KCA Mock Exam Simulator

Free Kyverno Certified Associate practice questions with full explanations on every option. Kubernetes policy management with Kyverno.

Format
multi-choice
Duration
90 min
Pass mark
75%
Study time
1–6 wks
Mocks here
2

KCA exam domains

Free KCA sample questions

Fundamentals of Kyverno

Q1. Which pattern value matches any non-empty string in a Kyverno validate rule?

Reveal answer and explanations
  1. A `*`

    Incorrect. A single `*` matches zero or more characters, so it also matches empty strings.

  2. B `!?`

    Incorrect. `!?` is not a valid Kyverno wildcard expression for non-empty values.

  3. C `.+`

    Incorrect. Kyverno patterns are not POSIX regular expressions; `.+` is not the idiomatic way to require non-empty.

  4. D `?*`

    Correct. The wildcard `?*` requires at least one character followed by any remaining characters, matching a non-empty string.

Installation, Configuration, and Upgrades

Q2. A platform team wants PolicyReports and background scans to scale independently from the admission controller. Which Helm chart values layout best achieves this?

Reveal answer and explanations
  1. A Set `admissionController.replicas` high and leave all other controllers at zero replicas.

    Incorrect. Setting other controllers to zero replicas would stop reports and background scans from working.

  2. B Increase `admissionController.resources.cpu` only; the other controllers scale automatically.

    Incorrect. Raising CPU on admission does not affect the capacity of the other controllers.

  3. C Set replicas per controller block in the chart values.

    Correct. Kyverno's split architecture exposes per-controller replica settings in the Helm chart, letting each controller scale independently.

  4. D Disable the HorizontalPodAutoscaler so the Deployments use cluster-wide autoscaling instead.

    Incorrect. Disabling HPA does not enable per-controller scaling; per-controller replicas do.

Kyverno CLI

Q3. Running `kyverno test .` reports: > 1 test passed, 1 test failed Which is the MOST likely immediate next step for the policy author?

Reveal answer and explanations
  1. A Delete the failing test file so the CI pipeline turns green.

    Incorrect. Deleting tests to hide failures removes the signal the CLI is providing.

  2. B Re-run with `--force` to skip assertions and mark the test as passed.

    Incorrect. `kyverno test` has no `--force` flag to mask assertion failures.

  3. C Inspect per-resource output to determine whether policy or expectation is wrong.

    Correct. The expected workflow is to read the per-resource output to decide whether the policy, the resource, or the test expectation is wrong and then fix it.

  4. D Ignore the failure because `kyverno test` failures do not block admission in-cluster.

    Incorrect. The point of running `kyverno test` in CI is to catch regressions before rollout.

Applying Policies

Q4. You want a validate rule to apply only to resources that have the annotation `policy.example.com/enforced: "true"`. Which construct fits best?

Reveal answer and explanations
  1. A A `preconditions.all` expression comparing the annotation value.

    Correct. `preconditions` let a rule narrow evaluation based on arbitrary JMESPath/CEL expressions like annotation values.

  2. B A global Helm flag that filters resources before they reach the webhook.

    Incorrect. Helm flags do not provide per-resource annotation filtering.

  3. C An admission webhook `objectSelector`, but only matched by name.

    Incorrect. `objectSelector` matches labels, not annotations, and is less expressive than preconditions.

  4. D A `PolicyException` covering every other resource in the cluster.

    Incorrect. Creating `PolicyException`s for every other resource is not a scalable or idiomatic pattern.

Writing Policies

Q5. Which rule type automatically adds or modifies fields on a Kubernetes resource?

Reveal answer and explanations
  1. A `validate`

    Incorrect. `validate` rules accept or deny resources; they do not change them.

  2. B `mutate`

    Correct. `mutate` rules modify incoming resources, for example by adding labels, annotations, or default fields.

  3. C `generate`

    Incorrect. `generate` rules create new resources rather than modifying the triggering one.

  4. D `verifyImages`

    Incorrect. `verifyImages` validates image signatures; it does not mutate other fields.

Policy Management

Q6. Which of these is a common Prometheus alerting use case built on Kyverno metrics?

Reveal answer and explanations
  1. A Alerting when `kyverno_admission_review_duration_seconds` p99 crosses an SLO.

    Correct. Webhook latency is a typical SLO and `kyverno_admission_review_duration_seconds` is the canonical histogram exposed by Kyverno for this purpose.

  2. B Alerting when a Pod's `spec.nodeName` changes unexpectedly.

    Incorrect. Node reassignment is unrelated to Kyverno metrics.

  3. C Alerting when the kernel version on worker nodes is older than the control plane.

    Incorrect. Kernel version drift is a node-level concern, not a Kyverno policy concern.

  4. D Alerting when an `EtcdDefrag` CronJob has not completed for 24 hours.

    Incorrect. Etcd defrag is unrelated to Kyverno policy metrics.

Start the full KCA mock exam90-min timer · paid plan required

Prerequisites and background knowledge

Kubernetes RBAC and admission controller concepts. Understanding of Kubernetes resource schemas (Pod spec, labels, annotations).

Official reference: cncf.io/training/certification/kca.

More KCA practice resources

Free KCA sample questions KCA exam tips

Where to go after KCA

Once you pass KCA, these certs are natural next steps on the Golden Kubestronaut path:

KCSA — Kubernetes and Cloud Native Security AssociateCNPA — Certified Cloud Native Platform Engineering Associate

Frequently asked questions about KCA

What is the passing score for KCA?

75%.

How long is the KCA exam?

90 minutes, multi-choice format. See the official CNCF page for the current question count.

How difficult is the KCA exam?

Rated intermediate. Plan 1–6 weeks depending on your background.

How much does the KCA exam cost?

Pricing changes periodically — check the official CNCF KCA page at https://www.cncf.io/training/certification/kca/.

Are these KCA mock exams free?

Sample questions on this page are free with no account. Full timed KCA mocks require a paid plan.

How is this mock exam different from the real KCA exam?

Original questions written against the official CNCF curriculum — not scraped dumps. Format mirrors the real exam; the real one is proctored, these are self-paced.

What is the best way to study for KCA?

Work through the official curriculum in order of domain weight (heaviest first), then run full timed mocks until you hit 85%+ consistently.