A Security Architect is designing the ingress and egress traffic flow for a highly regulated PCI-DSS zone within vSphere with Tanzu.
The requirements state:
1. Ingress: All incoming HTTP/S traffic must pass through a dedicated WAF (Web Application Firewall) before reaching the Kubernetes Ingress Controller.
2. Egress: All outbound traffic from the namespace must be identifiable by a unique, persistent IP address to allow for strict firewall rules on the perimeter.
3. Isolation: The namespace must use a dedicated T1 Gateway in NSX.
Review the following design decisions.
Which configuration choices correctly support these requirements? (Select all that apply.)

• A.Deploy a Tanzu Kubernetes Cluster with a Service of type: LoadBalancer to expose the Ingress Controller, and point the external WAF to the allocated Load Balancer VIP.
• B.Configure the Supervisor with NSX networking to ensure each namespace receives a dedicated Tier-1 Gateway and SNAT rules.
• C.Disable SNAT on the namespace to expose internal Pod IPs directly to the WAF.
• D.Use vDS networking with HAProxy, as it supports "Transparent Mode" for preserving client IPs better than NSX.
• E.Define a specific Egress CIDR range for the Supervisor and ensure the namespace is assigned a specific SNAT IP (Egress IP) from this range, which is then reserved in the perimeter firewall.

Comment: *

Name: *

Email: *

Verification: *

A Platform Engineer is troubleshooting a failed installation of the external-dns Supervisor Service.
The service status in the vSphere Client is "Error".
The engineer retrieves the logs from the service's pod and sees the following:
time="2023-11-22T10:00:00Z" level=error msg="rfc2136: failed to send TSIG authenticated message:
dns: failed to pack message: dns: bad secret"
time="2023-11-22T10:00:05Z" level=error msg="source: failed to list vSphere resources: Unauthorized" The configuration YAML provided during installation included the following snippet for the DNS provider:
spec:
provider: rfc2136
rfc2136:
host: 192.168.10.5
zone: corp.local
tsigSecretName: external-dns-tsig-secret
What is the most likely cause of the failure? (Choose 2.)

• A.The storage policy for the service is full.
• B.The external-dns service account does not have the necessary RBAC permissions on the Supervisor to watch/list Service and Ingress resources.
• C.The Kubernetes Secret external-dns-tsig-secret referenced in the config does not exist in the namespace where the service is being deployed, or it contains an incorrect TSIG key.
• D.The rfc2136 provider is not supported by vSphere with Tanzu.
• E.The Supervisor Cluster does not have a route to the DNS server 192.168.10.5.

Comment: *

Name: *

Email: *

Verification: *

What are three resource limitations defined on a vSphere Namespace? (Choose three.)

• A.Containers
• B.Services
• C.Memory
• D.CPU
• E.Storage

Comment: *

Name: *

Email: *

Verification: *

A DevOps team is deploying a legacy application that requires a specific Private Registry (registry.internal.corp) to pull its container images. This registry requires authentication.
To avoid modifying every individual Pod manifest to include imagePullSecrets, the Platform Engineer wants to configure a default deployment model for the namespace legacy-apps.
Which configuration applies the pull secret automatically to all Pods launched by the standard default ServiceAccount in that namespace?

• A.Patch the default ServiceAccount in the legacy-apps namespace to add the secret name to the imagePullSecrets list.
• B.Create a ConfigMap named standard-registry and mount it to every pod using a MutatingAdmissionWebhook.
• C.Edit the TanzuKubernetesCluster spec to include the registry credential in the settings.network.trust section.
• D.Create a Secret named default-token in the namespace; Kubernetes uses this automatically for all registries.

Comment: *

Name: *

Email: *

Verification: *

What Kubernetes object is used to grant permissions to acluster-wideresource?

• A.RoleReference
• B.RoleBinding
• C.ClusterRoleBinding
• D.ClusterRoleAccess

Comment: *

Name: *

Email: *

Verification: *