Correct Answer: B

vSphere with Tanzu storage policies are converted to storage classes when they are assigned to namespaces. A storage class is a Kubernetes object that defines a set of parameters for provisioning persistent volumes1. A storage policy is a vSphere object that defines thecharacteristics of the underlying storage for a given workload2. When a vSphere administrator assigns a storage policy to a namespace, vSphere with Tanzu automatically creates a corresponding storage class in the namespace with the same name as the storage policy3. The storage class references the storage policy ID and allows DevOps engineers to use the storage policy for dynamic provisioning of persistent volumes3. References: Storage Classes - Kubernetes, Create Storage Policies for vSphere with Tanzu - VMware Docs, Assign Storage Policies to Namespaces - VMware Docs

Correct Answer: C

The statement that correctly describes a global namespace in VMware Tanzu Service Mesh is that it defines an application boundary and provides consistent traffic routing, connectivity, resiliency, and security for applications across multiple clusters. A global namespace is a logical abstraction of an application from the underlying infrastructure that spans across multiple clusters and clouds4. A global namespace connects the resources and workloads that make up the application into one virtual unit and manages their identity, discovery, connectivity, security, and observability4. A global namespace also enables automatic service discovery and cross-cluster communication within the application boundary4. References: Global Namespaces - VMware Docs

Correct Answer: B

A prerequisite for cert-manager installation is to obtain the admin credentials of the target workload cluster. Cert-manager is a tool that automates the management and issuance of TLS certificates within Kubernetes clusters3. To install cert-manager, users need to have access to the cluster where they want to deploy it, and have the necessary permissions to create resources such as namespaces, custom resource definitions, deployments, services, and secrets3. Users can obtain the admin credentials of the target workload cluster by using the tanzu cluster kubeconfig get command with the --admin option4. This command generates a kubeconfig file that contains the admin credentials for the cluster, which can be used to authenticate with the cluster and perform cert-manager installation4. References: Installation - cert-manager Documentation, Deploy Workload Clusters - VMware Docs

Correct Answer: B

Antrea is the default CNI for new Tanzu Kubernetes Grid workload clusters8. Antrea is an open-source Kubernetes networking solution that implements the Container Network Interface (CNI) specification and uses Open vSwitch (OVS) as the

data plane9. Antrea supports various features such as network policies, service load balancing, NodePortLocal, IPsec encryption, IPv6 dual-stack, and more10.

The other options are incorrect because:

Multus CNI is an open-source container network interface plugin for Kubernetes that enables attaching multiple network interfaces to pods11. It is not the default CNI for Tanzu Kubernetes Grid workload clusters. Flannel is an open-source

simple and easy-to-use overlay network that satisfies the Kubernetes requirements12. It is not the default CNI for Tanzu Kubernetes Grid workload clusters.

Calico is an open-source network and network security solution for containers, virtual machines, and native host-based workloads13. It is not the default CNI for Tanzu Kubernetes Grid workload clusters.

References: Tanzu Kubernetes Grid Cluster Networking, Antrea, Antrea Features, Multus CNI, Flannel, Calico

Correct Answer: A

VMware Tanzu Mission Control (TMC) is a centralized management platform for consistently operating and securing your Kubernetes infrastructure and modern applications across multiple teams and clouds1. TMC provides a catalog of

curated open- source software packages that you can deploy to your clusters with a few clicks2. To deploy an application to a Kubernetes cluster using TMC catalog, you need to follow these steps3:

From the TMC Console, navigate to Catalog.

Select the package that you want to install from the list of available packages. You can filter the packages by name, provider, or category. Click Install Package to start the installation wizard. On the Installation Settings page, specify the

following information:

Click Install to confirm the installation settings and start the installation process. Wait for the installation to complete. You can monitor the progress and status of the installation on the Package Instances page.

The other options are incorrect because:

From the TMC Console, in Catalog, from Available Tanzu Packages, specify the target cluster and the package to install is false. There is no such option as Available Tanzu Packages in the TMC Console. The correct option is Install

Package.

Using the Tanzu CLI, enter the command tanzu package install is false. The Tanzu CLI is a command-line tool that allows you to interact with Tanzu Kubernetes Grid clusters and packages4. It is not related to TMC or its catalog. Using the

TMC CLI, enter the command tmc cluster tanzupackage create is false. There is no such command as tmc cluster tanzupackage create in the TMC CLI. The TMC CLI is a command-line tool that allows you to interact with TMC and its

resources5. It does not support installing packages from the catalog. References: VMware Tanzu Mission Control Overview, Catalog Overview, Install a Package from Catalog, Tanzu CLI Overview, TMC CLI Overview

Correct Answer: DE

ClusterIP and NodePort are two Kubernetes Service types that are fulfilled natively by Kubernetes without requiring external integrations. ClusterIP exposes a service on a cluster-internal IP address that can only be accessed from within the cluster. NodePort exposes a service on a static port on each node's IP address, and forwards the traffic to the corresponding ClusterIP service. Both ClusterIP and NodePort services are created by Kubernetes using iptables rules on the nodes, and do not depend on any external load balancers or DNS providers. References: Kubernetes Service Types Overview, Service | Kubernetes

Correct Answer: CD

Two services that require Transport Layer Security (TLS) certificates to provide encryption in VMware Tanzu Service Mesh are:

Certificate Authority (CA) Service: A service that issues certificates to services in the service mesh to enable mutual TLS (mTLS) communication between them. The CA service uses a root certificate to sign the certificates for the services,

and verifies the identity of the services using the certificates. The CA service also rotates the certificates periodically to ensure security8. Public Service: A service that exposes an internal service in the service mesh to external clients over

HTTPS. The public service uses a TLS certificate to encrypt the traffic between the external clients and the internal service, and to authenticate itself to the clients. The TLS certificate must match the domain name of the public service9.

The other options are incorrect because:

Internal Service: A service that runs inside the service mesh and communicates with other services using mTLS. The internal service does not require a TLS certificate, but rather uses a certificate issued by the CA service to enable mTLS10.

Proxy Service: A service that acts as an intermediary between an internal service and an external service, such as a database or an API. The proxy service does not require a TLS certificate, but rather uses a certificate issued by the CA

service to enable mTLS with the internal service. The proxy service also uses the external service's certificate to verify its identity11.

External Service: A service that runs outside the service mesh and communicates with an internal service over HTTPS or TCP. The external service does not require a TLS certificate from Tanzu Service Mesh, but rather uses its own

certificate to encrypt the traffic with the internal service, and to authenticate itself to the internal service.

References: Certificate Authority (CA) Service, Public Services, Internal Services, Proxy Services,

Correct Answer: C

The Tanzu package CLI plugin is a tool that allows users to install and manage Tanzu packages on their clusters. Tanzu packages are Kubernetes resources that encapsulate the deployment and configuration of software components, such as Contour, Prometheus, Grafana, and more1. The Tanzu package CLI plugin is intended only for CLI- managed packages, which are packages that users can install and update manually using the Tanzu CLI commands2. The Tanzu package CLI plugin cannot be used to install or manage auto-managed packages, which are packages that are automatically installed and updated by Tanzu Kubernetes Grid as part of the cluster lifecycle2. The other options are incorrect because: It cannot be used to add additional package repositories apart from tanzu-standard is false. The Tanzu package CLI plugin can be used to add, list, update, or delete package repositories, which are sources of Tanzu packages3. Users can add custom package repositories or use the default tanzu-standard repository that comes with Tanzu Kubernetes Grid4. It can be used to manage packages in public repositories is false. The Tanzu package CLI plugin can only be used to manage packages in the repositories that are added to the target cluster3. Users cannot use the Tanzu package CLI plugin to manage packages in public repositories that are not added to the cluster. It can be used to install auto-managed packages is false. As mentioned above, the Tanzu package CLI plugin cannot be used to install or manage auto-managed packages. References: Tanzu Packages, Tanzu Package Types, tanzu package repository, Add a Package Repository

Correct Answer: B

The Kubernetes project that vSphere with Tanzu Supervisor Cluster uses to automate the lifecycle management of Tanzu Kubernetes Grid Clusters is Cluster API. Cluster API is a Kubernetes project that provides declarative APIs for cluster creation, configuration, and management. Cluster API uses a set of custom resource definitions (CRDs) to represent clusters, machines, and other objects. Cluster API also relies on providers to implement the logic for interacting with different infrastructure platforms5. vSphere with Tanzu Supervisor Cluster uses Cluster API to deploy and manage Kubernetes clusters on vSphere 7 across multiple vCenter Server instances and/or multiple data centers via Tanzu Mission Control6. References: Taking Kubernetes to the People: How Cluster API Promotes Self ... - VMware, kubernetes-sigs/cluster-api - GitHub

Correct Answer: D

A service mesh is a dedicated infrastructure layer that you can add to your applications to provide capabilities like observability, traffic management, and security, without adding them to your own code. A service mesh consists of network proxies paired with each service in an application and a set of management processes. The proxies are called the data plane and the management processes are called the control plane. The data plane intercepts calls between different services and processes them; the control plane is the brain of the mesh that configures and monitors the data plane1. A service mesh makes communication between applications possible, structured, and observable by providing features such as load balancing, service discovery, encryption, authentication, authorization, routing, retries, timeouts, fault injection, metrics, logs, and traces2. The other options are incorrect because: Provides dynamic application load balancing and autoscaling across multiple clusters and multiple sites is a description of VMware Tanzu Service Mesh Global Namespaces feature3, which is built on top of a service mesh. It is not the purpose of a service mesh in general. Provides a centralized, global routing table to simplify and optimize traffic management is a description of VMware Tanzu Service Mesh Global Mesh Network feature4, which is also built on top of a service mesh. It is not the purpose of a service mesh in general. Provides service discovery across multiple clusters is a partial description of a service mesh, but it does not capture the full scope of its purpose. Service discovery is one of the features that a service mesh provides, but it is not the only one. References: What's a service mesh?, The Istio service mesh, Service mesh - Wikipedia