EMT Practice Test

1. Question Content...

Previous Submit Next
Was this helpful? Upvote!
Question List

Question1: The security team has submitted two requests to change or limit access in NSX for Site A's vCenter groups.
Requirements:
NSX Manager: nsxmgr-01a.corp.local
vCenter: vcsa-01a.corp.local
Credentials: [email protected] / VMware1!
Grant all members of vCenter group AuditTeam the minimal access necessary to view NSX Data Security policy configurations for all objects in Site A.
Grant all members of vCenter group ScanTeam the minimal access necessary to enable them to start and stop data security scans in Site A.
Ensure that the principles of least privilege are adhered to.
NOTE:
The Active Directory groups associated with the vCenter groups has already been preconfigured.
HOL LAB for Practice:
See the explanation part for complete solution.

Question2: Enable and configure cross vCenter support for and NSX implementation that contains two vCenter Servers:
vcsa-01a.corp.local and vcsa-01b.corp.local
Requirements:
vCenter: vcsa-01a.corp.local and vcsa-01b.corp.local
Credentials: [email protected] / VMware1!
NSX Manager Credentials: admin/VMware1!
The NSX Manager registered to vcsa-01a.corp.local should be responsible for all universal NSX objects.
A segment ID range of 16789-17563 is available for use with this exercise.
NOTE:
Allow time for synchronization to complete.
HOL LAB for Practice:
See the explanation part for complete solution.

Question3: Build a multi-tier network capable of supporting application virtual machines deployed across multiple vCenter instances.
Requirements:
vCenter: vcsa-01a.corp.local
Credentials: [email protected] / VMware1!
Resource Pools: Management and Edge Cluster 1A
The underlying physical network does not support multicast.
All new items created must have a prefix of "U" followed by their function name and a suffix of "New".
i.e. U-App-Tier-NEW.
Create a LS for HA management interface calle U-HA-VXLAN=NEW but do not enable HA on any of the edge devices deployed.
Deploy logical switches using separate subnets for the three tier application shared by both NSX Manager instances.
Deploy the required east-west routing component used across multiple vCenter instances for the multi-tier network.
Utilize a default gateway up to the Perimeter-Gateway02 (tenant router) from the east/west router.
Utilize a static route from the tenant router to reach the three tiers of the application.
Subnets for the tiers:
172.7.10.0/24 for the Web Tier.
172.17.20.1/24 for the App Tier.
172.17.30.0/24 for the Database Teir.
Use the first available IP address for the router on each of the tiers.
Subnet for the Transit VXLAN uplink from the application tier routing to the tenant router.
192.168.190.0/29
Uplink IP address of the application tier should be the first available IP address.
Downlink from the tenant router will use the second available IP addresses.
The password for new edge device(s) must be VMware1!VMware1!
Add all virtual machines with a prefix "universal-" to their respective segments.
Ensure all LIFs are reachable from ControlCenter.
HOL LAB for Practice:
See the explanation part for complete solution.

Question4: In the Dev environment, you have the application and database servers on separate networks created previously. Configure inbound only network security to allow only Dev application servers access to Dev database servers using MYSQL service port.
Requirements:
vCenter: vcsa-01a.corp.local
Credentials: [email protected] / VMware1!
Service Port: MYSQL
Networks: Dev-App-Tier-01-NEW and Dev-DB-Tier-01-NEW
Credentials for Dev VMs: root / VMware1!
This rule should be in its own "DB security-NEW" section.
Ensure inbound only network security allows Dev application servers access to Dev database servers.
This rule should not be prpogated to all NSX prepared clusters.
This rule should be created in a way that any new virtual machines on App and DB segments will be secured.
This rule should be created with the fewest rule(s) possible.
All other servers should be denied.
Ensure inbound security requirements are met.
HOL LAB for Practice:
See the explanation part for complete solution.

Question5: Provide automatic IP assignment for the servers on the DEV-DB-Tier-01-NEW segment.
Requirements:
vCenter: vcsa-01a.corp.local
Credentials: [email protected] / VMware1!
Edge: Dev-Edge
Automatically allocate IP addreesses in the 172.16.30.100-149 range.
Lease time: 1 hour
Ensure hosts that receive an IP assignment will be able to reach the other Dev subnets.
The legacyhost-NEW with the MAC address 40:00:00:00:00:01 must always be assigned 172.16.30.99 Ensure other parameters match those of the dynamic allocation mechanism (Task1).
Enable logging with the highest level of detail for automatic IP allocations.
Ensure all requirements have been met.
NOTE:
Do not configure DHCP Relay agent on the Dev-DLR-NEW as this will be done by another administrator.
HOL LAB for Practice:
DHCP and other questions 7, 8, 9
See the explanation part for complete solution.

Question6: You have been tasked with modifying an existing NSX API call to capture flow information for an organization. The existing API call is located on the ControlCenter desktop in a file name flowapi.txt.
The API call should be modified to collect Layer3 flow statistics between the dev-web-01a and the ControlCenter virtual machine.
Requirements:
vCenter: vcsa01a.corp.local
Credential: [email protected] / VMware1!
File location: flowapi.txt on the desktop of ControlCenter.
Modify and Save the existing API call to capture the requested information.
A REST Client has been added to Chrome and Firefox for this exercise.
Output the Response Body to a text file called apiresults.txt on the desktop of ControlCenter.
******************flowapi.txt***********************
https://<nsxmgr-ip>/api/2.1/app/flow/flowstats?contextId=datacenter-21&flowType=TCP_UDP&startTime
=0&endTime=
https://192.168.110.15/api/2.1/app/flow/flowstats?contextId=vm-26&flowType=Layer3&startTime=0&endT ime=1320917094000&
******************flowapi.txt***********************
HOL LAB for Practice:
See the explanation part for complete solution.

Question7: An NSX administrator has been troubleshooting a communication issue between Edge device TS-Comm-Edge-01 and the TS-Comm-DLR-01 logical router with no success and has reached out to you for further assistance. The following troubleshooting has already been performed.
Temporarily disabled the firewall between both devices.
Unsuccessful ping from TS-Comm-Edge-01 to TS-Comm-DLR-01
Unsuccessful ping from TS-Comm-DLR-01 to TS-Comm-Edge-01
Determine and resolve the communication issue between the two devices.
Requirements:
vCenter: vcsa01a.crop.local
Credentials: [email protected] / VMware1!
Troubleshooting Information:
Edge: TS-Comm-Edge-01 (192.168.33.1)
DLR: TS-Comm-DLR-01 (192.168.33.8)
Transit Network: TS-Comm-Transit
IP Subnet: 192.168.33.0/29
Ensure communication between both devices is successful.
NOTE:
IP addresses must remain unchanged.
HOL LAB for Practice:
See the explanation part for complete solution.