2V0-71.23 Online Practice Questions and Answers

Correct Answer: AE

Multus is an open-source container network interface plugin for Kubernetes that enables attaching multiple network interfaces to pods. Contour is an open-source Kubernetes ingress controller that provides dynamic configuration updates and makes use of the Envoy proxy as a data plane. By installing these two packages in a VMware Tanzu Kubernetes Grid cluster, an administrator can create a pod with two interfaces and use Contour to route the application and management traffic to different networks. The other options are incorrect because: external-dns is a package that synchronizes exposed Kubernetes services and ingresses with DNS providers. It does not provide multiple interfaces for pods. cert-manager is a package that automates the management and issuance of TLS certificates from various sources. It does not provide multiple interfaces for pods. qrafana is not a valid package name. The correct spelling is Grafana, which is a package that provides visualization and analytics for metrics collected by Prometheus. It does not provide multiple interfaces for pods. References: Install Multus and Whereabouts for Container Networking, Install Contour for Ingress

Correct Answer: B

A NetworkPolicy is a Kubernetes object that controls what traffic is allowed to and from selected pods and network endpoints6. NetworkPolicy objects contain the following information:

The pods that are affected by this policy (the pod selector) The traffic that is allowed for these pods (the ingress and egress rules) The network entities that are allowed or denied for this traffic (the selectors and IP blocks)

By default, all pods in a cluster can communicate with each other and with any external network endpoint. A NetworkPolicy allows you to restrict this behavior by defining rules for pod isolation and network access. A NetworkPolicy is enforced

by a network plugin that supports it6.

The other options are incorrect because:

An Ingress is a Kubernetes object that manages external access to services in a cluster, typically HTTP7. It does not control what traffic is allowed to and from selected pods and network endpoints.

A PodSecurityPolicy is a Kubernetes object that controls security-sensitive aspects of pod specification, such as running as privileged or using host networking8. It does not control what traffic is allowed to and from selected pods and network

endpoints.

A Secret is a Kubernetes object that stores sensitive information, such as passwords or keys, in an encrypted form9. It does not control what traffic is allowed to and from selected pods and network endpoints. References: Network Policies,

Ingress, Pod Security Policies, Secrets

Correct Answer: D

The set of tools that can be used to attach a Kubernetes cluster to VMware Tanzu Mission Control are kubectl and VMware Tanzu Mission Control Web Ul. kubectl is a command-line tool that allows users to interact with Kubernetes clusters. VMware Tanzu Mission Control Web Ul is a graphical user interface that allows users to manage their clusters and policies. To attach a cluster, users need to use both tools. First, they need to use the web console to select the cluster group and generate a YAML manifest for the cluster. Then, they need to use kubectl to apply the manifest on the cluster and install the cluster agent extensions that enable communication with Tanzu Mission Control. References: Attach a Cluster -VMware Docs, What Happens When You Attach a Cluster

Correct Answer: C

To create a vSphere Namespace, the correct steps are to use the vSphere web client, select Workload Management, select Namespaces tab, and click Create Namespace. A vSphere Namespace is a logical grouping of Kubernetes resources that can be used to isolate and manage workloads on a Supervisor Cluster1. To create a vSphere Namespace, a user needs to have the vSphere Client and the required privileges to access the Workload Management menu and the Namespaces tab2. From there, the user can select the Supervisor Cluster where to place the namespace, enter a name for the namespace, configure the network settings, set the resource limits, assign permissions, and enable services for the namespace2. References: Create and Configure a vSphere Namespace - VMware Docs, vSphere with Tanzu Concepts - VMware Docs

Correct Answer: CD

Two services that require Transport Layer Security (TLS) certificates to provide encryption in VMware Tanzu Service Mesh are:

Certificate Authority (CA) Service: A service that issues certificates to services in the service mesh to enable mutual TLS (mTLS) communication between them. The CA service uses a root certificate to sign the certificates for the services,

and verifies the identity of the services using the certificates. The CA service also rotates the certificates periodically to ensure security8. Public Service: A service that exposes an internal service in the service mesh to external clients over

HTTPS. The public service uses a TLS certificate to encrypt the traffic between the external clients and the internal service, and to authenticate itself to the clients. The TLS certificate must match the domain name of the public service9.

The other options are incorrect because:

Internal Service: A service that runs inside the service mesh and communicates with other services using mTLS. The internal service does not require a TLS certificate, but rather uses a certificate issued by the CA service to enable mTLS10.

Proxy Service: A service that acts as an intermediary between an internal service and an external service, such as a database or an API. The proxy service does not require a TLS certificate, but rather uses a certificate issued by the CA

service to enable mTLS with the internal service. The proxy service also uses the external service's certificate to verify its identity11.

External Service: A service that runs outside the service mesh and communicates with an internal service over HTTPS or TCP. The external service does not require a TLS certificate from Tanzu Service Mesh, but rather uses its own

certificate to encrypt the traffic with the internal service, and to authenticate itself to the internal service.

References: Certificate Authority (CA) Service, Public Services, Internal Services, Proxy Services,

Correct Answer: ACEF

Four policy types that are supported by VMware Tanzu Mission Control are:

Security policy: Security policies allow you to manage the security context in which deployed pods operate in your clusters by imposing constraints on your clusters that define what pods can do and which resources they have access to6.

Access policy: Access policies allow you to use predefined roles to specify which identities (individuals and groups) have what level of access to a given resource7. Network policy: Network policies allow you to use preconfigured templates to

define how pods communicate with each other and other network endpoints8. Custom policy: Custom policies allow you to implement additional business rules, using templates that you define, to enforce policies that are not already

addressed using the other built-in policy types9.

References: Policy-Driven Cluster Management - VMware Docs

Correct Answer: B

The tanzu mc upgrade command is used to upgrade a management cluster to a newer version of Tanzu Kubernetes Grid. The command requires the name of the management cluster as an argument, and optionally the version to upgrade to.

For example, toupgrade the management cluster named tanzu-mc01 to version v1.4.0, the command would be:

tanzu mc upgrade tanzu-mc01 --version v1.4.0

The other options are incorrect because:

kubectl management-cluster upgrade is not a valid command. The kubectl command is used to interact with Kubernetes clusters, not to upgrade them.

tanzu config use-context tanzu-mc01-admin@tanzu-mc01 is a command to switch the current context to the admin context of the management cluster named tanzu- mc01. It does not upgrade the cluster.

kubectl tanzu-mc01 upgrade is not a valid command. The kubectl command does not accept a cluster name as an argument, and there is no upgrade subcommand. References: VMware Tanzu for Kubernetes Operations Getting Started,

Upgrading Management Clusters

Correct Answer: BEF

Cluster API is a Kubernetes project that provides declarative APIs for cluster creation, configuration, and management. Cluster API uses a set of custom resource definitions (CRDs) to represent clusters, machines, and other objects. Cluster API also relies on providers to implement the logic for interacting with different infrastructure platforms. VMware Tanzu Kubernetes Grid uses Cluster API to deploy and manage Kubernetes clusters on various platforms. The three Cluster API providers being used in VMware Tanzu Kubernetes Grid are: CAPZ: Cluster API Provider for Azure. This provider enables Cluster API to create Kubernetes clusters on Microsoft Azure4. CAPV: Cluster API Provider for vSphere. This provider enables Cluster API to create Kubernetes clusters on vSphere 6.7 or later5. CAPA: Cluster API Provider for AWS. This provider enables Cluster API to create Kubernetes clusters on Amazon Web Services5. References: VMware Tanzu Kubernetes Grid Documentation, Taking Kubernetes to the People: How Cluster API Promotes Self ... - VMware

Correct Answer: C

Contour is an open-source Kubernetes ingress controller that provides dynamic configuration updates and makes use of the Envoy proxy as a data plane1. Envoy is an open-source edge and service proxy that can handle large volumes of

network traffic between services in a cloud-native environment2. Contour leverages Envoy's advanced features such as load balancing, health checking, dynamic service discovery, circuit breaking, rate limiting, and more3. Contour also

integrates with Envoy's external authorization filter to support external authentication and authorization providers4.

The other options are incorrect because:

NSX Load Balancer is a VMware solution that provides L4 and L7 load balancing and ingress control for Kubernetes clusters5. It is not the data plane for Contour. Istio is an open-source service mesh that provides a uniform way to connect,

secure, control, and observe services in a distributed system6. It is not the data plane for Contour.

Prometheus is an open-source systems monitoring and alerting toolkit that can collect metrics from various sources, including Kubernetes clusters7. It is not the data plane for Contour.

References: Contour Overview, Envoy Overview, Contour Architecture, External Authorization Support, NSX Advanced Load Balancer, Istio Overview, Prometheus Overview

Correct Answer: B

The Scheduler is the Kubernetes component that is responsible for workload creation. The Scheduler is responsible for assigning pods to nodes based on various factors, such as resource availability, node affinity, taints and tolerations, and pod priority. The Scheduler watches for newly created pods that have no node assigned, and selects a suitable node for them to run on. The Scheduler then informs the API server of its decision, and the API server binds the pod to the node. References: Scheduling | Kubernetes, Kubernetes Components | Kubernetes