Free Kyverno Certified Associate (KCA) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Kyverno Certified Associate (KCA) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1How many action declarations may a single Kyverno ClusterPolicy rule contain?

   1. A. One action declaration
   2. B. Two action declarations
   3. C. Three action declarations
   4. D. Four action declarations

   Answer: A

   Explanation: The overview states, "Each rule can contain only a single validate, mutate, generate, or verifyImages child declaration." A policy may group rules, but each rule selects one action.

   Reference: Kyverno ClusterPolicy Overview — Overview, rule composition

2. 2Which installation method does Kyverno recommend for production environments needing convenient configuration and customization?

   1. A. Editing running controller Pods
   2. B. Installing only the controller image
   3. C. Using the Kyverno Helm chart
   4. D. Copying an existing webhook object

   Answer: C

   Explanation: The installation guide states, "When installing in a production environment, Helm is the recommended and most flexible method as it offers convenient configuration options to satisfy a wide range of customizations." Installing an image or webhook alone omits the full resource set.

   Reference: Kyverno Installation — Installation, introduction

3. 3Which Kyverno CLI command performs a dry run of a policy against a local resource manifest before deployment?

   1. A. kyverno test policy.yaml --cluster
   2. B. kyverno jp query -i resource.yaml
   3. C. kyverno create values policy.yaml
   4. D. kyverno apply policy.yaml --resource resource.yaml

   Answer: D

   Explanation: The CLI guide states, "The apply command is used to perform a dry run on one or more policies with a given set of input resources." The documented --resource option supplies the local manifest.

   Reference: Kyverno CLI — Apply Command, introduction

4. 4Which command creates a Kyverno policy resource in a Kubernetes cluster from a manifest supplied on standard input?

   1. A. kyverno apply - --resource resource.yaml
   2. B. kyverno test .
   3. C. kubectl create -f -
   4. D. kyverno jp query -i policy.yaml

   Answer: C

   Explanation: The in-cluster quick start uses "kubectl create -f- << EOF" followed by the policy manifest. kubectl sends that manifest to the cluster; the Kyverno CLI apply and test commands evaluate policies without installing them.

   Reference: Kyverno Quick Start — Validate Resources, create policy command

5. 5A new resource violates a Kyverno validate rule. Which failureAction allows its creation while recording the violation in a policy report?

   1. A. Fail
   2. B. Ignore
   3. C. Enforce
   4. D. Audit

   Answer: D

   Explanation: The guide states, "When the value is set to Audit, a policy violation is logged in a PolicyReport or ClusterPolicyReport but the resource creation or update is allowed." Fail and Ignore concern webhook failure handling; Enforce blocks noncompliant new resources.

   Reference: Kyverno Validate Rules — Failure Action

6. 6A ClusterPolicy evaluates a namespaced Pod. Which report type records that Pod's results?

   1. A. ClusterPolicyReport because the policy is cluster-scoped
   2. B. ClusterPolicyReport because Pods run on cluster nodes
   3. C. PolicyReport because the evaluated resource is namespaced
   4. D. PolicyReport only if the policy itself is namespaced

   Answer: C

   Explanation: The guide states, "Every namespaced resource will (eventually) have an associated PolicyReport and every clustered resource will (eventually) have an associated ClusterPolicyReport." Report scope follows the evaluated resource, not the policy's scope.

   Reference: Kyverno Policy Reports — Overview, per-resource report scope

7. 7A Kyverno Policy is created in the namespace team-a. Which scope does this namespaced policy have?

   1. A. Matching resources on every node
   2. B. Matching resources in team-a
   3. C. Matching resources in all namespaces
   4. D. Matching cluster-scoped resources

   Answer: B

   Explanation: The overview states, "namespaced policies will only apply to resources within the namespace in which they are defined". Therefore, this Policy is limited to team-a.

   Reference: Kyverno ClusterPolicy Overview — Overview, namespaced and cluster-wide resources

8. 8Where should the Kyverno Helm release's controller workloads be installed?

   1. A. In a dedicated Kyverno namespace
   2. B. In the existing kube-system namespace
   3. C. In each application's existing namespace
   4. D. In an existing shared tools namespace

   Answer: A

   Explanation: The installation guide states, "Kyverno must always be installed in a dedicated Namespace; it must not be co-located with other applications in existing Namespaces including system Namespaces such as kube-system." Use a dedicated namespace for Kyverno.

   Reference: Kyverno Installation — Installation, namespace requirement

9. 9Which argument saves the resource produced by a Kyverno CLI mutation dry run to newresource.yaml?

   1. A. --set newresource.yaml
   2. B. -o newresource.yaml
   3. C. --resource newresource.yaml
   4. D. --userinfo newresource.yaml

   Answer: B

   Explanation: The guide gives "kyverno apply /path/to/policy.yaml --resource /path/to/resource.yaml -o newresource.yaml" under saving the mutated resource. -o selects the output destination; --resource supplies an input.

   Reference: Kyverno CLI — Apply Command, Save the mutated resource to a file

10. 10After Kyverno rejects a resource admission request, where does the quick-start documentation identify an additional Event containing the rejection information?

    1. A. In the namespace of the attempted resource
    2. B. Only in the namespace hosting Kyverno
    3. C. Only in kube-system for all resources
    4. D. As a copy in every existing namespace

    Answer: A

    Explanation: The quick start states, "In addition to the error returned, Kyverno also produces an Event in the same Namespace which contains this information." Inspect that namespace for the rejection Event.

    Reference: Kyverno Quick Start — Validate Resources, rejected request Event