A Security Architect is designing a Disconnected (Air-Gapped) vSphere with Tanzu environment for a defense contractor. The environment has NO internet access.
Requirements:
1. Developers must be able to provision TKG clusters.
2. Developers must be able to install standard packages (Contour, Prometheus).
3. All images must be scanned and hosted internally.
Which architectural components and configuration steps are strictly required to support this design?
(Select all that apply.)

• A.Configure the Supervisor to use a HTTP Proxy to bypass the air-gap restrictions.
• B.Configure the TKG clusters to use a Private Package Repository CR that points to the internal registry URL instead of the default public VMware URL.
• C.Configure the TkgServiceConfiguration (or global Supervisor settings) to trust the Private Registry's CA certificate.
• D.Deploy a Private Container Registry (e.g., Harbor) within the air-gapped environment to host the system images (TKR) and package bundles.
• E.Use an internet-connected machine to download/pull the required TKG images and Package Repository bundles from the public VMware registry, then push them to the internal Private Registry.

Comment: *

Name: *

Email: *

Verification: *

Which characteristic distinguishes a vSphere Pod from a standard virtual machine in a vSphere with Tanzu environment?

• A.A vSphere Pod runs directly on the ESXi host using a lightweight generic kernel (CRX) optimized for containers.
• B.A vSphere Pod runs a full heavy-weight guest operating system (Linux/Windows) managed by the tenant.
• C.A vSphere Pod requires a pre-existing Tanzu Kubernetes Grid cluster to be deployed.
• D.A vSphere Pod cannot be managed via the vSphere Client and is only visible via kubectl.

Comment: *

Name: *

Email: *

Verification: *

The vSphere Admin creates a vSphere Namespace harbor-project and grants the DevOps Engineer edit permissions. The DevOps Engineer deploys the Harbor service in thisnamespace with the command: kubectl apply -f harbor-svc.yml The Harbor service deploys successfully, but the database data harbor database 0 pods does not come into a Running state.
Click the two locations where the administrator should verify the Access Modes forthis pod's PerslstentVolumeClaim (PVC). (Choose two.)

Correct Answer:

Explanation:
* Storage
* Resources
When a stateful pod (like Harbor's database) is stuck Pending/ContainerCreating or repeatedly failing to attach
/mount storage, one of the first checks is whether the PVC'sAccess Modesmatch what the workload and backing storage support (for example, ReadWriteOnce vs ReadWriteMany). In Kubernetes, the PVC and PV explicitly showAccess Modes(for example Access Modes: RWO) when you inspect them.
In the vSphere Namespace UI, theStoragetab is where namespace storage is managed and reviewed (including storage policy assignments that back storage classes/PVCs), making it the natural place to validate the storage configuration being consumed by the Harbor database PVC. VMware's VCF documentation directs administrators to navigate to a namespace and use theStoragetab for storage-related settings.
TheResourcestab is the Kubernetes-object oriented view for the namespace, where you can locate the PVC object associated with the failing pod and inspect its properties/YAML (including the requested storage class and access mode intent). Namespace permissions explicitly include the ability to view Kubernetes resources within the namespace, which aligns with checking PVC details there.

Comment: *

Name: *

Email: *

Verification: *

A VMware Administrator is tasked with implementing a backup and restore strategy using Velero and external object storage for the namespace 'myapp1. Arrange the steps In the correct order of operations to enable Vetero.

Correct Answer:

Explanation:
Answer (Correct Order):
* Run the install command:velero install ... --provider aws --bucket <bucket> ... --plugins ... --backup- location-config ...
* Apply BackupStorageLocation YAML.
* Apply VolumeSnapshotLocation YAML.
* Run test backup:velero backup create test-backup --include-namespaces "myapp1" The correct sequence follows Velero's operational model: install the Velero components first, then define where backups and snapshots are stored, and finally validate with a real backup. In VCF 9.0, the Velero Plugin for vSphere installation command includes parameters for the object-store provider, bucket, and plugin images, which establishes the Velero control plane in the target namespace and prepares it to communicate with an S3-compatible store.
After the installation is in place, you apply theBackupStorageLocationconfiguration so Velero has a durable destination for Kubernetes backup metadata in the object store. This aligns with the VCF 9.0 guidance that backups upload Kubernetes metadata to the object store and require S3-compatible storage for backup/restore workflows.
Next, apply theVolumeSnapshotLocationso Velero knows how and where to create/track volume snapshots for stateful workloads. The VCF 9.0 install example explicitly includes snapshot/backup location configuration parameters, reflecting that both must be set for complete protection.
Finally, run a test backup scoped to the namespace (--include-namespaces=my-namespace) to confirm end-to- end functionality.

Comment: *

Name: *

Email: *

Verification: *

An administrator is operating a sovereign private cloud built on VMware Cloud Foundation (VCF) and is providing isolated Supervisor Namespaces as well as associated Kubernetes clusters. The architecture must ensure consistent provisioning, management, and monitoring of these clusters across tenants while maintaining compliance with internal governance and automation frameworks, considering:
* Deploying and scaling Kubernetes clusters
* Managing Supervisor Namespaces and configurations
* Monitoring cluster health, workloads, and resources across tenants
What three clients are supported for provisioning, managing, and monitoring VMware vSphere Kubernetes Service (VKS) clusters? (Choose three.)

• A.kubectl
• B.Cluster API
• C.vSphere UI
• D.esxtop
• E.VCF CLI
• F.esxcli

Comment: *

Name: *

Email: *

Verification: *