VMware VCP6-NV 2V0-642

Transcription

1 VMware VCP6-NV 2V0-642 Number: 2V0-642 Passing Score: 800 Time Limit: 120 min File Version: 14.75

2 Exam A QUESTION 1 An administrator needs to perform a configuration backup of NSX. From which two locations can this task be performed? (Choose two.) A. Directly on the NSX Manager B. From the vsphere Web Client C. Using the NSX API D. Directly on each NSX Controller Correct Answer: AC /Reference: QUESTION 2 Where does an administrator configure logging for the NSX Manager? A. In the vsphere Web Client B. In the NSX Manager GUI C. In the NSX Manager command line interface (CLI) D. In the vsphere Syslog Collector Correct Answer: B /Reference: QUESTION 3

3 Which term describes a situation where a bottleneck is created when traffic is sent to a single device for security enforcement? A. security event queuing B. hairpinning C. security looping D. enforcement degradation Correct Answer: A /Reference: QUESTION 4 Two virtual machines are unable to communicate with one another. The virtual machines are in the same distributed port group, but reside on different ESXi hosts. What are two possible causes for the communications issue? (Choose two ) A. Basic multicast filtering mode has been disabled on the ESXi hosts. B. No physical NICs are assigned as active or standby uplinks in a NIC team. C. The standby links are configured on different VLANs, preventing heartbeats from reaching each VM. D. The physical NICs assigned as active or standby uplinks reside on different VLANs on the physical switch. Correct Answer: BD /Reference: QUESTION 5 An NSX environment requires physical NIC redundancy for all dvportgroups when connecting hosts to the physical network. There are two 10Gb NIC's per host. Which two teaming methods should be used to ensure both links are utilized simultaneously? A. Virtual Port Channel B. LACP Port-Channel C. Static Port-Channel D. Explicit Failover Order

4 Correct Answer: AB /Reference: QUESTION 6 When creating a new security policy how is the default weight determined? A. The default weight is equal to the highest defined weight plus B. The default weight is incremented by 100, starting at 0. C. The default weight is equal to the highest defined weight minus D. The default weight is equal to the highest defined weight Correct Answer: A /Reference: : QUESTION 7 What is required before running an Activity Monitoring report? A. Enable data collection on the NSX Controller. B. Enable data collection on the vcenter Server. C. Enable data collection on the NSX Manager. D. Enable data collection on the virtual machine. Correct Answer: D /Reference: QUESTION 8 An administrator wants to perform Activity Monitoring on a large group of virtual machines in an NSX environment. How would this task be accomplished with

5 minimal administrative effort? A. Create a PowerCLI script to enable virtual machine data collection on each virtual machine. B. Create a security group in Service Composer and add the virtual machines to the security group. C. Add the virtual machines to the pre-defined Activity Monitoring security group in Service Composer. D. Add the virtual machines to a VM folder in vcenter Server and enable data collection. Correct Answer: C /Reference: QUESTION 9 When configuring BGP routing in NSX, what is the purpose of the Graceful Restart check box? A. Allow packet forwarding to be paused during restart of BGP services B. Allow packet forwarding to be uninterrupted during restart of BGP services C. Automatically restart the local router when BGP session is established D. Automatically restart the peer router when BGP session is established Correct Answer: B /Reference: QUESTION 10 Which vsphere network object obstructs the physical network, provides access-level switching in the hypervisor and enables support tot overlay networking? A. Standard Switch

6 B. Distributed Port Group C. Distributed Switch D. Logical Switch Correct Answer: C /Reference: QUESTION 11 Which three statements ore valid methods of Link Aggregation Control Protocol negotiation? (Choose three.) A. Switches activate one of the blocked paths and negotiate the forwarding path upon failure. B. Every other switch on the LAN negotiates only one data path back to the root bridge. C. Switches wait until they receive an aggregation request,negotiate the status of the links, and proceed. D. One switch sends repeated requests to the other switch that is requesting the port aggregation status. The two switches negotiate the status of the links and proceed. E. Switches with links enabled for port aggregation do the port aggregation themselves and must be manually configured to be compatible at each end of that link Correct Answer: ABC /Reference: QUESTION 12 What is the effect on NSX Edge virtual machines when NSX Edge high availability is configured but vsphere HA is NOT configured? A. The active-standby NSX Edge pair will survive one failure. However, the virtual machines must reside on the same host to prevent NSX Edge availability from being compromised. B. The active-standby NSX Edge HA pair will survive multiple failures. C. The active-standby NSX Edge HA pair will survive one failure. However, if another failure happens before the second Edge appliance is restored, NSX Edge availability can be compromised. D. The active-standby NSX Edge HA pair will survive two failures. However, the virtual machines must reside on two different hosts. Correct Answer: C

7 /Reference: QUESTION 13 What are two roles of vmnics? (Choose two) A. ESXi hosts reach the physical network through vmnics. B. Virtual machines require vmnics to communicate with their host C. ESXi hosts are segmented using vmnics, also called virtual trunk ports D. Virtual machines require vmnics to communicate with physical networks Correct Answer: AC /Reference: QUESTION 14 Which two statements are true about NSX Data Security support? (Choose two ) A. It supports HIPAA and PCI-DSS compliance policies as well as U.S. Driver License and Social Security numbers. B. It supports both Windows and Linux-based virtual machines. C. It only supports HIPAA and PCI-DSS compliance policies. D. It only supports Windows-based virtual machines. Correct Answer: BC /Reference: QUESTION 15 A virtualized application needs access to a physical database. Both servers are on the /24 subnet. NSX has been deployed across the entire virtual environment. What method can be used to allow access between the servers?

8 A. Configure a DLR with an L2 bridge instance for /24 VXLAN to VLAN traffic. B. Route /24 to the NSX Edge where the logical switch of the applicationexists. C. Configure a NAT rule for /024 for the database physical router. D. Configure the logical switch to bridge /24 to the physical router of the database. Correct Answer: D /Reference: QUESTION 16 What is the purpose of a DHCP Relay Agent in an NSX Edge configuration? A. Configures virtual machine interfaces to which DHCP messages are relayed. B. Configures Edge interfaces from which DHCP messages are relayed. C. Configures Edge interfaces to which DHCP messages are relayed. D. Configures virtual machine interfaces from which DHCP messages are relayed. Correct Answer: B /Reference: QUESTION 17 A user needs to be given the ability to make configuration changes on a specific NSX Edge device. What role and scope could be used to meet this requirement? A. NSX Administrator role and Limit Access scope B. Security Administrator role and Limit Access scope C. NSX Administrator role and No restriction scope D. Security Administrator role and No restriction scope Correct Answer: B

9 /Reference: QUESTION 18 An administrator needs to verify which port the switch manager is using. Which command should be used? A. show controller-cluster status B. show controller-cluster core stats C. show controller-cluster connections D. show controller-cluster logical-switches Correct Answer: C /Reference: QUESTION 19 If the Applied To scope is set to Distributed Firewall, which virtual machines with have the firewall rule applied? A. Only the virtual machines defined in the Source field. B. Only virtual machines defined in the Destination field. C. All virtual machines in a Datacenter. D. All virtual machines on prepared hosts. Correct Answer: C /Reference: QUESTION 20 Which two NSX rotes could be used to create security policies? (Choose two.) A. Enterprise Administrator

10 B. Security Administrator C. NSX Administrator D. Auditor Correct Answer: AB /Reference: QUESTION 21 Which load balancing algorithm is only available on a vsphere Distributed Switch? A. Route Based on Source MAC Hash B. Route Based on Originating Virtual Port C. Route Based on IP Hash D. Route Based on Physical NIC Load Correct Answer: D /Reference: QUESTION 22 Which action is not an option for adding Virtual Machines to a Security Group? A. Adding Virtual Machines to a Security Group and nesting it within another Security Group. B. Defining Dynamic Membership in the Security Group. C. Adding Virtual Machines to a Security Policy and associating it with a Security Group.

11 D. Selecting objects to include within a Security Group. Correct Answer: C /Reference: QUESTION 23 When running the NSX Control Plane in Hybrid Mode what are the minimum physical network requirements? (Choose three.) A. MTU 1500 B. NSX Controller connectivity C. IGMP Snooping D. Multicast Routing with PIM E. Unicast L3 Routing Correct Answer: BCE /Reference: QUESTION 24 What is a requirement of NSX Data Security? A. NSX manager must be configured for Active Directory integration B. The Global Flow Collection Status must be set to Enabled C. Guest Introspection must be installed on the cluster D. AN IP Pool must be created. Correct Answer: C /Reference:

12 QUESTION 25 From the NSX Edge CLI, which command would show VIP statistics? A. show service loadbalancer pool B. show service loadbalancer virtual C. show service loadbalancer monitor D. show service loadbalancer Correct Answer: B /Reference: QUESTION 26 What is the best practice workflow for a NSX installation to support logical switching? A. Deploy NSX Manager, Configure Logical Switches, Register with vcenter, Deploy Controllers, Prepare hosts B. Deploy NSX Manager, Deploy Controllers, Configure Logical Switches, Register with vcenter, Prepare hosts C. Deploy NSX Manager, Register with vcenter, Prepare hosts, Deploy Controllers, Configure Logical Switches D. Deploy NSX Manager, Register with vcenter, Deploy Controllers, Prepare hosts, Configure Logical Switches Correct Answer: B /Reference: QUESTION 27 A group of users' needs secured access to a set of web-based applications in a SDDC. Which VPN option is best suited for this? A. SSL VPN-Plus B. L2VPN C. IPSec VPN D. Application VPN

13 Correct Answer: A /Reference: QUESTION 28 Which is a prerequisite for deploying an Edge Service Gateway? A. Firewall Default Policy B. An interface C. Default Gateway D. High Availability Correct Answer: B /Reference: QUESTION 29 An administrator is deploying NSX in a Cross-vCenter configuration across three data centers located 100 miles apart Datacenter-1 and Datacenter-3 already have NSX deployed locally and Datacenter-2 does not have NSX deployed yet. What is the correct order of steps to configure all three data centers for this solution? A. 1 Remove the NSX manager from Datacenter-1 and Datacenter-3 2 Reinstall all three NSX managers at the same time 3 Deploy a universal transport zone 4 Deploy a universal distributed logical router B. 1 Deploy an NSX manager at Dataeenter-2 2 Change the roles of the NSX managers in Datacentar-1 and Datacenter-3 to Transit Mode 3 Deploy a universal transport zone 4 Configure the Primary and Secondary roles on all three NSX managers C. 1 Deploy an NSX manager in Datacenter 2 2 Update the NSX manager role in Datacenter-1 to Primary 3 Update the roles in Dafacenter-2 and Datacentar-3 to Secondary 4 Deploy a universal transport zone D. 1 Deploy the NSX manager at Datacenter-2 2 Update the NSX manager role in Datacenter-1 to Primary

14 3 Deploy a universal transport zone 4 Deploy a universal distributed logical router Correct Answer: D /Reference: QUESTION 30 Which two functions are provided by VMkernel ports? (Choose two) A. VXLAN Port Configuration B. vsphere vmotion C. ESXi Host Management D Q VLAN tagging Correct Answer: BC /Reference: QUESTION 31 When deploying a standalone NSX Edge as a Layer 2 VPN client, which port needs to be configured on the client vsphere Distributed Switch? A. Trunk port B. Span port C. Sink port D. Mirror port

15 Correct Answer: A /Reference: QUESTION 32 A security administrator needs to create a Security Group based on an Active Directory group. However, AD Groups are not available as an option. What must the administrator configure before AD Groups are available? A. Guest Introspection virtual machines must be joined to the domain B. Inventory Service must be registered with a domain account C. NSX Manager must be registered with Active Directory D. NSX Controller must be registered with Active Directory Correct Answer: C /Reference: QUESTION 33 What is one of the benefits of a spine-leaf network topology? A. A loop prevention protocol is not required B. Automatic propagation of security policies to all nodes C. Allows for VXl ANs to be defined in h traditional network topology D. Network virtualization relies on spine leaf topologies to create logical switches Correct Answer: D /Reference: QUESTION 34

16 What is the most restrictive NSX role that can be used to create and publish security policies and install virtual appliances? A. Security Administrator B. NSX Administrator C. Auditor D. Enterprise Administrator Correct Answer: D /Reference: QUESTION 35 In a Cross-vCenter implementation, where is the Universal Control Cluster deployed and configured? A. In each vcenter instance associated with the Cross-vCenter implementation. B. In each prepared NSX cluster associated with the Cross-vCenter implementation. C. In every vcenter instance associated with an NSX Manager. D. In the vcenter instance associated with the Primary NSX Manager. Correct Answer: D /Reference: 16) QUESTION 36 An NSX administrator is validating the setup for a new NSX implementation and inputs this command: A. It helps verify that VXLAN segments are functional and the transport network supports the proper MTU size for NSX. B. It helps verify that the source virtual machine is configured with the proper MTU size for NSX.

17 C. It helps verify that the NSX Controller is communicating with the destination VTEP. D. It helps verify that the NSX Logical Switch is routing packets to the destination host. Correct Answer: A /Reference: QUESTION 37 Which type of VPN should be configured to ensure application mobility data centers? A. Application VPN B. L2VPN C. IPSec VPN D. SSL VPN-Plus Correct Answer: B /Reference: 23) QUESTION 38 In a Cross-vCenter NSX deployment, what are two requirements that must be met in order for an administrator to deploy both universal logical switches and local logical switches within the same vcenter instance? (Choose two ) A. A universal distributed logical router must be created B. A logical distributed router must be created C. A universal transport zone must be created. D. A local transport zone must be created Correct Answer: CD /Reference:

18 QUESTION 39 What is one of the benefits of using logical switches in an NSX environment? A. IP subnet definitions can be migrated into logical switches using the NSX Manager. B. Quality of Service parameters are automatically configured in a logical switch C. The physical infrastructure is responsible for maintaining the logical switch broadcast tables D. The physical infrastructure is not constrained by MAC/FIB table limits. Correct Answer: D /Reference: QUESTION 40 The fact that NSX Data Security has visibility into sensitive data provides which two benefits? (Choose two ) A. It helps address compliance and risk management requirements. B. It acts as a forensic tool to analyze TCP and UDP connections between virtual machines C. It is able to trace packets between a source and destination without requiring access to the guestos D. It eliminates the typical agent footprint that exists with legacy software agents Correct Answer: AB /Reference: QUESTION 41 Which is a best practice to secure system traffic, ensure optimal performance and satisfy prerequisites for NSX? A. Configure a single VMkernel and a single distributed port group for all the system traffic. B. Configure a single distributed port group with a single VMkernel for Management and iscsi traffic, a separate VMkernel for vmotion and VSAN traffic. C. Dedicate separate VMkernel adapters for each type of system traffic. Dedicate separate distributed port groups for each VMkernel adapter and isolate the VLANs for each type of system traffic.

19 D. Dedicate separate VMkernel adapters for each type ofsystem traffic and dedicate separate standard switches for each type of system traffic connected to a single physical network. Correct Answer: B /Reference: QUESTION 42 Which port is used for NSX REST API Requests? A. 80 B. 443 C D Correct Answer: B /Reference: QUESTION 43 An administrator is attempting to troubleshoot a routing issue between the Edge Services Gateway (ESG) and the Distributed Logical Router (DLR).

20 Based on the exhibit, which method CANNOT be used to troubleshoot the issue? A. SSH session into on the ESG. B. Console session into the ESG. C. Console session into the DLR. D. SSH session into on the DLR. Correct Answer: A /Reference: QUESTION 44

21 When specifying a source for a security rule, what is the purpose of the Negates Source check box? A. If Negate Source is selected, the rule is sent to only the objects identified under object type. B. If Negate Source is selected, the rule is applied to traffic coming from all sources except for the source identified under the object type. C. If Negate Source is not selected, the rule is applied to traffic coming from all sources except for the source identified under the object type. D. If Negate Source is not selected, the rule is sent to only the objects identified under the object type. Correct Answer: B /Reference: QUESTION 45 What are two benefits of the NSX Distributed Firewall? (Choose two ) A. VMs are protected even as they are vmotioned

22 B. Each VM is individually protected by a L2-L4 stateful firewall C. ESXi hosts are automatically protected by a distributed firewall D. VXLANs are automatically protected by the Transport Zone definition Correct Answer: AC /Reference: QUESTION 46 How many vcenter Server environments can a single NSX Manager serve at one time? A vcenter Servers B. 10 vcenier Servers C. 1 vcenler Server D. 2 vcenter Servers Correct Answer: C /Reference: QUESTION 47 A new ESXi host was added to an existing cluster, prepared for NSX and enabled for Distributed Firewall, logical switching and Logical Routing. The Most Preparation page in the NSX Web Ul shows this new host is in Ready state and the Logical Network Preparation tab displays the VXLAN VTEPs are correctly configured. Virtual machines on the new host can communicate with each other but CANNOT communicate with VMs running on other hosts and connected to the same Logical Switch. Which condition below will result in the described behavior on the new host? A. NSX Edge is powered off

23 B. Host Agent (vpxa) to vcenter is disconnected C. Rabbitmq message bus connection (vsfwd) to NSX Manager is down D. Network Control Plane Agent (netcpa) connection to the controller is down Correct Answer: B /Reference: QUESTION 48 What resource must a partner security service be registered with before the service is available to a policy? A. NSX Manager B. ESXi host C. Service Composer D. vcenter Server Correct Answer: A /Reference: enforcement-nsx-service-composer.html QUESTION 49

24 What configuration change do you need to make to allow this connection? A. Change Applied On to "Uplink" B. Change the Translated Port/Range to "rdp" C. Swap the Original IP/Range and Translated IP/Range IP Addresses D. Change the Protocol to "any" Correct Answer: C /Reference: QUESTION 50 An administrator is deploying NSX to secure the virtual environment. NSX Manager has been deployed and register with it, Which additional step is required before

25 the distributed firewall is functional? A. Configure VTEPs on each host B. Perform host preparation on the cluster C. Deploy the NSX Controller cluster D. Enable Guest Introspection Correct Answer: C /Reference: QUESTION 51 Which two options are correct regarding vsphere Distributed Switches? (Choose two ) A. A single vds can span multiple vcenter Servers B. A single host can be attached to multiple vds C. A single vds can span multiple hosts across multiple clusters D. A vds is automatically created when a new 802.1Q trunk is configured Correct Answer: AB /Reference: QUESTION 52 What are the correct steps for connecting a virtual machine to a logical switch? A. Select the logical switch, click the Add Virtual Machine Icon, select the VM, select the vnic to connect B. Select the Add Virtual Machine icon, select the logical switch, vnic to connect C. Select the logical switch, select the virtual machine, click the Add Virtual Machine.con. select the vnic to connect D. Select the vnic, click the Add Virtual Machine Icon, select the logical switch Correct Answer: A

26 /Reference: QUESTION 53 Which virtual machine does VMware recommend be manually excluded from the Distributed Firewall? A. NSX Manager B. vcenter Server C. Microsoft SQL Server D. vrealize Automation Appliance Correct Answer: B /Reference: QUESTION 54 Which two statements are true regarding L2 Bridges and Distributed Logical Routers? (Choose two ) A. Each L2 bridge instance can only map to a single VLAN B. There can only be one instance of an L2 bridge on a DLR C. There can be multiple instances of an L2 bridge on a DLR D. Each L2 bridge instance can map to multiple VLANs. Correct Answer: AC /Reference: QUESTION 55 An administrator enables the NSX Ticket Logger to track infrastructure changes. The administrator logs out for lunch, returns and logs back in to complete the task. What is the status of ticket logger when the administrator logs back in?

27 A. The ticket logger still tracks changes until it is turned off by the administrator. B. The ticket logger is turned off. C. The ticket logger will prompt the user if they still want to continue tracking changes. D. The ticket logger will display an error. Correct Answer: B /Reference: QUESTION 56 Which three ways can membership be defined in a dynamic security group? (Choose three) A. Distributed Firewall Rules B. Locale ID C. Security Tags D. Security Groups E. Regular Expressions Correct Answer: BCD /Reference: QUESTION 57 A Service Provider is using VMware vcloud Director with VMware vcloud Networking and Security (VCNS) on vsphere. Which two products will be impacted by the upgrade of VCNS to VMware NSX? (Choose two) A. ESXi hosts B. NSX Controller Cluster C. vshield Manager D. vcenter Server

28 Correct Answer: BD /Reference: QUESTION 58 What are two requirements of the network infrastructure to the access layer? (Choose two ) A. IPv4 connectivity among ESXi hosts provided by a spine-leaf network design. B. IPv4 connectivity among ESXi hosts. C. Increased MTU if the virtual machines are using the default MTU size of D. A Redundant, Layer 3, Top-of-Rack network design to provide high availability to ESX hosts. Correct Answer: AC /Reference: QUESTION 59 In a vsphere Distributed Switch architecture, which plane handles packet switching? A. Data Plane B. Forwarding Plane C. Management Plane D. Control Plan Correct Answer: A

29 /Reference: design-and-best-practices(slide 7) QUESTION 60 Which details can an administrator verify from the Summary tab of the VMware NSX Manager? (Choose three) A. Current time B. Average MTBF C. Version D. Storage utilization E. Health Score Correct Answer: ACD /Reference: QUESTION 61 How is high availability of the NSX Edge Gateway accomplished? A. HA Application Monitoring on the Edge Gateway sends a heartbeat to the ESXi host. B. VMware Tools on the Edge Gateway sends a heartbeat to the ESXi host. C. The Edge appliance sends a heartbeat through an uplink interface. D. The Edge appliance sends a heartbeat through an internal interface. Correct Answer: D /Reference: QUESTION 62 An NSX administrator notices an error during the initial configuration of the SSO lookup service, as shown:

30 The administrator pulls up the lookup service status, which displays Disconnected.

31 What step should be performed to resolve this issue? A. Change the Port number from 7444 to 443 B. Change the SSO Administrator User Name C. Regenerate the SSL Certificate and reboot the NSX Manager D. Use IP address versus the DNS name in the Lookup Service Correct Answer: C /Reference: QUESTION 63 An application requires load balancing with minimal impact to network performance. An NSX administrator is deploying a load balancer to meet the stated requirements. Which load balancing engine should be deployed? A. Layer 5 B. Layer 6 C. Layer 7 D. Layer 4 Correct Answer: D /Reference:

32 QUESTION 64 A user has configured a specific distributed firewall rule preventing VM-A ( ) on the Web-Logical Switch to communicate to VM-B ( ), running on the same switch. After the changes, the user is still able to communicated to VM-A from VM-B. To debug this anomaly, the user will need to obtain logs from which component? A. The Distributed Logical Router B. The Edge Services Gateway C. The appropriate ESXi Hosts(s) D. The appropriate NSX Controller(s) Correct Answer: C /Reference: QUESTION 65 Which tool is used to detect rogue services? A. NSX Logical Firewall B. NSX Logical Router C. Activity Monitoring D. Flow Monitoring Correct Answer: D /Reference: QUESTION 66 Which are two uses of the NSX DLR protocol address? (Choose two.) A. When configuring BGP the protocol address is used to forward traffic to peers. B. When configuring BGP the protocol address is used by the protocol to form adjacencies with peers.

33 C. When configuring OSPF the protocol address is used to forward traffic to peers. D. When configuring OSPF the protocol address is used by the protocol to form adjacencies with peers. Correct Answer: BD /Reference: For a logical router a Click Edit at the top right corner of the window. b Click Enable OSPF. c In Forwarding Address, type an IP address that is to be used by the router datapath module in the hosts to forward datapath packets. d In Protocol Address, type a unique IP address within the same subnet as the Forwarding Address. Protocol address is used by the protocol to form adjacencies with the peers From < QUESTION 67 Which two NSX Data Security roles could be assigned to view configured policies and violation reports? (Choose two.) A. Security Administrator B. NSX Administrator C. Auditor D. Enterprise Administrator Correct Answer: AC /Reference: QUESTION 68 When defining membership for a security group, which three identifiers can be used for dynamic inclusion? (Choose Three)

34 A. VM folder B. Computer OS Name C. ESXi host D. VM Name E. Security Tag Correct Answer: BDE /Reference: QUESTION 69 With which Application Profile types would the Insert X-Forwarded-for HTTP header option be used? A. TCP, UDP B. HTTP, UDP C. HTTP, HTTPS D. HTTP, TCP Correct Answer: C /Reference: QUESTION 70 A network administrator is troubleshooting an issue and needs to observe an injected packet as it passes through the physical and logical network. Which tool will accomplish this? A. Traceflow B. NetFlow C. Flow Monitoring D. Activity Monitoring

35 Correct Answer: A /Reference: QUESTION 71 Which two are accurate statements with regards to Guest Introspection installation? (Chose two ) A. The service virtual machine performs data security and activity monitoring. B. The installation deploys a virtual machine to hosts prepared for VMware NSX. C. A security policy weight of 4300 is assigned to hosts prepared to Guest Introspection. D. Guest Introspection is deployed with NSX Data Security by default. Correct Answer: AB /Reference: Installing Guest Introspection automatically installs a new VIB and a service virtual machine on each host in the cluster. Guest Introspection is required for NSX Data Security, Activity Monitoring, and several third-party security solutions. From < QUESTION 72 Which two network services are abstracted from the underlying hardware by NSX? (Choose two.) A. Virtual Private Networks B. Multiprotocol Label Switching C. Load Balancing D. Overlay Transport Virtualizations

36 Correct Answer: AC /Reference: QUESTION 73 What is the minimum NSX role necessary for a user to edit the firewall on an Edge Services Gateway (ESG)? A. Auditor B. NSX Administrator C. Enterprise Administrator D. Security Administrator Correct Answer: D /Reference: QUESTION 74 In a Cross-vCenter environment where is information about local logical switches and local logical routers maintained? A. Platform Services Controller B. Local transport /one C. Local Controller Cluster D. Universal Controller Cluster Correct Answer: D /Reference: QUESTION 75 You have deployed an Edge Services Gateway with the following interface configuration:

37 Your customer has requested that you provide the ability to use Remote Desktop Protocol to log into a virtual machine that has a tenant IP address of using the provider IP address You have performed the following configuration however, you cannot RDP into the virtual machine.

38 What configuration change do you need to make to allow this connection? A. Change Applied Onto "Uplink" B. Change the Protocol to "any". C. Change the Translated Port/Range to "rdp". D. Swap the Original IP/Range and Translated IP/Range IP Addresses. Correct Answer: A

39 /Reference: QUESTION 76 Activity Monitoring has been enabled for a host with several virtual machines. However, only one virtual machine appears in the list. Which two additional configuration steps are required to allow the other virtual machines on the host to be selected? (Choose two.)

40 A. Guest Introspection driver must be installed. B. Virtual Machine Data Collection must be enabled on the other VMs. C. NSX Manager must be linked to Active Directory D. Guest Introspection appliance must be deployed on the host. Correct Answer: AB /Reference: As it shows one VM on the mentioned ESXi host, so C and D working correctly, it shout be A and B To protect VMs using a Guest Introspection security solution, you must install Guest Introspection thin agent, also called Guest Introspection drivers, From < Guest Introspection supports File Introspection in Linux for anti-virus only. To protect Linux VMs using a Guest Introspection security solution, you must install the Guest Introspection thin agent. From < QUESTION 77 The user at can reach the physical router but CANNOT reach edge-2 or any virtual machines.

41 What routing change would resolve the issue? A. Enable Default Originate on edge-2 for OSPF. B. Configure static routes on the physical router. C. Enable route redistribution on edge-2 between both routing protocols. D. Enable Default Originate on edge-2 for BGP Correct Answer: D /Reference: QUESTION 78 Which tool is used to display VXLAN connection information?

42 A. pktcap-uw B. NSX Controller CLI C. esxtop D. VDS Health Check Correct Answer: B /Reference: QUESTION 79 Internet access is required from virtual machines located on any logical switch Direct access from the internet to these virtual machines is NOT permitted Which perimeter NSX Edge feature would achieve this with the least configuration? A. LB B. VPN C. SNAT D. DNAT Correct Answer: D

43 /Reference: QUESTION 80 You are creating a Unrversal Segment ID Pool for a three site Cross-vCenter environment. The three sites are designated as Site A, Site B and Site C, * Site A has a local Segment ID pool of * Site B has a local Segment ID pool of * Site C has a local Segment ID pool of Which of the following ranges would be valid for the Universal Segment ID pool? A B C D Correct Answer: D /Reference: QUESTION 81 A customer has Cisco Nexus 1000V switches in their environment and is looking at deploying NSX Which statement is correct? A. The environment must be migrated from the Nexus 1000V to vsphere Distributed Switches. B. The environment must be configured for VXLAN over the Nexus 1000V. C. The environment can use the Nexus 1000V switches for the NSX deployment. D. The environment must be migrated from the Nexus 1000V to vsphere Standard Switches. Correct Answer: A /Reference:

44 QUESTION 82 Your environment has two sites designated as Site A and Site B. Each site has its own vcenler Server instance with NSX installed and configured in standalone mode. You are migrating the environment to Cross vcenter and have already promoted Site A to the Primary role. What action must be taken before the NSX Manager at Site B can be changed to Secondary? A. Migrate the Site B Controllers to Site A B. Convert the Site B Controllers to Universal Controllers C. Remove any logical switches from the Site B NSX Controller. D. Delete the Controllers at Site B Correct Answer: B /Reference: QUESTION 83 Which is required to support unicast mode in NSX? A. Hardware VTEP B. Distributed Logical Router C. NSX Controller D. NSX Edge Correct Answer: C /Reference: QUESTION 84 An administrator has implemented VMware NSX on a leaf-spine underlay. They have deployed the following in the data center: * Two racks for a management cluster that is not prepared for VMware NSX * Six racks for compute clusters * Two racks for an Edge cluster which holds a DLR control VM for bridging, and North/South Edge Service Gateways Which three of the following are true regarding the physical and logical networking of the environment? (Choose three )

45 A. At least one VXLAN segment spans across all the racks B. VXLAN segments span the compute and Edge racks C. At least one VLAN spans the compute racks D. At least one VLAN spans across the two management racks E. At least 2 VLANs span across the two Edge racks. Correct Answer: BCD /Reference: QUESTION 85 An administrator has been asked to provide single failure redundancy. What is the minimum supported number of NSX Controllers needed to meet this requirement? A. 2 B. 3 C. 1 D. 5 Correct Answer: B /Reference: QUESTION 86 An NSX Administrator is examining traffic on the network shown below.

46 What is the packet flow when VM1 communicates to VM5? A. Host A will perform a destination lookup, route the packet, switch the packet onto segment 5002, then encapsulate and send the packet to Host C. B. Host A will perform a destination lookup, switch the packet onto segment 5002, route the packet, then encapsulate the packet and send it to the DLR control VM. C. Host A will encapsulate thepacket, send the encapsulated packet to host C, Host C will perform a destination lookup and switch the packet onto segment D. Host A will encapsulate the packet, perform a destination lookup, route the packet to the DLR control VM, the control DLR will bridge the packet onto segment Correct Answer: D

47 /Reference: QUESTION 87 Which NSX component can validate that security policies at your organization are being enforced correctly? A. Activity Monitoring B. Flow Monitoring C. ERSPAN D. Distributed firewalls Correct Answer: A /Reference: QUESTION 88 In which VMware NSX use case would VXLAN NOT be required? A. L2 Bridging physical to virtual B. NSX micro-segmentation C. Active/Active Datacenter D. Distributed Logical Routing Correct Answer: C /Reference: QUESTION 89 Which three methods can be used by the NSX Distributed Firewall to discover IP addresses? (Choose three ) A. DHCP Snooping

48 B. IP Sets C. Spoofguard configured for Trust on First Use. D. VMware Tools installed on every guest virtual machine. E. ARP Spoofing Correct Answer: ACD /Reference: QUESTION 90 Which highly available Edge design would provide high bandwidth and isolation to four application networks? A. Four Distributed Routers (standalone mode) with one Edge Services Gateway in Active/Standby mode. B. One Edge Services Gateway in ECMP mode. C. One distributed Router (in HA mode) with two Edge Services Gateways in ECMP mode. D. Four Distributed Routers (in HA mode) with one Edge Services Gateway in Active/Standby mode. Correct Answer: C /Reference: QUESTION 91 An NSX Administrator is examining a broken set of firewall rules and discovers that the Block Telnet rule was created in the wrong section.

49 Based on the exhibit, which option would correct the issue with the least amount of effort? A. Use the Merge Section functionality to correct this. B. Use the Move rule Up icon to move rules between sections. C. Add a new rule called Block Telnet to the correct section and then remove the existing rule. D. Delete the rule and then re-add the rule to the correct section. Correct Answer: D /Reference: QUESTION 92 Which three objects are supported for universal synchronization in a Cross-vCenter NSX deployment? (Choose three)

50 A. IP Pools B. IP Sets C. L2 bridges D. MAC Sets E. Transport Zones Correct Answer: BDE /Reference: QUESTION 93 Which two methods does VMware NSX offer to integrate with third-party partners? (Choose two ) A. Integration Manager B. Service Chaining C. VMware NSX APIs D. Universal Synchronization Service Correct Answer: AC /Reference: EA477D96-E2D3-488B-90AA-2F19B4AE327D QUESTION 94 Which two NSX Data Security roles could be used to create security policies? (Choose two) A. Auditor B. NSX Administrator C. Enterprise Administrator D. Security Administrator

51 Correct Answer: CD /Reference: QUESTION 95 A network administrator has been tasked with deploying a 3-tier application across two data centers. Tier-1 and tier-2 will be located in Datacenter-A and tier-3 will be located in Datacenter-B. Which NSX components are needed to make this deployment functional? A. A universal transport zone deployed with a universal distributedlogical router (UDLR), a universal logical switch and two local logical switches connected to the UDLR. B. A universal transport zone deployed with a universal distributed logical router (UDLR), two universal logical switches and a single logical switch connected to the UDLR. C. A universal transport zone deployed with a universal distributed logical router (UDLR) and three universal logical switches connected to the UDLR. D. A universal transport zone, a universal distributed logical router (UDLR) and three local switches in each data center connected to the UDLR Correct Answer: A /Reference: QUESTION 96 Which two networking and security components are contained m the backup configuration data of an NSX Manager backup file? (Choose two ) A. vsphere Distributed Switch B. Resource Pools C. Edge Services Gateway D. Grouping Objects Correct Answer: CD /Reference:

52 QUESTION 97 Which component automates the consumption of third-party services and provides mapping to virtual machines using a logical policy? A. NSX Manager B. Cloud Management Platform (CMP) C. Service Composer D. NSX Data Security Correct Answer: C /Reference: QUESTION 98 Which three options are true about NSX logical bridges? (Choose three) A. A logical bridge configured for HA uses a 15 second heartbeat by default to detect failure. B. A logical bridge configured for HA uses (BFD) Bi-Directional Forwarding to detect a failure in a minimum of one second C. A logical bridge on the DLR supports VXLAN to VLAN bridging. D. A logical bridge forwards traffic through the control VM. E. A logical bridge forwards traffic through the hypervisor. Correct Answer: ACE /Reference: From < All NSX Edge services run on the active appliance. The primary appliance maintains a heartbeat with the standby appliance and sends service updates through an internal interface. If a heartbeat is not received from the primary appliance within the specified time (default value is 15 seconds), the primary appliance is declared dead Page 197 QUESTION 99 An organization has PCI compliant application deployed as part of a larger NSX environment.every year a team of contractors evaluates the security of the

53 environment and recommends changes. What NSX Role and Scope should the contractors be given to minimize access but still allow them to fulfill the staled requirement? A. Security Administrator, No restrictions B. Auditor. Limit access scope C. NSX Administrator, Limit access scope D. Enterprise Administrator, Limit access scope Correct Answer: B /Reference: VMware_SDDC_Validated_Reference_Architecture_for_PCI_v3.0_June_2014b b9e7e4c6aa280f5fd9df5a0f.pdf Page 3 VMware NSX VMware NSX Edge, VMware NSX Firewall, VMware NSX Router, VMware NSX Load Balancer, and, VMware NSX Service Composer QUESTION 100 A workload was attached to a logical switch port group in Compute Cluster 1. Users are complaining that I hey can communicate with other workloads on that port group in the cluster, but not with other workloads on different networks. What is the most probable cause? A. The distributed firewall has a default rule set to deny all B. The Distributed Logical Router was not configured on Compute Cluster 1 C. Compute Cluster 1 is NOT a member of the Transport Zone D. An NSX Edge has NOT been deployed into Compute Cluster 1

54 Correct Answer: A /Reference: QUESTION 101 An NSX Edge Service Gateway has two interfaces: * Internal interface named Internal Access -- IP address = Network mask = * Uplink interface named Physical Uplink -- IP address = Network mask = A vsphere administrator wants to add a SNAT rule to allow traffic from the internal network segment to access external resources via the uplink interface. Which three steps should the vsphere administrator do to add the SNAT rule? (Choose three.) A. Apply the SNAT rule to the Internal Access interface. B. Select as the translated source IP. C. Apply the SNAT rule on the Physical Uplink interface. D. Select /24 as the original subnet. E. Choose as the translated source IP address. Correct Answer: CDE /Reference: QUESTION 102 What are two things that should be done before upgrading from vcloud Networking and Security to NSX? (Choose two.) A. Power off vshield Manager B. Deploy NSX Manager virtual appliance C. Uninstall vshield Data Security D. Ensure that forward and reverse DNS is functional

55 Correct Answer: CD /Reference: