Skip to content

KCA practice test

Kyverno Certified Associate · free · 399 questions in the bank today

By Ibrahim Yesilay · Published · Updated

Start a free KCA practice test: Kyverno Certified Associate questions with an instant verdict and explanation, an order that returns to your weakest domains, and a timed mock in the official format. The official KCA exam is 60 questions in 90 minutes with a passing score of 75%, as read from the Linux Foundation documentation on 2026-10-28.

Start KCA practiceTake a timed mock exam

Ten guest answers need no account; mock exams need a free one. Independent practice, not affiliated with the CNCF or the Linux Foundation.

KCA exam snapshot

Questions
60
Minutes
90
Passing score
75%
Mock exam
Official format
60 q · 90 min

Exam facts from the Linux Foundation pages, checked 2026-10-28; full table with sources on the KCA certification page.

What this KCA practice test is

This page starts a free KCA practice session on GoldenKube. The official KCA exam is 60 questions in 90 minutes with a passing score of 75%, as read from the Linux Foundation documentation on 2026-10-28. The GoldenKube KCA bank held 399 questions when this page was written; the live count is shown above. One question at a time. As soon as you answer you see whether you were right and read the explanation; reloading the page keeps the verdict on screen. The next question comes from the questions due for review first, then from the domain where you are weakest and still have unseen questions, then from the rest of the bank. Use it for the five operational domains and pair it with writing your own rules and checking them with the Kyverno CLI, which is the only way to prepare for the policy-writing domain here.

Every KCA question in the bank has a written explanation, so a wrong answer is always followed by the reasoning that fixes it.

What the KCA bank covers

The KCA bank covers all six official domains. Writing Policies, the largest, has the most questions: validate, mutate, generate and verify-image rules, cleanup, variables and API calls, preconditions, autogen and the CEL-based policy types. The rest cover what Kyverno is, how it is installed and upgraded, the CLI, how policies are applied and how reports and exceptions are managed. The table compares the official domain weights, checked against the KCA certification page on 2026-10-28, with the share of the bank each domain holds and the number of explained questions, both read from the database when the page is served. Writing Policies is the heaviest domain at 32%, so it deserves the largest share of your study time whatever the bank's share is.

Official domainExam weightBank shareQuestionsExplained
Fundamentals of Kyverno18%15%6161
Installation, Configuration, and Upgrades18%15%5959
Kyverno CLI12%8.3%3333
Applying Policies10%15%6161
Writing Policies32%32%128128
Policy Management10%14%5757

All 399 questions have a written explanation. Live from the database; the KCA bank coverage report explains the method.

A domain whose bank share is well below its weight is one to study from the official curriculum and the project documentation as well; the bank-coverage report linked below tracks these gaps over time.

How the bank covers the KCA curriculum

The KCA curriculum has six domains, and one of them dominates: Writing Policies is 32% of the exam and lists eleven of the 31 topics. Every one of the 399 GoldenKube KCA questions is filed under one of the six official domains, and Writing Policies holds the largest share: validate, mutate and generate rules, JSON patches, verify-image rules, cleanup policies, variables and API calls, preconditions, background scans, autogen and the CEL-based policy types such as ValidatingPolicy and DeletingPolicy. Applying Policies and Policy Management carry more questions than their weights, and Kyverno CLI is the thinnest domain relative to its 12%, so add hands-on CLI work to the bank.

  1. Fundamentals of Kyverno

    18% of the exam · 61 questions in the bank

    Whether you know what Kyverno is as an admission controller, how policies and rules are structured as YAML, and where OCI images come into policy decisions.

    Official curriculum topics

    • Kyverno Policies & Rules
    • YAML Manifests
    • Admission Controllers
    • OCI Images

  2. Installation, Configuration, and Upgrades

    18% of the exam · 59 questions in the bank

    Whether you can install and configure Kyverno with Helm, know its CRDs, controller flags and RBAC, and plan a highly available install and an upgrade.

    Official curriculum topics

    • Helm-based Installation and Configuration
    • Kyverno Custom Resource Definitions (CRDs)
    • Controller Configuration with Flags
    • Configuring Kyverno RBAC, roles, and permissions
    • High Availability Installations
    • Upgrading Kyverno

  3. Kyverno CLI

    12% of the exam · 33 questions in the bank

    Whether you can choose between kyverno apply, kyverno test and kyverno jp for a task and install the CLI.

    Official curriculum topics

    • apply
    • test
    • jp
    • Installing Kyverno CLI

  4. Applying Policies

    10% of the exam · 61 questions in the bank

    Whether you can predict which resources a policy acts on in a cluster and what the common rule settings change.

    Official curriculum topics

    • Applying Policy in Cluster
    • Resource Selection
    • Common Policy Settings for Kyverno Rules

  5. Writing Policies

    32% of the exam · 128 questions in the bank

    Whether you can read and write each rule type, with preconditions, variables, API calls, JSON patches, autogen, cleanup and CEL expressions.

    Official curriculum topics

    • Validation Rules
    • Preconditions
    • Background Scans
    • Mutation Rules
    • Generation Rules
    • VerifyImage Rules
    • Variables & API Calls in Policies
    • JSON Patches
    • Autogen Rules
    • Cleanup Policies
    • Common Expression Language (CEL)

  6. Policy Management

    10% of the exam · 57 questions in the bank

    Whether you can read policy reports, grant a PolicyException and use Kyverno metrics to watch the engine.

    Official curriculum topics

    • Policy Reports
    • PolicyExceptions
    • Kyverno Metrics

Weights from the official certification page; question counts from the GoldenKube bank when this page was built; topics as named in the CNCF curriculum PDF listed under Sources.

Try three KCA questions

Three questions from the bank with their answers and explanations. The KCA sample-questions page has twenty more; the practice session has the whole bank.

Question 1

By default, a brand-new ClusterPolicy with a generate rule is applied to a cluster with 40 pre-existing namespaces. What happens to those 40 namespaces?
  1. A.They're all immediately backfilled, since generate rules always run cluster-wide on apply.
  2. B.Nothing — generate rules are forward-only by default; the 40 existing namespaces are untouched unless generateExisting: true is also set.
  3. C.Kyverno queues a one-time job to backfill them automatically within 24 hours.
  4. D.They're deleted and recreated to re-trigger the rule.

Correct answer: B

generate rules react to admission events on trigger resources; pre-existing resources generated no such event for this new policy, so they're skipped unless generateExisting: true opts in.

Question 2

You create a PolicyException on a freshly installed Kyverno v1.13.2 cluster. kubectl get policyexception shows it, but the policy keeps blocking the workload. What is the most likely cause?
  1. A.PolicyException only works against namespaced Policy objects, never ClusterPolicy.
  2. B.The exception must be created in the kyverno namespace.
  3. C.PolicyExceptions are disabled by default; --enablePolicyException=true must be set on the controllers, along with a matching --exceptionNamespace.
  4. D.The exception needs several minutes to propagate to the webhook.

Correct answer: C

The CRD is installed by default but the feature is off. Without --enablePolicyException=true, the object is stored happily by the API server and has no effect whatsoever — no error, no event, no warning. --exceptionNamespace then restricts which namespace's exceptions are honoured.

Question 3

In a ClusterPolicy validate rule using the cel subrule, which variable holds the Namespace object of the incoming resource?
  1. A.params
  2. B.request.namespace
  3. C.object.metadata.namespace
  4. D.namespaceObject

Correct answer: D

CEL expressions in the cel subrule can read namespaceObject, the Namespace the incoming object belongs to; the docs use it to require that StatefulSets are created in a specific Namespace. object.metadata.namespace and request.namespace give only the Namespace name as a string, not the object with its labels. params is the parameter resource referenced through cel.paramKind and cel.paramRef.

Sources: Kyverno docs: Validate Rules

Start KCA practice

How to practise KCA with GoldenKube

A KCA loop on GoldenKube runs on two tracks every day. Track one is the bank: due reviews first, then new questions from the adaptive order, which sends you to your weakest practice set that still has unseen questions. Track two is a local cluster or just the Kyverno CLI, where you write one rule of a different type each day and check it with kyverno apply against a resource file, because Writing Policies questions ask you to predict what a rule does and writing rules is the fastest way to learn that. The bank part covers 399 questions in a week at about 57 new answers a day; missed questions return after 12 other answers, then after 1 day and after 4 days.

The 7-day loop

  1. Day 1About 57 unfiltered answers, then write a validate rule with failureAction Audit and run kyverno apply on a Pod manifest that breaks it.
  2. Day 2Reviews first, then Focus mode on Fundamentals of Kyverno. Hands-on: turn the same rule to Enforce and note what changes in the output.
  3. Day 3Focus on Installation, Configuration, and Upgrades: Helm values, controller flags, the four controller Deployments and high availability. Hands-on: write a mutate rule that adds a label.
  4. Day 4Focus on Kyverno CLI and Applying Policies. Hands-on: write a kyverno-test.yaml for the two rules so far and run kyverno test.
  5. Day 5Focus on Policy Management: reports, PolicyExceptions and metrics. Hands-on: a generate rule that creates a ConfigMap in every new Namespace.
  6. Day 6Focus on Writing Policies, the 32% domain: anchors, deny rules, preconditions, variables and generate synchronization. Hands-on: add a precondition and a variable from request.object to one of your rules.
  7. Day 7One timed mock exam in the official format. Read its by-domain result and send the weakest domain to Focus mode; for Writing Policies, compare the result with how easily you wrote your own rules during the week.

The 14-day loop

  1. Days 1-2About 29 answers a day without a filter; read the Kyverno introduction and the ClusterPolicy overview.
  2. Days 3-4Focus on Fundamentals of Kyverno and Installation, Configuration, and Upgrades (36% of the exam together).
  3. Days 5-8Writing Policies: Focus mode on the domain each day, plus one rule type per day written by hand (validate, mutate, generate, verifyImages) and checked with kyverno apply. Keep clearing due reviews each morning.
  4. Day 9Focus on Kyverno CLI; write tests for the rules from days 5-8 and run them with kyverno test.
  5. Day 10Focus on Applying Policies and Policy Management.
  6. Days 11-12First mock exam, then Focus on the weakest domain it shows. Rewrite one of your validate rules as a CEL-based ValidatingPolicy, the type the current documentation lists in place of ClusterPolicy.
  7. Days 13-14Unfiltered practice and a second mock exam. Bookmark anything you answered by guessing and practise it from the review center.

The first 10 answers need no account; a free account keeps reviews and mock history across the two weeks. The readiness score on the progress page is built from the official domains, and all six now have bank questions, so Writing Policies counts toward it with its full weight.

Start the KCA loop nowKCA exam guide and study plan

Common KCA mistakes

Most KCA traps sit in the order in which Kyverno evaluates things and in the defaults: what runs first, what a rule may contain, what is on unless you turn it off. Each item is stated as the Kyverno documentation states it and links the page.

  1. 1. Putting two actions in one rule

    Each rule has a match declaration, an optional exclude declaration and one of validate, mutate, generate or verifyImages. A rule can contain only a single one of those child declarations, so a policy that validates and mutates needs two rules.

    Source: ClusterPolicy overview (kyverno.io)

  2. 2. Writing a validate rule that fights a mutate rule

    Resource mutation occurs before validation. A validate rule that checks for the original value of a field that a mutate rule already changed will never see that value, so the documentation warns that validation should not contradict the mutation.

    Source: Mutate Rules (kyverno.io)

  3. 3. Reading an Audit violation as a blocked request

    failureAction decides what a failed validation does: Enforce blocks the request, Audit allows it and records the result in a policy report. Violations of an Audit rule also surface as an event on the resource, which is not the same as a denial.

    Source: Validate Rules (kyverno.io)

  4. 4. Misreading any and all in match and exclude

    match and exclude each take one of two blocks: any, where Kyverno applies a logical OR across the listed resource filters, and all, where it applies a logical AND. Filters placed directly under match or exclude are marked for deprecation, so read which block a filter sits in before deciding what the rule selects.

    Source: Selecting Resources: match and exclude (kyverno.io)

  5. 5. Expecting preconditions to replace match

    Preconditions are evaluated only after a resource has been matched and not excluded by the rule. They narrow the selection further with expressions; they do not select resources the match block missed.

    Source: Preconditions (kyverno.io)

  6. 6. Forgetting that background scanning is on by default

    The background setting controls scanning of existing resources for violations and generating policy reports, and it defaults to true. Policy reports are therefore created both from admission events and from background scans of resources that already existed.

    Source: Policy Settings (kyverno.io)

  7. 7. Assuming PolicyExceptions work after a default install

    The Kyverno documentation states that PolicyExceptions are disabled by default. They are enabled with the enablePolicyException flag, and you must also set exceptionNamespace to say which namespaces may hold them.

    Source: Policy Exceptions (kyverno.io)

  8. 8. Learning only ClusterPolicy and CleanupPolicy

    The current policy types page lists ClusterPolicy and CleanupPolicy as legacy types, deprecated in v1.19 and removed in v1.20, with CEL-based ValidatingPolicy, MutatingPolicy, GeneratingPolicy, DeletingPolicy and ImageValidatingPolicy in their place. The curriculum still names rule types such as validation, mutation and cleanup alongside CEL, and it does not state a Kyverno version, so learn the rule model and the CEL types.

    Source: Policy types overview (kyverno.io)

Mock exam

The KCA mock exam draws 60 questions from the bank, gives you 90 minutes and scores the run against the 75% threshold, the same numbers as the official format. It is a timed rehearsal of pacing and stamina, not a prediction: the questions are GoldenKube's own and the result is practice feedback. Mock exams need a free account; your history of runs is kept on the exam's mock page.

Take a timed mock exam

Frequently asked questions

Is the KCA practice test free?

Yes. Your first 10 answers need no account. After that a free account keeps your progress; there is no paid tier and no card.

How many KCA questions are there?

399 when this page was written; the live count from the database is shown at the top of the page. Questions are added and corrected over time.

Does the KCA practice test match the real exam format?

The mock exam uses the published format: 60 questions, 90 minutes, 75% to pass. Practice mode is untimed and adaptive. The questions themselves are GoldenKube's own, not exam content.

Where are more sample questions with answers?

The KCA sample-questions page shows 20 questions with answers and explanations without an account, and each KCA topic page shows three more for its subdomain.

Does the GoldenKube KCA bank cover Writing Policies?

Yes. Writing Policies is the largest domain in the bank, as it is on the exam: validate, mutate, generate and verify-image rules, JSON patches, cleanup, variables and API calls, preconditions, background scans, autogen and the CEL policy types. Practise it here, and also write and test rules yourself with the Kyverno CLI: kyverno apply runs policies against resource files, and kyverno test compares results with the expectations in a kyverno-test.yaml.

Should I learn ClusterPolicy or the new CEL policy types for KCA?

Both. The curriculum lists validation, mutation, generation, verify-image and cleanup rules as well as Common Expression Language, without naming a Kyverno version. The current Kyverno documentation marks ClusterPolicy and CleanupPolicy as deprecated in v1.19 and due for removal in v1.20, replaced by CEL-based policy types, so newer material uses those. The bank has questions on both.

Do the KCA questions use current Kyverno field names?

They follow the Kyverno documentation for the v1.19 release line, checked on 28 October 2026. Questions that used deprecated forms, such as the lowercase enforce and audit values or the policy-level validationFailureAction, were rewritten to the rule-level failureAction, and questions about the new policy types cite the pages they are based on.

Sources

Last updated