A Cloud Architect is designing an upgrade strategy for a multi-site VKS environment with Federation.
Scenario:
Site A and Site B both have Supervisor Clusters. Site A hosts the "Global" Harbor Registry. Site B's TKG clusters pull images from Site A's Harbor.
The architect plans to upgrade Site A's Supervisor.
Which dependency/risk must be mitigated during the upgrade plan? (Choose 2.)

A Platform Engineer is tasked with managing the lifecycle of VKS clusters across multiple zones to ensure high availability for a mission-critical app.
Scenario:
The production namespace spans Zone-A, Zone-B, and Zone-C. A TKG cluster prod-app-cluster needs to be provisioned such that its worker nodes are evenly distributed across these three zones to tolerate a zone failure.
Review the following TanzuKubernetesCluster spec snippet:
spec:
topology:
controlPlane:
replicas: 3
vmClass: guaranteed-medium
storageClass: gold-storage-policy
workers:
replicas: 6
vmClass: guaranteed-large
storageClass: gold-storage-policy
distribution:
type: "..." # Missing Value
Which configuration strategies are correct to ensure the desired zonal distribution? (Select all that apply.)

A DevOps team is deploying a legacy application that requires a specific Private Registry (registry.internal.corp) to pull its container images. This registry requires authentication.
To avoid modifying every individual Pod manifest to include imagePullSecrets, the Platform Engineer wants to configure a default deployment model for the namespace legacy-apps.
Which configuration applies the pull secret automatically to all Pods launched by the standard default ServiceAccount in that namespace?

A VKS Administrator is troubleshooting a failed upgrade where the new worker nodes are successfully provisioned (VMs are "Powered On") but fail to join the Kubernetes cluster. The Machine status reports NodeRegistrationFailure.
The administrator inspects the cloud-init logs on one of the failed worker VMs and finds:
# /var/log/cloud-init-output.log
...
[ 25.123456] cloud-init[1234]: curl: (7) Failed to connect to 192.168.10.50 port 6443: Connection timed out
[ 25.123456] cloud-init[1234]: Error: failed to join cluster: could not connect to API server
...
192.168.10.50 is the Virtual IP (VIP) of the cluster's Load Balancer Service.
What are the likely causes of this failure? (Choose 2.)

A VI Administrator is managing the lifecycle of VM images used by the VM Service. A new corporate standard requires that all Linux VMs deployed via kubectl must use the hardened image corp-linux- v2.ova.
The administrator has uploaded the new OVA to the Corporate-Images Content Library.
How can the administrator ensure that developers can immediately begin deploying VMs using this new image name in their YAML? (Select all that apply.)