What tool can be used to back up and restore workloads on clusters provisioned by vSphere Supervisor?

• A.Velero
• B.VMware Live Recovery
• C.Restic
• D.Site Recovery Manager

Comment: *

Name: *

Email: *

Verification: *

A customer is required to enhance the security for a set of VMware vSphere Kubernetes Service (VKS) clusters that host services interacting with sensitive customer data. The solution must encrypt the transport and communications between services.
The VKS Admin recommends enabling Istio Service Mesh to satisfy the requirement. What type of encryption does Istio Service Mesh provide?

• A.SSH or TLS
• B.IPsec with IKEv2
• C.AES 256
• D.mTLS

Comment: *

Name: *

Email: *

Verification: *

A VKS Administrator is troubleshooting a failed package installation. A developer attempted to install the fluent-bit package, but the PackageInstall resource status reports a reconciliation failure.
The administrator inspects the PackageRepository status:
$ kubectl get packagerepository -n tkg-system
NAME AGE DESCRIPTION
private-repo 10m Reconcile failed: Error: Imgpkg: Fetching image:
Head "https://private-reg.corp.local/repo/packages:v1":
x509: certificate signed by unknown authority
The environment uses a private Harbor registry (private-reg.corp.local) signed by an internal Corporate Root CA.
What is the correct procedure to resolve this trust issue and allow the cluster to pull packages? (Choose
2.)

• A.Reconfigure the TKG cluster by updating its TanzuKubernetesCluster spec to include the trust.additionalTrustedCAs field with the Corporate Root CA name/data.
• B.Disable TLS verification on the kapp-controller deployment by editing the deployment spec.
• C.Obtain the Corporate Root CA certificate in PEM format.
• D.Create a Kubernetes Secret of type Opaque (or generic) in the tkg-system namespace containing the CA certificate (key ca.crt), then reference this secret in the spec.fetch.imgpkgBundle.secretRef (or appropriate CA trust field if supported by the specific API version) of the PackageRepository YAML. Self- Correction/Refinement: The standard TKG way to trust a registry CA for the whole cluster (including containerd and kapp) is typically at cluster creation via the TkgServiceConfiguration or ClusterClass, OR by patching the cluster. However, for kapp-controller specific trust, referencing a CA secret or ensuring the node trusts it is key.
• E.Manually copy the CA certificate to /etc/ssl/certs on every worker node and reboot them.

Comment: *

Name: *

Email: *

Verification: *