2V0-71.23 Exam Questions & Answers

Correct Answer: BE

VMware Tanzu Kubernetes Grid supports StorageClass objects for different storage types, provisioned by Kubernetes internal ("in-tree") or external ("out-of-tree") plug- ins. Two of the supported storage types are vSphere Cloud Native Storage (CNS) and Amazon EBS. vSphere Cloud Native Storage (CNS) is a vSphere feature that provides persistent storage for Kubernetes clusters running on vSphere 6.7 or later. CNS integrates with the vSphere Container Storage Interface (CSI) driver to dynamically provision persistent volumes backed by First Class Disks on a datastore1. Amazon EBS is a block storage service that provides persistent storage for Amazon EC2 instances. EBS volumes can be attached to EC2 instances as block devices, and can be used to create persistent volumes for Kubernetes clusters running on AWS2. Both CNS and EBS support dynamic provisioning of persistent volumes using StorageClass objects with the provisioner field set to csi.vsphere.vmware.com and kubernetes.io/aws-ebs respectively12. References: Back Up and Restore Cluster Workloads - VMware Docs, Amazon Elastic Block Store (EBS) - Amazon Web Services

Correct Answer: A

The purpose of setting ENABLE_AUDIT_LOGGING=true during a cluster deployment is to log metadata about all requests made to the Kubernetes API server. This enables auditing of the cluster activities and helps with security and compliance. The audit logs are stored in /var/log/kubernetes/audit.log on the control plane node and can be accessed by the cluster administrator. The audit logs are generated based on an audit policy file that defines what events should be recorded and what data they should include12 References: 1: https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/1.6/vmware- tanzu-kubernetes-grid-16/GUID-troubleshooting-tkg-audit-logging.html 2: https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/

Correct Answer: AB

To visualize API connectivity and enable API protection in VMware Tanzu Service Mesh, the administrator needs to perform two steps: Activate API Discovery for the Global Namespace. This allows Tanzu Service Mesh to automatically discover the APIs signatures between microservices running inside or outside the mesh. API Discovery creates a custom API schema for each API that is close to OpenAPI spec 3.0. Tanzu Service Mesh graph renders the detected APIs in the Enforcing mode by default, which means that any new API is considered as a violated API unless accepted by the administrator1 Create API Security Policy for the Global Namespace. This allows the administrator to block or allow layer 4 and layer 7 traffic, as well as create granular policies that provide API and data segmentation, OWASP 10 attack defense, schema validation, geofencing, data compliance, and egress controls. The administrator can create the API Security policy through the Tanzu Service Mesh Console UI or by using the Tanzu Service Mesh API Explorer2 References: 1: https:// docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu- service-mesh-enterprise/GUID-E6FB9FB3-FDB3-4D2B-B5CB-614608EEF537.html 2: https://docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu-service-mesh- enterprise/GUID-5B635420-3BD2-4EC1-B67E-2015F991A91C.html