VMware 2V0-41.23 問題集

質問 1：
Which two steps must an NSX administrator take to integrate VMware Identity Manager in NSX to support role-based access control? (Choose two.)
A. Enter the service URL, Client Secret, and SSL thumbprint in NSX Manager.
B. Create a SAML authentication in VMware Identity Manager using the NSX Manager FQDN.
C. Add NSX Manager as a Service Provider (SP) in VMware Identity Manager.
D. Enter the Identity Provider (IdP) metadata URL in NSX Manager.
E. Create an OAuth 2.0 client in VMware Identity Manager.
正解：A,E
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Which command Is used to test management connectivity from a transport node to NSX Manager?
A. esxcli network connection list | grep 1234
B. esxcli network ip connection list | grep 1235
C. esxcli network ip connection list | grep 1234
D. esxcli network connection list | grep 1235
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Sort the rule processing steps of the Distributed Firewall. Order responses from left to right.

正解：

Explanation:
The correct order of the rule processing steps of the Distributed Firewall is as follows:
* Packet arrives at vfilter connection table. If matching entry in the table, process the packet.
* If connection table has no match, compare the packet to the rule table.
* If the packet matches source, destination, service, profile and applied to fields, apply the action defined.
* If the rule table action is allow, create an entry in the connection table and forward the packet.
* If the rule table action is reject or deny, take that action.
This order is based on the description of how the Distributed Firewall works in the web search results1. The first step is to check if there is an existing connection entry for the packet in the vfilter connection table, which is a cache of flow entries for rules with an allow action. If there is a match, the packet is processed according to the connection entry. If there is no match, the packet is compared to the rule table, which contains all the security policy rules. The rules are evaluated from top to bottom until a match is found. The match criteria include source, destination, service, profile and applied to fields. The action defined by the matching rule is applied to the packet. The action can be allow, reject or deny. If the action is allow, a new connection entry is created for the packet and the packet is forwarded to its destination. If the action is reject or deny, the packet is dropped and an ICMP message or a TCP reset message is sent back to the source.

質問 4：
Where does an administrator configure the VLANs used In VRF Lite? (Choose two.)
A. uplink interface of the default Tier-0 gateway
B. segment connected to the Tler-1 gateway
C. downlink interface of the default Tier-0 gateway
D. uplink trunk segment
E. uplink Interface of the VRF gateway
正解：D,E
解説: (Topexam メンバーにのみ表示されます)

質問 5：
An NSX administrator is creating a Tier-1 Gateway configured In Active-Standby High Availability Mode. In the event of node failure, the failover policy should not allow the original tailed node to become the Active node upon recovery.
Which failover policy meets this requirement?
A. Preemptive
B. Disable Preemptive
C. Non-Preemptive
D. Enable Preemptive
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Which of the following exist only on Tler-1 Gateway firewall configurations and not on Tier-0?
A. Actions
B. Profiles
C. Applied To
D. Sources
正解：B