VMware Certified Advanced Professional - VMware Cloud Foundation 9.0 vSphere Kubernetes Service Practice Exam 2025: Latest Questions

An administrator is reviewing the components involved when developers deploy Pods directly onto vSphere without managing underlying VM lifecycle. Which component provides the Kubernetes control plane integration point in vSphere and brokers lifecycle operations for Kubernetes constructs on vSphere resources?

A platform team wants to provide self-service Kubernetes clusters to multiple application teams while maintaining centralized governance. Which object is the recommended construct for delegating resources and policies to teams on vSphere Kubernetes Service?

After enabling vSphere Kubernetes Service, developers can create PersistentVolumeClaims but all PVCs remain in a Pending state. Pods show events indicating no matching StorageClass. What is the most likely cause?

A security team requires that only members of an enterprise identity group can administer a specific vSphere Namespace. What is the recommended method to grant this access?

An organization runs latency-sensitive workloads and wants to ensure Kubernetes worker nodes for a specific team do not contend with other tenants. Which approach best aligns with vSphere Kubernetes Service resource governance?

Developers report that Kubernetes Services of type LoadBalancer stay in a Pending state in a newly created vSphere Namespace. Other cluster functions appear healthy. What is the most likely misconfiguration?

A team needs to allow developers to deploy workloads but prevent them from creating new Kubernetes clusters in a given vSphere Namespace. Which control best enforces this requirement?

After a maintenance window, multiple Pods that use persistent volumes fail to start, and events show attach/detach timeouts. The underlying vSphere storage is healthy. Which operational check is MOST appropriate first in a vSphere Kubernetes Service environment?

A company wants to design for strong tenant isolation. Requirement: Team A must not be able to discover or communicate with Team B workloads unless explicitly allowed. They also require independent resource limits and delegated administration. Which design best meets these goals in vSphere Kubernetes Service?

A regulated environment requires that container images used in production workloads come only from an approved registry and that developers cannot pull images from public registries. Which approach is MOST appropriate to enforce this in a vSphere Kubernetes Service deployment?

An administrator is validating a vSphere Kubernetes Service environment and needs to describe which component provides the Kubernetes API endpoint for a Supervisor. Which component fulfills this role?

A platform team wants developers to deploy workloads into vSphere Namespaces while ensuring isolation of resource consumption between teams. Which vSphere feature should the administrator configure on the vSphere Namespace?

A developer can authenticate to vCenter but cannot create pods in a vSphere Namespace. The developer reports receiving Kubernetes RBAC 'forbidden' errors when running kubectl against the Supervisor. What is the most likely cause?

A company is planning a Supervisor architecture and wants to minimize blast radius while supporting multiple business units with different isolation requirements. Which design choice best aligns with this goal?

An administrator is enabling a new vSphere Namespace for a development team. The team needs persistent storage for stateful workloads with self-service PVC provisioning. Which configuration step is required to enable this capability?

A Supervisor has been running normally, but new pod deployments remain in a pending state with events indicating insufficient CPU. Existing workloads must continue running, and the administrator wants to prevent a single namespace from starving others. What is the BEST action?

A security team requires that Kubernetes API access be limited to a specific group of administrators while still allowing developers to deploy workloads in their own namespaces. Which approach meets this requirement with least privilege?

A platform team observes intermittent connectivity issues to workloads in one namespace. The issue correlates with pod rescheduling events across hosts. Other namespaces are unaffected. Which troubleshooting step is MOST appropriate to isolate whether the issue is tied to namespace networking configuration versus a cluster-wide problem?

During a security review, an auditor asks how the environment prevents a compromised developer account from gaining privileged access across all namespaces on the Supervisor. Which control is MOST directly responsible for limiting the blast radius?

A Supervisor-enabled cluster must support strict availability requirements for both the Supervisor control plane and workloads. The current environment experiences brief API outages during host maintenance operations. Which design adjustment is MOST likely to mitigate this while aligning with best practices?

A developer reports that a Pod in a vSphere Namespace is stuck in Pending with events indicating it cannot get an IP address. The Supervisor Cluster is healthy, but the namespace uses a dedicated workload network. Which configuration issue is MOST likely causing the problem?

An operator must allow a CI/CD service account to deploy workloads into a specific vSphere Namespace while preventing any changes to Namespace configuration (e.g., storage policies, resource limits, permissions). Which is the BEST approach?

A team runs GPU-accelerated workloads on vSphere Kubernetes Service and needs to ensure Pods that request GPUs are scheduled only onto GPU-capable ESXi hosts. Which Kubernetes construct is MOST appropriate to enforce this placement?

After enabling a new content/library-based image source for vSphere Kubernetes Service, Pods fail during creation with image pull errors, but only for images from the new source. Existing images still work. Which action is the MOST likely fix while adhering to security best practices?

A platform architect is designing a multi-tenant vSphere Kubernetes Service environment. They must isolate tenants so that each tenant’s workloads are constrained to specific compute resources while still sharing the same Supervisor Cluster. Which design is MOST appropriate?