Kyverno Certified Associate Questions and Answers
300 questions organized by topic with detailed explanations
Linux Foundation
KCA
300 questions
6 topics
Updated Jul 2026Fundamentals of Kyverno
54 questions12 easy26 medium16 hard~18% of exam
A team wants to block Namespaces that are missing a required label at admission time. Which Kyverno rule type is designe...A policy author writes one validate rule that matches only `Pod` and wants equivalent coverage for Deployments, DaemonSe...A platform team wants a Kubernetes-native policy engine that lets it author policies with YAML and CEL instead of learni...
Installation, Configuration, and Upgrades
54 questions12 easy29 medium13 hard~18% of exam
An operator sets `--autoUpdateWebhooks=false` to stop dynamic webhook management. What is the main consequence?A cluster was installed from a tagged YAML release. The platform team wants to do a direct in-place upgrade by applying ...A generate rule must create Deployments, but policy installation fails because Kyverno lacks permission to create them. ...
Kyverno CLI
36 questions12 easy18 medium6 hard~12% of exam
Applying Policies
30 questions6 easy12 medium12 hard~10% of exam
A ClusterPolicy sets `applyRules: One`. How does Kyverno process matching rules in that policy?A GitOps pipeline wants to evaluate Kubernetes manifests against Kyverno policies before they are committed and applied ...A rule's `match` block specifies resource kinds but no `operations`. What admission operations are matched by default?
Writing Policies
96 questions27 easy48 medium21 hard~32% of exam
A platform team wants Kyverno to remove temporary resources automatically after a set time without writing a full cleanu...A validate policy matches only `Pod` and uses a pattern on `metadata.namespace`. The author wants controller coverage th...A mutate rule uses `foreach` with `patchesJson6902` to add `securityContext` to every container. Which variable lets the...
Policy Management
30 questions9 easy17 medium4 hard~10% of exam
Which Kyverno controller handles background scanning that records validation and `verifyImages` results for existing res...A platform team wants to use `PolicyException` resources in a cluster where they are currently unavailable. What must it...When Kyverno is installed with Helm and metrics services are created, which port is exposed for metrics by default?
All Questions
| # | Question | Topic | Difficulty |
|---|---|---|---|
| 1 | A repository contains policy tests for `kyverno test`. Which file name does the CLI look for by defa... | Kyverno CLI | medium |
| 2 | An operator sets `--autoUpdateWebhooks=false` to stop dynamic webhook management. What is the main c... | Installation, Configuration, and Upgrades | hard |
| 3 | A cluster was installed from a tagged YAML release. The platform team wants to do a direct in-place ... | Installation, Configuration, and Upgrades | hard |
| 4 | Which Kyverno controller handles background scanning that records validation and `verifyImages` resu... | Policy Management | medium |
| 5 | A platform team wants Kyverno to remove temporary resources automatically after a set time without w... | Writing Policies | medium |
Sign in to see all 300 questions
Create a free account to browse the questions included with the free plan.
Ready to test your knowledge?
Take a full Kyverno Certified Associate practice test with timed exam simulation.
Start Practice Test