2V0-71.23 Online Practice Questions and Answers

Correct Answer: C

Policies are one of the features of Tanzu Mission Control that allow you to manage the operation and security posture of your Kubernetes clusters and other organizational objects. Policies allow you to provide a set of rules that govern your

organization and all the objects it contains. The policy types available in Tanzu Mission Control include access policy, image registry policy, network policy, quota policy, security policy, and custom policy. Policies can be applied at the

individual, group, or organizational level to control access, image registries, networking, resource consumption, security context, and more18.

The other options are incorrect because:

Policies can be configured using a tag selector to restrict the scope of the policy is false. Policies can be configured using a label selector, not a tag selector, to include or exclude certain objects from the policy. A label is a key/value

pairattached to a Kubernetes object that allows you to specify identifying attributes for that object. A selector provides the means to identify the objects that have a given label18.

Policies can only be applied to clustergroups is false. Policies can be applied to various levels of the Tanzu Mission Control resource hierarchy, such as organization, cluster group, workspace, cluster, and namespace18. Policies can be

enforced using Kubernetes resources (NetworkPolicy, ResourceQuota etc) or using the Kyverno admission controller is false. Policies are enforced by Tanzu Mission Control using its own admission controller and webhook server. Kyverno is

an open-source policy engine for Kubernetes that is not related to Tanzu Mission Control.

References: Policy-Driven Cluster Management, [Kyverno]

Correct Answer: D

A tool that can be used to backup and restore workloads on clusters provisioned by the VMware Tanzu Kubernetes Grid Service is the Velero Plugin for VMware vSphere. The Velero Plugin for VMware vSphere is an extension of Velero, an open source tool that performs backup and restore of Kubernetes resources and persistent volumes5. The plugin leverages the snapshot capabilities of vSphere to create backups of Kubernetes workloads running on vSphere-managed infrastructure, such as VMware Cloud on AWS or VMware Cloud on Dell EMC5. The plugin also supports restoring backups to the same or different clusters, as well as migrating workloads across clusters5. References: Velero Plugin for VMware vSphere Documentation

Correct Answer: CE

VMware Tanzu Mission Control and Tanzu CLI package plugin are two methods that can be used to install Fluent Bit on a VMware Tanzu Kubernetes Grid cluster. VMware Tanzu Mission Control is a centralized management platform for Kubernetes clusters across different environments. It allows users to install Fluent Bit on any attached cluster from the web console or the CLI, and configure the output plugins for log forwarding. Tanzu CLI package plugin is a command-line tool that enables users to interact with VMware Tanzu packages and services. It allows users to install Fluent Bit from a package repository on any standalone management or workload cluster, and configure the output plugins for log forwarding. References: Install Fluent Bit for Log Forwarding - VMware Docs, Implement Log Forwarding with Fluent Bit - VMware Docs

Correct Answer: BE

Two valid options for obtaining kubectl config file in Tanzu Kubernetes environment are:

Download from vSphere UI: For Tanzu Kubernetes clusters that are deployed on vSphere with Tanzu, you can download the kubeconfig file from the vSphere UI by selecting the cluster and clicking on the Download kubeconfig button1. This

file contains the credentials and connection information for the cluster, which you can use to access it with kubectl1.

Access from VMware Tanzu Mission Control: For Tanzu Kubernetes clusters that are attached or provisioned by VMware Tanzu Mission Control, you can access the kubeconfig file from the Tanzu Mission Control console by selecting the

cluster and clicking on the Access this cluster button2. This will generate a YAML file that you can download and use to connect to the cluster with kubectl2. References: Download a Kubeconfig File for a Tanzu Kubernetes Cluster - VMware Docs, Connect to a Managed Cluster with kubectl - VMware Docs

Correct Answer: B

The Kubernetes RBAC API declares four kinds of Kubernetes object: Role, ClusterRole, RoleBinding and ClusterRoleBinding. These objects are used to define permissions and assign them to users or groups within a cluster. A Role or ClusterRole contains rulesthat represent a set of permissions on resources or non-resource endpoints. A RoleBinding or ClusterRoleBinding grants the permissions defined in a Role or ClusterRole to a set of subjects (users, groups, or service accounts). A RoleBinding applies only within a specific namespace, while a ClusterRoleBinding applies cluster-wide. The other options are incorrect because: CloudPolicyObject is not a valid Kubernetes object type. It might be confused with NetworkPolicy, which is an object type that defines how pods are allowed to communicate with each other and other network endpoints. Container type and Container object are not valid Kubernetes object types. They might be confused with Pod, which is an object type that represents a group of one or more containers running on a node. ClusterObject and ClusterNode are not valid Kubernetes object types. They might be confused with Cluster and Node, which are concepts that describe the logical and physical components of a Kubernetes cluster. References: Using RBAC Authorization, Kubernetes RBAC: Concepts, Examples and Top Misconfigurations

Correct Answer: A

To register the vSphere management cluster in VMware Tanzu Mission Control, an administrator can use either the web console or the CLI of VMware Tanzu Mission Control. The web console provides a graphical user interface to perform the registration, while the CLI provides a command-line interface to run a script that automates the registration process. Both methods require the administrator to have access to the vSphere management cluster and to provide some information such as the cluster name, context, and namespace. The registration process creates a service account and a secret in the vSphere management cluster, and generates a kubeconfig file that is used by VMware Tanzu Mission Control to connect to the cluster. References: VMware Tanzu Mission Control Documentation, Registering a vSphere Management Cluster

Correct Answer: C

The type of policy that can be used to enforce the container controls is image security. Image security policies allow users to define rules for validating container images before they are deployed on clusters. Users can specify image names, tags, signatures, or digests to whitelist or blacklist images based on their source and integrity. Users can also enable or disable image scanning for vulnerabilities and configure the severity threshold for admission decisions. References: Image Security Policy - VMware Docs, Image Policy - VMware Docs

Correct Answer: B

The Scheduler is the Kubernetes component that is responsible for workload creation. The Scheduler is responsible for assigning pods to nodes based on various factors, such as resource availability, node affinity, taints and tolerations, and pod priority. The Scheduler watches for newly created pods that have no node assigned, and selects a suitable node for them to run on. The Scheduler then informs the API server of its decision, and the API server binds the pod to the node. References: Scheduling | Kubernetes, Kubernetes Components | Kubernetes