Exam 3V0-24.25 Topic 1 Question 45 Discussion

Actual exam question for VMware's 3V0-24.25 exam
Question #: 45
Topic #: 1

A Security Architect is designing the ingress and egress traffic flow for a highly regulated PCI-DSS zone within vSphere with Tanzu.
The requirements state:
1. Ingress: All incoming HTTP/S traffic must pass through a dedicated WAF (Web Application Firewall) before reaching the Kubernetes Ingress Controller.
2. Egress: All outbound traffic from the namespace must be identifiable by a unique, persistent IP address to allow for strict firewall rules on the perimeter.
3. Isolation: The namespace must use a dedicated T1 Gateway in NSX.
Review the following design decisions.
Which configuration choices correctly support these requirements? (Select all that apply.)

A. Use vDS networking with HAProxy, as it supports "Transparent Mode" for preserving client IPs better than NSX. B. Define a specific Egress CIDR range for the Supervisor and ensure the namespace is assigned a specific SNAT IP (Egress IP) from this range, which is then reserved in the perimeter firewall. C. Disable SNAT on the namespace to expose internal Pod IPs directly to the WAF. D. Deploy a Tanzu Kubernetes Cluster with a Service of type: LoadBalancer to expose the Ingress Controller, and point the external WAF to the allocated Load Balancer VIP. E. Configure the Supervisor with NSX networking to ensure each namespace receives a dedicated Tier-1 Gateway and SNAT rules.

Comments

0 Satisfied Customers

0 Shares

0 Demo Downloads

10 Years in Business