Accurate VMware 2V0-41.23 Training Online

NEW QUESTION 1
An NSX administrator is using ping to check connectivity between VM1 running on ESXi1 to VM2 running on ESXi2. The ping tests fails. The administrator knows the maximum transmission unit size on the physical switch is 1600.
Which command does the administrator use to check the VMware kernel ports for tunnel end point communication?

• A. esxcli network diag ping -I vmk0O -H <destination IP address>
• B. vmkping ++netstack=geneve -d -s 1572 <destination IP address>
• C. esxcli network diag ping -H <destination IP address>
• D. vmkping ++netstack=vxlan -d -s 1572 <destination IP address>

Answer: B

Explanation:
The command vmkping ++netstack=geneve -d -s 1572 <destination IP address> is used to check the VMwar kernel ports for tunnel end point communication. This command uses the geneve netstack, which is the default netstack for NSX-T. The -d option sets the DF (Don’t Fragment) bit in the IP header, which prevents the packet from being fragmented by intermediate routers. The -s 1572 option sets the packet size to 1572 bytes, which is the maximum payload size for a geneve encapsulated packet with an MTU of 1600 bytes.
The <destination IP address> is the IP address of the remote ESXi host or VM. References: : VMware NS Data Center Installation Guide, page 19. : VMware Knowledge Base: Testing MTU with the vmkping command (1003728). : VMware NSX-T Data Center Administration Guide, page 102.

NEW QUESTION 2
When running nsxcli on an ESXi host, which command will show the Replication mode?

• A. get logical-switch <Local-Switch-UUID> status
• B. get logical-switch <Logical-Switch-UUID>
• C. get logical-switches
• D. get logical-switch status

Answer: B

NEW QUESTION 3
Which two statements are correct about East-West Malware Prevention? (Choose two.)

• A. A SVM is deployed on every ESXi host.
• B. NSX Application Platform must have Internet access.
• C. An agent must be installed on every ESXi host.
• D. An agent must be installed on every NSX Edge node.
• E. NSX Edge nodes must have Internet access.

Answer: AE

Explanation:
East-West Malware Prevention is a feature of NSX Advanced Threat Prevention that can detect and prevent malicious files in the network traffic between virtual machines (east-west) and between the data center and the external network (north-south). To enable this feature, a Service Virtual Machine (SVM) is deployed on every ESXi host to intercept and analyze the files in the east-west traffic. An agent must also be installed on every NSX Edge node to intercept and analyze the files in the north-south traffic. The NSX Application Platform is a cloud-based service that provides threat intelligence and analysis for the NSX Malware Prevention feature. The NSX Application Platform must have Internet access to receive updates and send files for analysis. The NSX Edge nodes must also have Internet access to communicate with the NSX Application Platform.
References:
Overview of NSX IDS/IPS and NSX Malware Prevention
Administering NSX Malware Prevention

NEW QUESTION 4
Refer to the exhibit.
An administrator configured NSX Advanced Load Balancer to load balance the production web server traffic, but the end users are unable to access the production website by using the VIP address.
Which of the following Tier-1 gateway route advertisement settings needs to be enabled to resolve the problem? Mark the correct answer by clicking on the image.

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 5
An NSX administrator is creating a Tier-1 Gateway configured In Active-Standby High Availability Mode. In the event of node failure, the failover policy should not allow the original tailed node to become the Active node upon recovery.
Which failover policy meets this requirement?

• A. Non-Preemptive
• B. Preemptive
• C. Enable Preemptive
• D. Disable Preemptive

Answer: A

Explanation:
According to the VMware NSX Documentation, a non-preemptive failover policy means that the original failed node will not become the active node upon recovery, unless the current active node fails again. This policy can help avoid unnecessary failovers and ensure stability.
The other options are either incorrect or not available for this configuration. Preemptive is the opposite of non-preemptive, meaning that the original failed node will become the active node upon recovery, if it has a higher priority than the current active node. Enable Preemptive and Disable Preemptive are not valid options for the failover policy, as the failover policy is a drop-down menu that only has two choices: Preemptive and Non-Preemptive.

NEW QUESTION 6
Which CLI command shows syslog on NSX Manager?

• A. get log-file auth.lag
• B. /var/log/syslog/syslog.log
• C. show log manager follow
• D. get log-file syslog

Answer: D

Explanation:
According to the VMware NSX CLI Reference Guide, this CLI command shows the syslog messages on the NSX Manager node. You can use this command to view the system logs for troubleshooting or monitoring purposes.
The other options are either incorrect or not available for this task. get log-file auth.log is a CLI command that shows the authentication logs on the NSX Manager node, not the syslog messages. /var/log/syslog/syslog.log is not a CLI command, but a file path that may contain syslog messages on some Linux systems, but not on the NSX Manager node. show log manager follow is not a valid CLI command, as there is no show log command or manager option in the NSX CLI.
## NSX Cli command get log-file <fiilename>
get log-file <filename> follow
# Below are commonly used log files, there are many more log files
get log-file <auth.log | controller | controller-error | http.log | kern.log | manager.log | node-mgmt.log | policy.log | syslog> [follow]
# use [follow] to continuing monitor Example: get log-file syslog follow get log-file syslog

NEW QUESTION 7
Which two statements are true for IPSec VPN? (Choose two.)

• A. VPNs can be configured on the command line Interface on the NSX manager.
• B. IPSec VPN services can be configured at Tler-0 and Tler-1 gateways.
• C. IPSec VPNs use the DPDK accelerated performance library.
• D. Dynamic routing Is supported for any IPSec mode In NSX.

Answer: BC

Explanation:
According to the VMware NSX 4.x Professional documents and tutorials, IPSec VPN secures traffic flowing between two networks connected over a public network through IPSec gateways called endpoints. NSX Edge supports a policy-based or a route-based IPSec VPN. Beginning with NSX-T Data Center 2.5, IPSec VPN services are supported on both Tier-0 and Tier-1 gateways1. NSX Edge also leverages the DPDK accelerated performance library to optimize the performance of IPSec VPN2.

NEW QUESTION 8
Which command Is used to test management connectivity from a transport node to NSX Manager?

• A. esxcli network ip connection list | grep 1234
• B. esxcli network connection list | grep 1235
• C. esxcli network ip connection list | grep 1235
• D. esxcli network connection list | grep 1234

Answer: A

Explanation:
The NSX Manager management plane communicates with the transport nodes by using APH Server over NSX-RPC/TCP through port 1234. CCP communicates with the transport nodes by using APH Server over NSX-RPC/TCP through port 1235.

NEW QUESTION 9
Which three DHCP Services are supported by NSX? (Choose three.)

• A. Gateway DHCP
• B. Port DHCP per VNF
• C. Segment DHCP
• D. VRF DHCP Server
• E. DHCP Relay

Answer: ACE

Explanation:
According to the VMware NSX Documentation1, NSX-T Data Center supports the following types of DHCP configuration on a segment:
Local DHCP server: This option creates a local DHCP server that has an IP address on the segment and provides dynamic IP assignment service only to the VMs that are attached to the segment.
Gateway DHCP server: This option is attached to a tier-0 or tier-1 gateway and provides DHCP service to the networks (overlay segments) that are directly connected to the gateway and configured to use a gateway DHCP server.
DHCP Relay: This option relays the DHCP client requests to the external DHCP servers that can be in any subnet, outside the SDDC, or in the physical network.

NEW QUESTION 10
Where in the NSX UI would an administrator set the time attribute for a time-based Gateway Firewall rule?

• A. The option to set time-based rule is a clock Icon in the rule.
• B. The option to set time based rule is a field in the rule Itself.
• C. There Is no option in the NSX U
• D. It must be done via command line interface.
• E. The option to set time-based rule is a clock Icon in the policy.

Answer: D

Explanation:
According to the VMware documentation1, the clock icon appears on the firewall policy section that you want to have a time window. By clicking the clock icon, you can create or select a time window that applies to all the rules in that policy section. The other options are incorrect because they either do not exist or are not related to the time-based rule feature. There is no option to set a time-based rule in the rule itself, as it is a policy-level setting. There is also an option to set a time-based rule in the NSX UI, so it does not require using the command line interface.
https://docs.vmware.com/en/VMware-NSX/4.1/administration/GUID-8572496E-A60E-48C3-A016-4A081AC8

NEW QUESTION 11
Which two choices are use cases for Distributed Intrusion Detection? (Choose two.)

• A. Use agentless antivirus with Guest Introspection.
• B. Quarantine workloads based on vulnerabilities.
• C. Identify risk and reputation of accessed websites.
• D. Gain Insight about micro-segmentation traffic flows.
• E. Identify security vulnerabilities in the workloads.

Answer: BE

Explanation:
According to the VMware NSX Documentation, these are two of the use cases for Distributed Intrusion Detection, which is a feature of NSX Network Detection and Response:
Quarantine workloads based on vulnerabilities: You can use Distributed Intrusion Detection to detect vulnerabilities in your workloads and apply quarantine actions to isolate them from the network until they are remediated.
Identify security vulnerabilities in the workloads: You can use Distributed Intrusion Detection to scan your workloads for known vulnerabilities and generate reports that show the severity, impact, and remediation steps for each vulnerability.

NEW QUESTION 12
Which three of the following describe the Border Gateway Routing Protocol (BGP) configuration on a Tier-0 Gateway? (Choose three.)

• A. Can be used as an Exterior Gateway Protocol.
• B. It supports a 4-byte autonomous system number.
• C. The network is divided into areas that are logical groups.
• D. EIGRP Is disabled by default.
• E. BGP is enabled by default.

Answer: ABD

Explanation:
* A. Can be used as an Exterior Gateway Protocol. This is correct. BGP is a protocol that can be used to exchange routing information between different autonomous systems (AS). An AS is a network or a group of networks under a single administrative control. BGP can be used as an Exterior Gateway Protocol (EGP) to connect an AS to other ASes on the internet or other external networks1
* B. It supports a 4-byte autonomous system number. This is correct. BGP supports both 2-byte and 4-byte AS numbers. A 2-byte AS number can range from 1 to 65535, while a 4-byte AS number can range from 65536 to 4294967295. NSX supports both 2-byte and 4-byte AS numbers for BGP configuration on a Tier-0 Gateway2
* C. The network is divided into areas that are logical groups. This is incorrect. This statement describes OSPF, not BGP. OSPF is another routing protocol that operates within a single AS and divides the network into areas to reduce routing overhead and improve scalability. BGP does not use the concept of areas, but rather uses attributes, policies, and filters to control the routing decisions and traffic flow3
* D. FIGRP Is disabled by default. This is correct. FIGRP stands for Fast Interior Gateway Routing Protocol, which is an enhanced version of IGRP, an obsolete routing protocol developed by Cisco. FIGRP is not supported by NSX and is disabled by default on a Tier-0 Gateway.
* E. BGP is enabled by default. This is incorrect. BGP is not enabled by default on a Tier-0 Gateway. To enable BGP, you need to configure the local AS number and the BGP neighbors on the Tier-0 Gateway using the NSX Manager UI or API.
To learn more about BGP configuration on a Tier-0 Gateway in NSX, you can refer to the following resources:
VMware NSX Documentation: Configure BGP 1
VMware NSX 4.x Professional: BGP Configuration
VMware NSX 4.x Professional: BGP Troubleshooting

NEW QUESTION 13
Refer to the exhibits.
Drag and drop the NSX graphic element icons on the left found in an NSX Intelligence visualization graph to Its correct description on the right.

• A. Yes
• B. Not Mastered

Answer: A

NEW QUESTION 14
Which three NSX Edge components are used for North-South Malware Prevention? (Choose three.)

• A. Thin Agent
• B. RAPID
• C. Security Hub
• D. IDS/IPS
• E. Security Analyzer
• F. Reputation Service

Answer: BCD

Explanation:
https://docs.vmware.com/en/VMware-NSX/4.1/administration/GUID-69DF70C2-1769-4858-97E7-B757CAED

NEW QUESTION 15
How does the Traceflow tool identify issues in a network?

• A. Compares the management plane configuration states containing control plane traffic and error reporting from transport node agents.
• B. Compares intended network state in the control plane with Tunnel End Point (TEP) keepalives in the data plane.
• C. Injects ICMP traffic into the data plane and observes the results in the control plane.
• D. Injects synthetic traffic into the data plane and observes the results in the control plane.

Answer: D

Explanation:
The Traceflow tool identifies issues in a network by injecting synthetic traffic into the data plane and observing the results in the control plane. This allows the tool to identify any issues in the network and provide a detailed report on the problem. You can use the Traceflow tool to test connectivity between any two endpoints in your NSX-T Data Center environment.

NEW QUESTION 16
Which CLI command would an administrator use to allow syslog on an ESXi transport node when using the esxcli utility?

• A. esxcli network firewall ruleset set -r syslog -e true
• B. esxcli network firewall ruleset -e syslog
• C. esxcli network firewall ruleset set -r syslog -e false
• D. esxcli network firewall ruleset set -a -e false

Answer: A

Explanation:
To allow syslog on an ESXi transport node, the administrator needs to use the esxcli utility to enable the syslog ruleset in the ESXi firewall. The correct syntax for this command is esxcli network firewall ruleset set
-r syslog -e true, where -r specifies the ruleset name and -e specifies whether to enable or disable it. The options are incorrect because they either use an invalid syntax, such as omitting the ruleset name or
using -a instead of -r, or they disable the syslog ruleset instead of enabling it, which is the opposite of what
question asks. References: [ESXi Firewall Command-Line Interface], [Configure Syslog on ESXi Hosts]

NEW QUESTION 17
......