Services EC2 deployments. Tanzu Kubernetes Grid on AWS uses the AWS Elastic Load Balancing service as the default load balancer provider for both management and workload clusters9. References: Configure the VIP Endpoint for the Management Cluster, Deploy and Configure NSX Advanced Load Balancer as a Load Balancer for Workload Clusters, Supported CNI Plugins, Service Types, Load Balancing on AWS

• Question 16:

  Which kinds of objects does the Kubernetes RBAC API declare?

  A. CloudPolicyObject
  B. Role, ClusterRole, RoleBinding and ClusterRoleBinding
  C. Container type and Container object
  D. ClusterObject and ClusterNode
  B. Role, ClusterRole, RoleBinding and ClusterRoleBinding

  ---

  Explanation/Reference:

  The Kubernetes RBAC API declares four kinds of Kubernetes object: Role, ClusterRole, RoleBinding and ClusterRoleBinding. These objects are used to define permissions and assign them to users or groups within a cluster. A Role or ClusterRole contains rulesthat represent a set of permissions on resources or non-resource endpoints. A RoleBinding or ClusterRoleBinding grants the permissions defined in a Role or ClusterRole to a set of subjects (users, groups, or service accounts). A RoleBinding applies only within a specific namespace, while a ClusterRoleBinding applies cluster-wide. The other options are incorrect because: CloudPolicyObject is not a valid Kubernetes object type. It might be confused with NetworkPolicy, which is an object type that defines how pods are allowed to communicate with each other and other network endpoints. Container type and Container object are not valid Kubernetes object types. They might be confused with Pod, which is an object type that represents a group of one or more containers running on a node. ClusterObject and ClusterNode are not valid Kubernetes object types. They might be confused with Cluster and Node, which are concepts that describe the logical and physical components of a Kubernetes cluster. References: Using RBAC Authorization, Kubernetes RBAC: Concepts, Examples and Top Misconfigurations

• Question 17:

  Which Container Network Interface (CNI) is selected by default in a VMware Tanzu Kubernetes Grid workload cluster?

  A. Multus CNI
  B. Antrea
  C. Flannel
  D. Calico
  A. Multus CNI
  B. Antrea
  C. Flannel

  ---

  data plane9. Antrea supports various features such as network policies, service load balancing, NodePortLocal, IPsec encryption, IPv6 dual-stack, and more10.

  The other options are incorrect because:

  Multus CNI is an open-source container network interface plugin for Kubernetes that enables attaching multiple network interfaces to pods11. It is not the default CNI for Tanzu Kubernetes Grid workload clusters. Flannel is an open-source

  simple and easy-to-use overlay network that satisfies the Kubernetes requirements12. It is not the default CNI for Tanzu Kubernetes Grid workload clusters.

  Calico is an open-source network and network security solution for containers, virtual machines, and native host-based workloads13. It is not the default CNI for Tanzu Kubernetes Grid workload clusters.

  References: Tanzu Kubernetes Grid Cluster Networking, Antrea, Antrea Features, Multus CNI, Flannel, Calico

• Question 18:

  Which statement correctly describes the Cluster API?

  A. It is a specialized toolset to bring declarative, Kubernetes-style APIs to cluster creation, configuration, and management in the Kubernetes ecosystem.
  B. It enables pod networking and enforces network Kubernetes policies.
  C. It is responsible for scanning language-specific packages in container images, such as Java, Python, Go, and others.
  D. It is a native Kubernetes certificate management controller that adds certificates and certificate issuers as resource types in Kubernetes clusters.
  A. It is a specialized toolset to bring declarative, Kubernetes-style APIs to cluster creation, configuration, and management in the Kubernetes ecosystem.

  ---

  Explanation/Reference:

  The statement that correctly describes the Cluster API is that it is a specialized toolset to bring declarative, Kubernetes-style APIs to cluster creation, configuration, and management in theKubernetes ecosystem. Cluster API is a Kubernetes sub-project that provides declarative APIs and tooling to simplify provisioning, upgrading, and operating multiple Kubernetes clusters5. Cluster API uses a set of custom resource definitions (CRDs) to represent clusters, machines, and other objects. Cluster API also relies on providers to implement the logic for interacting with different infrastructure platforms5. References: Introduction - The Cluster API Book

• Question 19:

  Which statement describes how VMware Tanzu Mission Control and VMware Aria Operations for Applications integrate?

  A. An administrator can enable VMware Aria Operations for Applications usingthe integrations tab in VMware Tanzu Mission Control.
  B. VMware Aria Operations for Applications is enabled by default in VMware Tanzu Mission Control. No integration is required.
  C. An administrator can login to VMware Aria Operations for Applications and enable VMware Tanzu Mission Control integration from the administration menu.
  D. An administrator can download and install the VMware Aria Operations Observations agent from Tanzu CLI.
  A. An administrator can enable VMware Aria Operations for Applications usingthe integrations tab in VMware Tanzu Mission Control.

  ---

  Explanation/Reference:

  VMware Aria Operations for Applications is a SaaS solution that provides observability for modern applications across multiple clouds and platforms. It collects and analyzes traces, metrics, and logs from various sources, including Tanzu

  Kubernetes Grid clusters managed by Tanzu Mission Control. To enable the integration between VMware Aria Operations for Applications and Tanzu Mission Control, an administrator can use the integrations tab in Tanzu Mission Control UI

  and follow the steps to configure the connection.

  The other options are incorrect because:

  VMware Aria Operations for Applications is not enabled by default in Tanzu Mission Control. An administrator has to explicitly enable the integration and provide the required credentials and settings.

  An administrator cannot login to VMware Aria Operations for Applications and enable Tanzu Mission Control integration from the administration menu. The integration has to be initiated from Tanzu Mission Control UI. An administrator cannot

  download and install the VMware Aria Operations Observations agent from Tanzu CLI. The Observations agent is automatically installed on the clusters managed by Tanzu Mission Control once the integration is enabled.

  References: Configure Integration with Tanzu Mission Control, Introducing the Tanzu Mission Control Integration for VMware Aria Automation

• Question 20:

  A Tanzu Mission Control administrator would like to enforce the following container controls:

  1.

  Only allows container images that match the specified names or tags.

  2.

  Ensure that the container image is not tampered with.

  Which type of policy can be used?

  A. Access
  B. Security
  C. Image Security
  D. Image Registry
  E. Network
  C. Image Security

  ---

  Explanation/Reference:

  The type of policy that can be used to enforce the container controls is image security. Image security policies allow users to define rules for validating container images before they are deployed on clusters. Users can specify image names, tags, signatures, or digests to whitelist or blacklist images based on their source and integrity. Users can also enable or disable image scanning for vulnerabilities and configure the severity threshold for admission decisions. References: Image Security Policy - VMware Docs, Image Policy - VMware Docs