Correct Answer: A

The key benefit of Tanzu Service Mesh Autoscaler feature is to autoscale microservices that meet changing levels of demand based on metrics, such as CPU or memory usage. These metrics are available to Tanzu Service Mesh without needing additional code changes or metrics plugins1. Tanzu Service Mesh Autoscaler supports configuring an autoscaling policy for services inside a global namespace through the UI or API, or using a Kubernetes custom resource definition (CRD) for services directly in cluster namespaces2. Tanzu Service Mesh Autoscaler also supports two modes: performance mode, where services are scaled up but not down, and efficiency mode, where services are scaled up and down to optimize resource utilization2. References: VMware Aria Operations for Applications, Tanzu Service Mesh Service Autoscaling Overview - VMware Docs

Correct Answer: A

VMware Aria Operations for Applications is a SaaS solution that provides observability for modern applications across multiple clouds and platforms. It collects and analyzes traces, metrics, and logs from various sources, including Tanzu

Kubernetes Grid clusters managed by Tanzu Mission Control. To enable the integration between VMware Aria Operations for Applications and Tanzu Mission Control, an administrator can use the integrations tab in Tanzu Mission Control UI

and follow the steps to configure the connection.

The other options are incorrect because:

VMware Aria Operations for Applications is not enabled by default in Tanzu Mission Control. An administrator has to explicitly enable the integration and provide the required credentials and settings.

An administrator cannot login to VMware Aria Operations for Applications and enable Tanzu Mission Control integration from the administration menu. The integration has to be initiated from Tanzu Mission Control UI. An administrator cannot

download and install the VMware Aria Operations Observations agent from Tanzu CLI. The Observations agent is automatically installed on the clusters managed by Tanzu Mission Control once the integration is enabled.

References: Configure Integration with Tanzu Mission Control, Introducing the Tanzu Mission Control Integration for VMware Aria Automation

Correct Answer: A

VMware Tanzu Mission Control (TMC) is a centralized management platform for consistently operating and securing your Kubernetes infrastructure and modern applications across multiple teams and clouds1. TMC provides a catalog of

curated open- source software packages that you can deploy to your clusters with a few clicks2. To deploy an application to a Kubernetes cluster using TMC catalog, you need to follow these steps3:

From the TMC Console, navigate to Catalog.

Select the package that you want to install from the list of available packages. You can filter the packages by name, provider, or category. Click Install Package to start the installation wizard. On the Installation Settings page, specify the

following information:

Click Install to confirm the installation settings and start the installation process. Wait for the installation to complete. You can monitor the progress and status of the installation on the Package Instances page.

The other options are incorrect because:

From the TMC Console, in Catalog, from Available Tanzu Packages, specify the target cluster and the package to install is false. There is no such option as Available Tanzu Packages in the TMC Console. The correct option is Install

Package.

Using the Tanzu CLI, enter the command tanzu package install is false. The Tanzu CLI is a command-line tool that allows you to interact with Tanzu Kubernetes Grid clusters and packages4. It is not related to TMC or its catalog. Using the

TMC CLI, enter the command tmc cluster tanzupackage create is false. There is no such command as tmc cluster tanzupackage create in the TMC CLI. The TMC CLI is a command-line tool that allows you to interact with TMC and its

resources5. It does not support installing packages from the catalog. References: VMware Tanzu Mission Control Overview, Catalog Overview, Install a Package from Catalog, Tanzu CLI Overview, TMC CLI Overview

Correct Answer: ACEF

Four policy types that are supported by VMware Tanzu Mission Control are:

Security policy: Security policies allow you to manage the security context in which deployed pods operate in your clusters by imposing constraints on your clusters that define what pods can do and which resources they have access to6.

Access policy: Access policies allow you to use predefined roles to specify which identities (individuals and groups) have what level of access to a given resource7. Network policy: Network policies allow you to use preconfigured templates to

define how pods communicate with each other and other network endpoints8. Custom policy: Custom policies allow you to implement additional business rules, using templates that you define, to enforce policies that are not already

addressed using the other built-in policy types9.

References: Policy-Driven Cluster Management - VMware Docs

Correct Answer: A

A rolling upgrade is a method of upgrading a Kubernetes cluster without downtime by gradually replacing nodes or components with newer versions. A rolling upgrade ensures that there is no disruption to the availability and functionality of the cluster during the upgrade process. A rolling upgrade can be performed manually or using tools such as kubeadm or kops5. The other options are incorrect because: In-place upgrade of each node is a method of upgrading a Kubernetes cluster by stopping each node or component and updating it to the newer version. This method can cause downtime and disruption to the cluster during the upgrade process. Use canary upgrade is not a valid method of upgrading a Kubernetes cluster. A canary upgrade is a technique for deploying new versions of applications or services by gradually exposing them to a subset of users or traffic before rolling them out to everyone6. It is not applicable to cluster upgrades. Deploy a new cluster with upgraded Kubernetes release is not a method of upgrading a Kubernetes cluster, but rather creating a new one. This method canbe costly and time-consuming, as it requires migrating all the resources and configurations from the old cluster to the new one. References: Upgrade A Cluster, Canary deployments

Correct Answer: BD

To enable workload management in vSphere using NSX Advanced Load Balancer, an administrator needs to prepare two components on NSX Advanced Load Balancer in advance: the Service Engine Group and the NSX Advanced Load Balancer Controller1. The Service Engine Group is a logical group of Service Engines that share the same configuration and resources. A Service Engine is a virtual machine that handles the data plane operations of NSX Advanced Load Balancer, such as load balancing, health monitoring, SSL termination, and more2. The administrator needs to configure a Service Engine Group for each Supervisor Cluster that will use NSX Advanced Load Balancer as the load balancer provider1. The NSX Advanced Load Balancer Controller is a virtual machine that handles the control plane operations of NSX Advanced Load Balancer, such as configuration, analytics, orchestration, and management2. The administrator needs to deploy and configure the NSX Advanced Load Balancer Controller VM in the management network of the vSphere environment where workload management will be enabled1. The other options are incorrect because: The NSX Controller is not a component of NSX Advanced Load Balancer, but rather a component of NSX-T Data Center. The NSX Controller is a clustered virtual appliance that provides the control plane functions for logical switching and routing3. It is not required for enabling workload management in vSphere using NSX Advanced Load Balancer. Providing connectivity to NSX Manager is not a component of NSX Advanced Load Balancer, but rather a prerequisite for enabling workload management in vSphere using NSX-T Data Center. The NSX Manager is a virtual appliance that provides the management plane functions for NSX-T Data Center3. It is not required for enabling workload management in vSphere using NSX Advanced Load Balancer. The Avi Kubernetes Operator is not a component of NSX Advanced Load Balancer, but rather an optional tool that can be used to automate the installation and configuration of NSX Advanced Load Balancer on Kubernetes clusters4. It is not

required for enabling workload management in vSphere using NSX Advanced Load Balancer.

References: Install and Configure the NSX Advanced Load Balancer for vSphere with Tanzu with NSX, NSX Advanced Load Balancer Architecture, NSX-T Data Center Architecture, Avi Kubernetes Operator

Correct Answer: B

The tanzu mc upgrade command is used to upgrade a management cluster to a newer version of Tanzu Kubernetes Grid. The command requires the name of the management cluster as an argument, and optionally the version to upgrade to.

For example, toupgrade the management cluster named tanzu-mc01 to version v1.4.0, the command would be:

tanzu mc upgrade tanzu-mc01 --version v1.4.0

The other options are incorrect because:

kubectl management-cluster upgrade is not a valid command. The kubectl command is used to interact with Kubernetes clusters, not to upgrade them.

tanzu config use-context tanzu-mc01-admin@tanzu-mc01 is a command to switch the current context to the admin context of the management cluster named tanzu- mc01. It does not upgrade the cluster.

kubectl tanzu-mc01 upgrade is not a valid command. The kubectl command does not accept a cluster name as an argument, and there is no upgrade subcommand. References: VMware Tanzu for Kubernetes Operations Getting Started,

Upgrading Management Clusters

Correct Answer: C

The Tanzu package CLI plugin is a tool that allows users to install and manage Tanzu packages on their clusters. Tanzu packages are Kubernetes resources that encapsulate the deployment and configuration of software components, such as Contour, Prometheus, Grafana, and more1. The Tanzu package CLI plugin is intended only for CLI- managed packages, which are packages that users can install and update manually using the Tanzu CLI commands2. The Tanzu package CLI plugin cannot be used to install or manage auto-managed packages, which are packages that are automatically installed and updated by Tanzu Kubernetes Grid as part of the cluster lifecycle2. The other options are incorrect because: It cannot be used to add additional package repositories apart from tanzu-standard is false. The Tanzu package CLI plugin can be used to add, list, update, or delete package repositories, which are sources of Tanzu packages3. Users can add custom package repositories or use the default tanzu-standard repository that comes with Tanzu Kubernetes Grid4. It can be used to manage packages in public repositories is false. The Tanzu package CLI plugin can only be used to manage packages in the repositories that are added to the target cluster3. Users cannot use the Tanzu package CLI plugin to manage packages in public repositories that are not added to the cluster. It can be used to install auto-managed packages is false. As mentioned above, the Tanzu package CLI plugin cannot be used to install or manage auto-managed packages. References: Tanzu Packages, Tanzu Package Types, tanzu package repository, Add a Package Repository

Correct Answer: A

The object in Kubernetes used to grant permissions to a cluster-wide resource is ClusterRoleBinding. A ClusterRoleBinding is a cluster-scoped object that grants permissions defined in a ClusterRole to one or more subjects, such as users, groups, or service accounts5. A ClusterRole is a cluster-scoped object that defines a set of permissions on cluster-scoped resources (like nodes) or namespaced resources (like pods) across all namespaces5. For example, a ClusterRoleBinding can be used to allow a particular user to run kubectl get pods --all-namespaces by granting them the permissions defined in a ClusterRole that allows listing pods in any namespace6. References: Using RBAC Authorization | Kubernetes, Cluster Roles and Cluster Roles Binding in Kubernetes | ANOTE.DEV

Correct Answer: AB

To visualize API connectivity and enable API protection in VMware Tanzu Service Mesh, the administrator needs to perform two steps: Activate API Discovery for the Global Namespace. This allows Tanzu Service Mesh to automatically discover the APIs signatures between microservices running inside or outside the mesh. API Discovery creates a custom API schema for each API that is close to OpenAPI spec 3.0. Tanzu Service Mesh graph renders the detected APIs in the Enforcing mode by default, which means that any new API is considered as a violated API unless accepted by the administrator1 Create API Security Policy for the Global Namespace. This allows the administrator to block or allow layer 4 and layer 7 traffic, as well as create granular policies that provide API and data segmentation, OWASP 10 attack defense, schema validation, geofencing, data compliance, and egress controls. The administrator can create the API Security policy through the Tanzu Service Mesh Console UI or by using the Tanzu Service Mesh API Explorer2 References: 1: https:// docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu- service-mesh-enterprise/GUID-E6FB9FB3-FDB3-4D2B-B5CB-614608EEF537.html 2: https://docs.vmware.com/en/VMware-Tanzu-Service-Mesh/services/tanzu-service-mesh- enterprise/GUID-5B635420-3BD2-4EC1-B67E-2015F991A91C.html