Configure CNIs, NSX Networking Objects, and TLS Certificates and Secure VKS Clusters VCAP-VCF-VKS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A VKS cluster administrator needs to replace the default self-signed certificate for the Kubernetes API server with a certificate signed by the company's internal CA. The certificate must be valid for the cluster's external DNS name. What is the correct procedure?

   • AUse the existing self-signed certificate and add the DNS name to the cluster's /etc/hosts file
   • BImport the CA certificate directly into the cluster and use it as the API server certificate
   • CRegenerate the self-signed certificate with the DNS name in the CN field only
   • DGenerate a CSR with the DNS name as a SAN, have the CA sign it, and update the API server certificate in the cluster configuration
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A VKS cluster administrator is configuring TLS certificates for the cluster's metrics server. The metrics server is internal and uses a certificate signed by the cluster's internal CA. The administrator needs to ensure that the kubelet can communicate with the metrics server securely. What should be configured?

   • AAdd the internal CA certificate to the kubelet's trust store
   • BConfigure the metrics server to use a public CA certificate
   • CDisable TLS verification for the metrics server
   • DUse a self-signed certificate for the metrics server
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A VKS cluster administrator needs to rotate the TLS certificates for the cluster's etcd component. The certificates are about to expire. What is the correct procedure?

   • ADelete the etcd data and recreate the cluster
   • BUse the same certificate for all components
   • CGenerate new certificates, update the etcd configuration, and restart etcd
   • DExtend the expiration date of the existing certificates
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which component of a VKS cluster typically requires a TLS certificate for secure client communication?

   • AKubernetes API server
   • BContainer runtime
   • Ckube-proxy
   • Detcd
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A VKS cluster is being deployed in a multi-tenant environment where each tenant requires its own network segment and security policies. The administrator plans to use Antrea with NSX-T integration. What is the best approach to isolate tenants?

   • ACreate a separate NSX-T segment and distributed firewall policy for each tenant
   • BDeploy a separate VKS cluster for each tenant
   • CUse a Tier-1 gateway for each tenant
   • DUse a single segment and rely on network policies
   Reveal Solution Discussion Select an answer first