Configure CNIs, NSX Networking Objects, and TLS Certificates and Secure VKS Clusters VCAP-VCF-VKS Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which NSX object is used to define firewall rules that restrict traffic between pods in a VKS cluster?

   • ASegment
   • BTier-1 Gateway
   • CSecurity Policy
   • DDistributed Firewall
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A VKS cluster is shared between two teams. The administrator needs to ensure that Team A cannot access the resources of Team B. What should be configured?

   • ACreate separate namespaces and apply RBAC roles and network policies to restrict access
   • BDeploy two separate VKS clusters
   • CConfigure a Tier-1 gateway for each team
   • DUse a single namespace with different labels
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A VKS cluster is deployed with Antrea and NSX-T integration. The security team requires that all traffic between pods in different namespaces be blocked by default, with exceptions for specific services. What is the most efficient way to achieve this?

   • ACreate a distributed firewall policy with a default deny rule and allow rules for specific services
   • BUse a Tier-1 gateway with a route map to block traffic
   • CCreate a network policy for each namespace to allow traffic
   • DConfigure the Antrea CNI to disable inter-namespace traffic
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A VKS cluster is being audited for compliance. The audit requires that all API server access be authenticated using certificates, and that the cluster's etcd data be encrypted at rest. The cluster currently uses token-based authentication and unencrypted etcd. What must the administrator do to meet the audit requirements?

   • ADisable token-based authentication and rely on network policies
   • BUse a service account token for authentication and enable etcd encryption
   • CEnable TLS for the API server only
   • DConfigure certificate-based authentication for the API server and enable etcd encryption at rest
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the purpose of configuring TLS certificates for VKS cluster components?

   • ATo secure communication between components
   • BTo encrypt data at rest
   • CTo authenticate users
   • DTo improve performance
   Reveal Solution Discussion Select an answer first