2V0-71.23 Online Practice Questions and Answers

Correct Answer: A

The Tanzu CLI is a command-line tool that enables users to interact with VMware Tanzu products and services. It must be installed upfront to deploy VMware Tanzu Kubernetes Grid management cluster, as it provides commands to create, configure, scale, upgrade, and delete management clusters on different platforms. The Tanzu CLI also allows users to create workload clusters from the management cluster, and to perform various operations on both types of clusters. References: VMware Tanzu CLI Documentation, [Deploying Management Clusters with the Tanzu CLI]

Correct Answer: C

Policies are one of the features of Tanzu Mission Control that allow you to manage the operation and security posture of your Kubernetes clusters and other organizational objects. Policies allow you to provide a set of rules that govern your

organization and all the objects it contains. The policy types available in Tanzu Mission Control include access policy, image registry policy, network policy, quota policy, security policy, and custom policy. Policies can be applied at the

individual, group, or organizational level to control access, image registries, networking, resource consumption, security context, and more18.

The other options are incorrect because:

Policies can be configured using a tag selector to restrict the scope of the policy is false. Policies can be configured using a label selector, not a tag selector, to include or exclude certain objects from the policy. A label is a key/value

pairattached to a Kubernetes object that allows you to specify identifying attributes for that object. A selector provides the means to identify the objects that have a given label18.

Policies can only be applied to clustergroups is false. Policies can be applied to various levels of the Tanzu Mission Control resource hierarchy, such as organization, cluster group, workspace, cluster, and namespace18. Policies can be

enforced using Kubernetes resources (NetworkPolicy, ResourceQuota etc) or using the Kyverno admission controller is false. Policies are enforced by Tanzu Mission Control using its own admission controller and webhook server. Kyverno is

an open-source policy engine for Kubernetes that is not related to Tanzu Mission Control.

References: Policy-Driven Cluster Management, [Kyverno]

Correct Answer: CE

Two configurations that are valid for Zonal Supervisor Deployment are three- zone and one-zone. A Zonal Supervisor Deployment is a way of deploying the vSphere with Tanzu Supervisor Cluster across multiple vSphere clusters that are mapped to vSphere Zones1. A vSphere Zone is a logical grouping of vSphere clusters that share common characteristics, such as network connectivity, power source, or physical location2. A Zonal Supervisor Deployment provides high availability and fault tolerance for Kubernetes workloads by distributing them across different zones1. The supported configurations for Zonal Supervisor Deployment are: Three-zone: The Supervisor Cluster spans three vSphere clusters, each mapped to a different vSphere Zone. This configuration provides the highest level of availability and fault tolerance, as it can tolerate the failure of any one zone1. One-zone: The Supervisor Cluster runs on a single vSphere cluster that is mapped to a single vSphere Zone. This configuration is suitable for development or testing purposes, but does not provide any availability or fault tolerance guarantees1. References: Requirements for Zonal Supervisor Deployment - VMware Docs, Create vSphere Zones for a Multi-Zone Supervisor Deployment - VMware Docs

Correct Answer: B

A prerequisite for cert-manager installation is to obtain the admin credentials of the target workload cluster. Cert-manager is a tool that automates the management and issuance of TLS certificates within Kubernetes clusters3. To install cert-manager, users need to have access to the cluster where they want to deploy it, and have the necessary permissions to create resources such as namespaces, custom resource definitions, deployments, services, and secrets3. Users can obtain the admin credentials of the target workload cluster by using the tanzu cluster kubeconfig get command with the --admin option4. This command generates a kubeconfig file that contains the admin credentials for the cluster, which can be used to authenticate with the cluster and perform cert-manager installation4. References: Installation - cert-manager Documentation, Deploy Workload Clusters - VMware Docs

Correct Answer: AE

Node groups and service groups are two kinds of resource groups that can be created to collect and manage objects in VMware Tanzu Service Mesh. A resource group is a collection of cluster resources of a specific type that share specific characteristics. Resource groups help enforce policies and monitor the performance of resources in a single global namespace or across your entire organization7. A node group collects nodes that meet certain criteria, such as running in a specific region or having certain labels. A service group collects services that meet certain criteria, such as having a specific name prefix or belonging to a specific namespace. The other options are incorrect because: Cluster groups are not a valid kind of resource group in VMware Tanzu Service Mesh. Clusters are not considered as resources in Tanzu Service Mesh. Security groups are not a valid kind of resource group in VMware Tanzu Service Mesh. Security groups are used to define network access rules for resources in some cloud platforms8, but they are not part of Tanzu Service Mesh. API groups are not a valid kind of resource group in VMware Tanzu Service Mesh. API groups are used to organize Kubernetes resources into categories based on their API versions9, but they are not part of Tanzu Service Mesh. References: Resource Groups, Security Groups, API Groups

Correct Answer: B

The tanzu mc upgrade command is used to upgrade a management cluster to a newer version of Tanzu Kubernetes Grid. The command requires the name of the management cluster as an argument, and optionally the version to upgrade to.

For example, toupgrade the management cluster named tanzu-mc01 to version v1.4.0, the command would be:

tanzu mc upgrade tanzu-mc01 --version v1.4.0

The other options are incorrect because:

kubectl management-cluster upgrade is not a valid command. The kubectl command is used to interact with Kubernetes clusters, not to upgrade them.

tanzu config use-context tanzu-mc01-admin@tanzu-mc01 is a command to switch the current context to the admin context of the management cluster named tanzu- mc01. It does not upgrade the cluster.

kubectl tanzu-mc01 upgrade is not a valid command. The kubectl command does not accept a cluster name as an argument, and there is no upgrade subcommand. References: VMware Tanzu for Kubernetes Operations Getting Started,

Upgrading Management Clusters

Correct Answer: B

The Kubernetes RBAC API declares four kinds of Kubernetes object: Role, ClusterRole, RoleBinding and ClusterRoleBinding. These objects are used to define permissions and assign them to users or groups within a cluster. A Role or ClusterRole contains rulesthat represent a set of permissions on resources or non-resource endpoints. A RoleBinding or ClusterRoleBinding grants the permissions defined in a Role or ClusterRole to a set of subjects (users, groups, or service accounts). A RoleBinding applies only within a specific namespace, while a ClusterRoleBinding applies cluster-wide. The other options are incorrect because: CloudPolicyObject is not a valid Kubernetes object type. It might be confused with NetworkPolicy, which is an object type that defines how pods are allowed to communicate with each other and other network endpoints. Container type and Container object are not valid Kubernetes object types. They might be confused with Pod, which is an object type that represents a group of one or more containers running on a node. ClusterObject and ClusterNode are not valid Kubernetes object types. They might be confused with Cluster and Node, which are concepts that describe the logical and physical components of a Kubernetes cluster. References: Using RBAC Authorization, Kubernetes RBAC: Concepts, Examples and Top Misconfigurations

Correct Answer: AB

To visualize API connectivity and enable API protection in VMware Tanzu Service Mesh, the administrator needs to perform two steps: Activate API Discovery for the Global Namespace. This allows Tanzu Service Mesh to automatically discover the APIs signatures between microservices running inside or outside the mesh. API Discovery creates a custom API schema for each API that is close to OpenAPI spec 3.0. Tanzu Service Mesh graph renders the detected APIs in the Enforcing mode by default, which means that any new API is considered as a violated API unless accepted by the administrator1 Create API Security Policy for the Global Namespace. This allows the administrator to block or allow layer 4 and layer 7 traffic, as well as create granular policies that provide API and data segmentation, OWASP 10 attack defense, schema validation, geofencing, data compliance, and egress controls. The administrator can create the API Security policy through the Tanzu Service Mesh Console UI or by using the Tanzu Service Mesh API Explorer2 References: 1: https:// docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu- service-mesh-enterprise/GUID-E6FB9FB3-FDB3-4D2B-B5CB-614608EEF537.html 2: https://docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu-service-mesh- enterprise/GUID-5B635420-3BD2-4EC1-B67E-2015F991A91C.html

Correct Answer: BE

Two statements about the NSX Advanced Load Balancer are correct: It can be configured as the VIP endpoint for the management cluster on vSphere. The VIP endpoint is the IP address that clients use to access the Kubernetes API server on the management cluster. By default, this IP address is assigned by DHCP, but it can also be configured manually or by using a load balancer. Using a load balancer provides high availability and scalability for the VIP endpoint. NSX Advanced Load Balancer can be used as the load balancer provider for the VIP endpoint by creating a virtual service that points to the control plane nodes of the management cluster5. It can be configured as a load balancer for workloads in the clusters that are deployed on vSphere. Workload clusters are Kubernetes clusters that run user workloads on vSphere with Tanzu. Workload clusters require a load balancer to expose services of type LoadBalancer to external clients. NSX Advanced Load Balancer can be used as the load balancer provider for workload clusters by deploying an Avi Kubernetes Service (AKS) pod on each cluster node. The AKS pod acts as an ingress controller that communicates with the NSX Advanced Load Balancer Controller and creates virtual services for each service of type LoadBalancer6. The other options are incorrect because: It can only be used if Antrea CNI is installed on the workload cluster is false. Antrea is one of the supported Container Network Interface (CNI) plugins for workload clusters on vSphere with Tanzu, but it is not mandatory to use it with NSX Advanced Load Balancer. Other CNI plugins, such as Calico or Flannel, can also work with NSX Advanced Load Balancer7. It only supports the service type LoadBalancer is false. NSX Advanced Load Balancer supports other service types as well, such as ClusterIP and NodePort. These service types can be used to expose services within or across clusters without requiring an external load balancer8. It is natively integrated with Tanzu Kubernetes Grid Amazon Web Services EC2 deployments is false. NSX Advanced Load Balancer is not natively integrated with Tanzu Kubernetes Grid Amazon Web Services EC2 deployments. Tanzu Kubernetes Grid on AWS uses the AWS Elastic Load Balancing service as the default load balancer provider for both management and workload clusters9. References: Configure the VIP Endpoint for the Management Cluster, Deploy and Configure NSX Advanced Load Balancer as a Load Balancer for Workload Clusters, Supported CNI Plugins, Service Types, Load Balancing on AWS

Correct Answer: B

The Kubernetes project that vSphere with Tanzu Supervisor Cluster uses to automate the lifecycle management of Tanzu Kubernetes Grid Clusters is Cluster API. Cluster API is a Kubernetes project that provides declarative APIs for cluster creation, configuration, and management. Cluster API uses a set of custom resource definitions (CRDs) to represent clusters, machines, and other objects. Cluster API also relies on providers to implement the logic for interacting with different infrastructure platforms5. vSphere with Tanzu Supervisor Cluster uses Cluster API to deploy and manage Kubernetes clusters on vSphere 7 across multiple vCenter Server instances and/or multiple data centers via Tanzu Mission Control6. References: Taking Kubernetes to the People: How Cluster API Promotes Self ... - VMware, kubernetes-sigs/cluster-api - GitHub