A Cloud Administrator needs to resolve a "Condition: False" error on a Supervisor Cluster related to network connectivity. The Supervisor cannot reach the external image registry to pull system images.
Review the following log snippet from the Supervisor's WCP service:
E1121 10:05:01.442 controller.go:120] Failed to pull image 'projects.registry.vmware.com/tkg/tanzu- kubernetes-grid-service-v2.0.0':
rpc error: code = Unknown desc = Error response from daemon: Get
https://projects.registry.vmware.com/v2/: dial tcp 10.128.0.45:443: i/o timeout The administrator verifies that the firewall rules allow traffic from the Supervisor Management Network IP range to the internet.
What configuration on the Supervisor is most likely missing or incorrect, preventing this connection?
(Select all that apply.)

A Platform Engineer is enabling Workload Management on a vSphere Cluster to prepare it for a new development team. The environment utilizes NSX for networking.
Review the following configuration options available in the "Enable Workload Management" wizard:
[Network Stack]
1. NSX
2. VDS
[Load Balancer]
1. NSX Load Balancer
2. HAProxy
3. Avi Load Balancer
Which specific configuration combination facilitates the deployment of vSphere Pods (native pods)?

A VKS Administrator is troubleshooting a stalled upgrade of the prod-cluster. The upgrade has halted during the worker node rollout.
The administrator inspects the Machine object for the node currently being deleted (worker-node-02) and finds the following event:
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Warning DrainFailed 10m machine-controller Failed to drain node: Cannot evict pod "payment- service-5d4f7c" in namespace "finance": PodDisruptionBudget "payment-pdb" is blocking eviction.
Review the PodDisruptionBudget (PDB) status:
NAME MIN AVAILABLE MAX UNAVAILABLE ALLOWED DISRUPTIONS AGE
payment-pdb 2 N/A 50d 0
The deployment payment-service currently has 2 replicas running.
What is the correct procedure to resolve this blockage and allow the upgrade to proceed? (Choose 2.)

A Platform Engineer is configuring Kubernetes Admin Credentials for a break-glass scenario. The requirement is to enable the built-in admin user for a specific TKG cluster prod-cluster, bypassing vCenter SSO in case of an SSO outage.
Which sequence of commands/actions correctly retrieves this kubeconfig? (Choose 2.)

A Cloud Administrator is evaluating the use of Custom Ingress Controllers (e.g., Contour, Nginx) versus the Native NSX Load Balancer for handling Layer 7 traffic in a vSphere with Tanzu environment.
The goal is to support advanced traffic shaping, such as header-based routing and TLS termination at the ingress layer, while minimizing the consumption of Load Balancer VIPs (Virtual IPs) from the limited pool.
Why would deploying a Custom Ingress Controller (like Contour) via a TKG Extension be architecturally preferable to using type: LoadBalancer for every service? (Select all that apply.)