2V0-71.23 VMware Tanzu for Kubernetes Operations Professional Free Practice Exam Questions (2025 Updated)

The Supervisor Service in Tanzu Kubernetes Grid exposes three layers of controllers to manage the lifecycle of a Tanzu Kubernetes Grid cluster:

Virtual Machine Service (VMS) controllers provide an abstraction layer for managing virtual machines on vSphere. They allow users to create and manage VM classes, VM images, content libraries, and VM services.

Tanzu Kubernetes Grid (TKG) controllers provide an abstraction layer for managing Kubernetes clusters on vSphere. They allow users to create and manage TKG service configurations, TKG service plans, TKG service instances, and TKG service bindings.

Cluster API (CAPI) controllers provide an abstraction layer for managing Kubernetes clusters on any platform. They allow users to create and manage cluster objects, machine objects, machine deployment objects, machine set objects, and machine health check objects.

The other options are incorrect because:

Authentication webhook, Container Storage Support, Cloud Provider Implementation are components of vSphere with Tanzu that enable authentication integration with vCenter Server, persistent storage provisioning forKubernetes workloads, and cloud provider functionality for vSphere respectively. They are not part of the Supervisor Service controllers.

Aria integration Service, Tanzu Cluster API and Tanzu Container Network Controller are not valid components of Tanzu Kubernetes Grid or vSphere with Tanzu. Aria integration Service is a typo for Aria Operations for Applications (formerly VMware Tanzu Observability), which is a SaaS solution that collects and analyzes traces, metrics, and logs from various sources. Tanzu Cluster API is a typo for Cluster API (CAPI), which is one of the Supervisor Service controllers. Tanzu Container Network Controller is a typo for Antrea Controller, which is part of VMware Container Networking with Antrea, which is a solution that streamlines Kubernetes networking with a unified networking stack across multiple managed Kubernetes providers.

VMware Tanzu Mission Control Connection agent, Cluster API and Kubernetes Connection Agent are not valid components of the Supervisor Service controllers. VMware Tanzu Mission Control Connection agent is a component of VMware Tanzu Mission Control, which is a SaaS solution that provides centralized management and governance for Tanzu Kubernetes Grid clusters across multiple platforms. Cluster API (CAPI) is one of the Supervisor Service controllers, but it is not specific to Tanzu Mission Control. Kubernetes Connection Agent is not a valid component of Tanzu Kubernetes Grid or vSphere with Tanzu.

References: VMware Tanzu for Kubernetes Operations Getting Started, vSphere with Tanzu Configuration and Management

The type of policy that can be used to enforce the container controls is image security. Image security policies allow users to define rules for validating container images before they are deployed on clusters. Users can specify image names, tags, signatures, or digests to whitelist or blacklist images based on their source and integrity. Users can also enable or disable image scanning for vulnerabilities and configure the severity threshold for admission decisions. References: Image Security Policy - VMware Docs, Image Policy - VMware Docs

The role of the Tanzu Kubernetes Grid Service is to provision Kubernetes clusters that integrate with the underlying vSphere Namespace resources and Supervisor Services. The Tanzu Kubernetes Grid Service is a component of vSphere with Tanzu that provides self-service lifecycle management of Tanzu Kubernetes clusters3. A Tanzu Kubernetes cluster is an opinionated installation of Kubernetes that runs on top of the Supervisor Cluster and inherits its capabilities, such as storage integration, pod networking, load balancing, authentication, and authorization4. The Tanzu Kubernetes Grid Service exposes three layers of controllers to manage the lifecycle of a Tanzu Kubernetes cluster: Cluster API, Virtual Machine Service, and Tanzu Kubernetes Release Service3. References: Tanzu Kubernetes Grid Service Architecture - VMware Docs, What Is a Tanzu Kubernetes Cluster? - VMware Docs

The command that has a valid syntax for scaling VMware Tanzu Kubernetes Grid cluster using Tanzu CLI is tanzu cluster scale --controlplane-machine-count 5 --worker-machine-count 10. The tanzu cluster scale command allows users to manually scale the number of control plane and worker nodes in a cluster5. The --controlplane-machine-count flag specifies the desired number of control plane nodes, while the --worker-machine-count flag specifies the desired number of worker nodes5. The other commands are invalid because they either use incorrect flags or omit the namespace flag when required5. References: Scale Clusters - VMware Docs

Policies are one of the features of Tanzu Mission Control that allow you to manage the operation and security posture of your Kubernetes clusters and other organizational objects. Policies allow you to provide a set of rules that govern your organization and all the objects it contains. The policy types available in Tanzu Mission Control include access policy, image registry policy, network policy, quota policy, security policy, and custom policy. Policies can be applied at the individual, group, or organizational level to control access, image registries, networking, resource consumption, security context, and more18.

The other options are incorrect because:

Policies can be configured using a tag selector to restrict the scope of the policy is false. Policies can be configured using a label selector, not a tag selector, to include or exclude certain objects from the policy. A label is a key/value pairattached to a Kubernetes object that allows you to specify identifying attributes for that object. A selector provides the means to identify the objects that have a given label18.

Policies can only be applied to clustergroups is false. Policies can be applied to various levels of the Tanzu Mission Control resource hierarchy, such as organization, cluster group, workspace, cluster, and namespace18.

Policies can be enforced using Kubernetes resources (NetworkPolicy, ResourceQuota etc) or using the Kyverno admission controller is false. Policies are enforced by Tanzu Mission Control using its own admission controller and webhook server. Kyverno is an open-source policy engine for Kubernetes that is not related to Tanzu Mission Control.

References: Policy-Driven Cluster Management, [Kyverno]

VMware Aria Operations for Applications (formerly VMware Tanzu Observability) is a SaaS solution that collects and analyzes traces, metrics, and logs from various sources, including Tanzu Kubernetes Grid clusters, applications, and services. It provides a single source of truth for actionable insights into the performance, availability, and behavior of the entire application stack. It also enables users to create dashboards, alerts, and reports based on the collected data.

The other options are incorrect because:

Watches defined infrastructure systems to keep track of health of resources is a description of VMware Tanzu Mission Control, which is another SaaS solution that provides centralized management and governance for Tanzu Kubernetes Grid clusters across multiple platforms.

Automates the remediation of Kubernetes platform resources based on collected data is a description of VMware Tanzu Service Mesh, which is a service thatcreates an enterprise-class service mesh for consistent control and security for microservices, end users, and data.

Tracks metrics, logs, and alerts based on specified thresholds is a partial description of VMware Aria Operations for Applications, but it does not mention the trace analysis and the single source of truth features.

References: VMware Tanzu for Kubernetes Operations Getting Started, VMware Aria Operations for Applications Documentation

Antrea is the default CNI for new Tanzu Kubernetes Grid workload clusters8. Antrea is an open-source Kubernetes networking solution that implements the Container Network Interface (CNI) specification and uses Open vSwitch (OVS) as the data plane9. Antrea supports various features such as network policies, service load balancing, NodePortLocal, IPsec encryption, IPv6 dual-stack, and more10.

The other options are incorrect because:

Multus CNI is an open-source container network interface plugin for Kubernetes that enables attaching multiple network interfaces to pods11. It is not the default CNI for Tanzu Kubernetes Grid workload clusters.

Flannel is an open-source simple and easy-to-use overlay network that satisfies the Kubernetes requirements12. It is not the default CNI for Tanzu Kubernetes Grid workload clusters.

Calico is an open-source network and network security solution for containers, virtual machines, and native host-based workloads13. It is not the default CNI for Tanzu Kubernetes Grid workload clusters.

References: Tanzu Kubernetes Grid Cluster Networking, Antrea, Antrea Features, Multus CNI, Flannel, Calico

To create a vSphere Namespace, the correct steps are to use the vSphere web client, select Workload Management, select Namespaces tab, and click Create Namespace. A vSphere Namespace is a logical grouping of Kubernetes resources that can be used to isolate and manage workloads on a Supervisor Cluster1. To create a vSphere Namespace, a user needs to have the vSphere Client and the required privileges to access the Workload Management menu and the Namespaces tab2. From there, the user can select the Supervisor Cluster where to place the namespace, enter a name for the namespace, configure the network settings, set the resource limits, assign permissions, and enable services for the namespace2. References: Create and Configure a vSphere Namespace - VMware Docs, vSphere with Tanzu Concepts - VMware Docs

VMware Tanzu Kubernetes Grid is an enterprise-ready Kubernetes runtime that streamlines operations across multi-cloud infrastructure1. Tanzu Kubernetes Grid natively integrates with the following VMware products:

NSX Advanced Load Balancer: A solution that provides L4 and L7 load balancing and ingress control for Kubernetes clusters. NSX Advanced Load Balancer can be used as the default load balancer provider for both management and workload clusters on vSphere, AWS, Azure, and other platforms2.

NSX-T Data Center: A network virtualization and security platform that provides consistent networking and security for applications running across private and public clouds. NSX-T Data Center can be used as the default network plugin for both management and workload clusters on vSphere, AWS, Azure, and other platforms3.

vSphere with VMware Tanzu: A solution that enables you to run Kubernetes workloads natively on a vSphere cluster, and to provision and manage Kubernetes clusters using the vSphere Client. vSphere with VMware Tanzu can be used as the platform to deploy Tanzu Kubernetes Grid management clusters and workload clusters4.

The other options are incorrect because:

BOSH is an open-source tool that provides release engineering, deployment, lifecycle management, and monitoring of distributed systems. BOSH is not a VMware product, nor does it natively integrate with Tanzu Kubernetes Grid5.

vRealize Network Insight is a solution that delivers intelligent operations for software-defined networking and security. It helps optimize network performance and availability with visibility and analytics across virtual and physical networks. vRealize Network Insight is not natively integrated with Tanzu Kubernetes Grid6.

Tanzu Mission Control is a centralized management platform for consistently operating and securing your Kubernetes infrastructure and modern applications across multiple teams and clouds. Tanzu Mission Control is not natively integrated with Tanzu Kubernetes Grid, but rather works with it as a separate product7.

References: VMware Tanzu Kubernetes Grid Overview, NSX Advanced Load Balancer, NSX-T Data Center, vSphere with VMware Tanzu, BOSH, vRealize Network Insight, Tanzu Mission Control Overview

The purpose of setting ENABLE_AUDIT_LOGGING=true during a cluster deployment is to log metadata about all requests made to the Kubernetes API server. This enables auditing of the cluster activities and helps with security and compliance. The audit logs are stored in /var/log/kubernetes/audit.log on the control plane node and can be accessed by the cluster administrator. The audit logs are generated based on an audit policy file that defines what events should be recorded and what data they should include12

References: 1: https://docs.vmware.com/en/VMware-Tanzu-Kubernetes-Grid/1.6/vmware-tanzu-kubernetes-grid-16/GUID-troubleshooting-tkg-audit-logging.html  2: https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/

The tanzu mc upgrade command is used to upgrade a management cluster to a newer version of Tanzu Kubernetes Grid. The command requires the name of the management cluster as an argument, and optionally the version to upgrade to. For example, toupgrade the management cluster named tanzu-mc01 to version v1.4.0, the command would be:

tanzu mc upgrade tanzu-mc01 --version v1.4.0

The other options are incorrect because:

kubectl management-cluster upgrade is not a valid command. The kubectl command is used to interact with Kubernetes clusters, not to upgrade them.

tanzu config use-context tanzu-mc01-admin@tanzu-mc01 is a command to switch the current context to the admin context of the management cluster named tanzu-mc01. It does not upgrade the cluster.

kubectl tanzu-mc01 upgrade is not a valid command. The kubectl command does not accept a cluster name as an argument, and there is no upgrade subcommand.

References: VMware Tanzu for Kubernetes Operations Getting Started, Upgrading Management Clusters

The set of tools that can be used to attach a Kubernetes cluster to VMware Tanzu Mission Control are kubectl and VMware Tanzu Mission Control Web Ul. kubectl is a command-line tool that allows users to interact with Kubernetes clusters. VMware Tanzu Mission Control Web Ul is a graphical user interface that allows users to manage their clusters and policies. To attach a cluster, users need to use both tools. First, they need to use the web console to select the cluster group and generate a YAML manifest for the cluster. Then, they need to use kubectl to apply the manifest on the cluster and install the cluster agent extensions that enable communication with Tanzu Mission Control. References: Attach a Cluster - VMware Docs, What Happens When You Attach a Cluster

A NetworkPolicy is a Kubernetes object that controls what traffic is allowed to and from selected pods and network endpoints6. NetworkPolicy objects contain the following information:

The pods that are affected by this policy (the pod selector)

The traffic that is allowed for these pods (the ingress and egress rules)

The network entities that are allowed or denied for this traffic (the selectors and IP blocks)

By default, all pods in a cluster can communicate with each other and with any external network endpoint. A NetworkPolicy allows you to restrict this behavior by defining rules for pod isolation and network access. A NetworkPolicy is enforced by a network plugin that supports it6.

The other options are incorrect because:

An Ingress is a Kubernetes object that manages external access to services in a cluster, typically HTTP7. It does not control what traffic is allowed to and from selected pods and network endpoints.

A PodSecurityPolicy is a Kubernetes object that controls security-sensitive aspects of pod specification, such as running as privileged or using host networking8. It does not control what traffic is allowed to and from selected pods and network endpoints.

A Secret is a Kubernetes object that stores sensitive information, such as passwords or keys, in an encrypted form9. It does not control what traffic is allowed to and from selected pods and network endpoints.

References: Network Policies, Ingress, Pod Security Policies, Secrets

The command that can be used to upgrade a VMware Tanzu Kubernetes Cluster that is managed by VMware Tanzu Mission Control is tmc cluster upgrade [version] . This command allows you to upgrade a managed cluster to a newer version of Kubernetes that is supported by Tanzu Mission Control5. The version flag is optional and specifies the target version of Kubernetes. If not specified, the command upgrades the cluster to the latest available version5. The clustername argument is required and specifies the name of the cluster to upgrade5. References: Upgrade Kubernetes on Your Cluster - VMware Docs

Three capabilities that are supported by VMware Aria Operations for Applications (formerly VMware Tanzu Observability) are:

Unified log management: Users can browse logs to troubleshoot their issues, for example, if they notice anomalies on their metrics charts or see that a service on the application map has large latency value. Users can also drill into related logs directly from charts, alerts, and traces2.

Event tracing: Users can work with a service map, examine traces and spans, and drill down into problem areas in their code. Users can also view traces and spans from a single source of truth across logs, metrics, and traces1.

Out-of-the-box and user-configurable dashboards: Users can visualize their data based on query results in various chart types (such as line plot, point plot, table, pie chart, etc.) and organize them in dashboards. Users can also interact with charts and dashboards in real time, such as zoom in, zoom out, change the time window, change the focus, and so on1.

References: VMware Aria Operations for Applications Documentation, VMware Aria Operations for Applications

A rolling upgrade is a method of upgrading a Kubernetes cluster without downtime by gradually replacing nodes or components with newer versions. A rolling upgrade ensures that there is no disruption to the availability and functionality of the cluster during the upgrade process. A rolling upgrade can be performed manually or using tools such as kubeadm or kops5.

The other options are incorrect because:

In-place upgrade of each node is a method of upgrading a Kubernetes cluster by stopping each node or component and updating it to the newer version. This method can cause downtime and disruption to the cluster during the upgrade process.

Use canary upgrade is not a valid method of upgrading a Kubernetes cluster. A canary upgrade is a technique for deploying new versions of applications or services by gradually exposing them to a subset of users or traffic before rolling them out to everyone6. It is not applicable to cluster upgrades.

Deploy a new cluster with upgraded Kubernetes release is not a method of upgrading a Kubernetes cluster, but rather creating a new one. This method canbe costly and time-consuming, as it requires migrating all the resources and configurations from the old cluster to the new one.

References: Upgrade A Cluster, Canary deployments

Two configurations that are valid for Zonal Supervisor Deployment are three-zone and one-zone. A Zonal Supervisor Deployment is a way of deploying the vSphere with Tanzu Supervisor Cluster across multiple vSphere clusters that are mapped to vSphere Zones1. A vSphere Zone is a logical grouping of vSphere clusters that share common characteristics, such as network connectivity, power source, or physical location2. A Zonal Supervisor Deployment provides high availability and fault tolerance for Kubernetes workloads by distributing them across different zones1. The supported configurations for Zonal Supervisor Deployment are:

Three-zone: The Supervisor Cluster spans three vSphere clusters, each mapped to a different vSphere Zone. This configuration provides the highest level of availability and fault tolerance, as it can tolerate the failure of any one zone1.

One-zone: The Supervisor Cluster runs on a single vSphere cluster that is mapped to a single vSphere Zone. This configuration is suitable for development or testing purposes, but does not provide any availability or fault tolerance guarantees1.

References: Requirements for Zonal Supervisor Deployment - VMware Docs, Create vSphere Zones for a Multi-Zone Supervisor Deployment - VMware Docs