KCA practice exam: free questions, domains and format

What is the KCA exam?

KCA is the Kyverno Certified Associate exam from the Linux Foundation and CNCF. It is a proctored, online, multiple-choice exam on Kyverno, a policy engine designed for Kubernetes where policies are written as Kubernetes resources instead of a separate language. It tests the fundamentals of what Kyverno does, how it is installed, configured and upgraded, how the Kyverno CLI is used to test policies, how policies are applied to a cluster, how they are written, and how they are managed over time. It is a knowledge exam, so you read policy YAML and decide what it validates, mutates or generates. Officially it is the Kyverno Certified Associate certification, a multiple-choice exam in the Golden tier of the 16-certification Golden Kubestronaut program. The sections below cover its official domains, the verified format and cost, and its place in the path.

Typical questions show a ClusterPolicy and ask which resources it blocks or changes, what a match or exclude block selects, how a variable or JMESPath expression resolves, or when a rule generates a new resource. Reading policy YAML fluently is the core skill.

KCA exam domains and weights

KCA has six domains. Writing Policies is the largest at 32%. Fundamentals of Kyverno and Installation, Configuration, and Upgrades follow at 18% each, then Kyverno CLI at 12%, with Applying Policies and Policy Management at 10% each. Writing policies is the clear priority: validate, mutate, generate and verify-images rules, match and exclude selectors, preconditions, variables and JMESPath. The remaining domains are smaller and more operational, covering how Kyverno is deployed, how the CLI tests policies offline, and how policy reports and exceptions are handled. The official list has 6 domains: the largest is Writing Policies at 32% and the smallest is Policy Management at 10%, so a sensible plan splits study time roughly in proportion to these weights.

Learn the fundamentals and rule types first, since every policy question builds on them, then practise writing and reading policies until the selectors and variables feel natural, and treat installation, the CLI and policy management as shorter topics to cover in a second pass.

KCA exam format and cost

The KCA exam facts below were read from the official Linux Foundation pages on 2026-10-23, and every row of the table links to the page it came from. Format: Online, proctored, multiple-choice. Questions: 60. Duration: 90 minutes. Passing score: 75%. Price: 250 US dollars. Certification validity: 2 years. Prerequisites: None. Retake policy: One retake per exam purchase if a passing score is not achieved. Curriculum version: not published by the Linux Foundation. Prices and policies change, so confirm them on the official KCA page before you book. If the Linux Foundation changes a value, this page is updated and shows the date it was last verified.

With 60 questions in 90 minutes you have about 90 seconds per question on average, which is enough to read a scenario carefully but not to agonise over one item. If every question counts equally, 75% of 60 is 45 correct answers, so one unknown topic does not decide the result. Flag a hard question, move on, and return to it at the end.

Treat the table as the single source for numbers on this page. If a row says the Linux Foundation does not publish a value, we print that instead of guessing, and the official KCA page remains the final word on registration and policy.

How GoldenKube practice works for KCA

GoldenKube turns the KCA bank into a practice loop. You answer one question at a time, see right away whether you were correct, and read an explanation of why. The next question is chosen for you: reviews that are due come first, then the domain where you are weakest, spread across all 6 exam domains so you do not only practise what you already know. A question you miss comes back on a spaced schedule until you answer it correctly, and a mock exam mode lets you test yourself under exam conditions. You can answer 10 questions as a guest with no sign-up; after that a free account saves your progress, with no credit card.

• Adaptive order: due reviews first, then your weakest domain.
• Spaced repetition: missed questions return until you have mastered them.
• Every question carries an explanation, not just a right-or-wrong verdict.
• Mock exam mode for a timed run once you are close to ready.

5 sample KCA questions

The five questions below come from the GoldenKube KCA bank, and each one shows its correct answer and a written explanation. They are practice questions written for learning, not questions from the real exam, and they were picked once so the page stays stable. Use them as a quick check of your level: if you can explain why each wrong option is wrong, you are in good shape for this part of the syllabus, and if not, the explanation shows what to revise. The sample questions page holds a larger set, and the practice app holds the full bank with adaptive ordering and review.

Where KCA sits in the Golden Kubestronaut path

KCA is a Golden-tier certification, not one of the 5 core Kubestronaut certifications, and Golden Kubestronaut requires all 16 certifications in the program, so KCA is a required step. Its own prerequisites, per the Linux Foundation: None. The program page lists all 16 certifications side by side and marks which ones GoldenKube can practice today. In the program it is the policy-as-code exam: it connects to KCSA and CKS, which examine admission control and Pod security from the security side, and to CNPE, whose tasks include security and policy enforcement. Candidates who already know admission webhooks and Pod Security Standards will find that Kyverno gives them a practical way to apply those ideas.

Kyverno policies are plain Kubernetes YAML, which keeps the learning curve gentle for anyone who has written manifests. The program page lists all sixteen certifications and which of them GoldenKube practices today.

Frequently asked questions