100+ Free KCA Practice Questions

Pass your Kyverno Certified Associate (KCA) exam on the first try — instant access, no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately

100+ Questions

100% Free

1 / 10

Question 1

Score: 0/0

What is Kyverno?

A Kubernetes-native policy engine that uses Kubernetes resources (YAML) to define policies without a DSL

A container runtime

A CI/CD server

A service mesh

to track

2026 Statistics

Key Facts: KCA Exam

Questions

Linux Foundation

90 min

Time Limit

Linux Foundation

75%

Passing Score

Linux Foundation MC FAQ

$250

Exam Fee

Linux Foundation

1 retake

Included

KCA product page

2 years

Validity

Linux Foundation

As of April 15, 2026, the Linux Foundation lists KCA as a 60-question, 90-minute remotely proctored multiple-choice exam with a $250 exam-only price and one retake included. The current published domain weights are Fundamentals of Kyverno (18%), Installation/Configuration/Upgrades (18%), Kyverno CLI (12%), Applying Policies (10%), Writing Policies (32%), and Policy Management (10%). The certification is valid for two years and has no formal prerequisites.

Sample KCA Practice Questions

Try these sample questions to test your KCA exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1What is Kyverno?

A.A Kubernetes-native policy engine that uses Kubernetes resources (YAML) to define policies without a DSL

B.A container runtime

C.A CI/CD server

D.A service mesh

Explanation: Kyverno is a policy engine that manages and validates Kubernetes resources using policies expressed as Kubernetes YAML. Unlike Rego-based engines, Kyverno policies look like native Kubernetes resources.

2Which Kubernetes mechanism does Kyverno primarily use to intercept resource requests?

A.Admission controllers (ValidatingWebhookConfiguration and MutatingWebhookConfiguration)

B.Custom scheduler plugins

C.kubelet hooks

D.CNI chains

Explanation: Kyverno registers dynamic admission webhooks that intercept API server requests and evaluate policies before resources are persisted. This lets it validate or mutate objects at admission time.

3Which two kinds represent Kyverno policies?

A.Policy (namespaced) and ClusterPolicy (cluster-scoped)

B.Role and ClusterRole

C.NetworkPolicy and GlobalNetworkPolicy

D.Deployment and StatefulSet

Explanation: Kyverno defines policies through the Policy (namespaced) and ClusterPolicy (cluster-scoped) CRDs. ClusterPolicy applies cluster-wide, while Policy applies to a single namespace.

4A Kyverno policy consists of one or more what?

A.Rules

B.Secrets

C.ConfigMaps

D.Roles

Explanation: Each Kyverno Policy or ClusterPolicy has a list of rules, each with a type (validate, mutate, generate, or verifyImages) and a match/exclude selector. Rules are the unit of evaluation.

5Which is NOT a Kyverno rule type?

A.validate

B.mutate

C.rollback

D.generate

Explanation: Kyverno's rule types are validate, mutate, generate, verifyImages, and cleanup. There is no 'rollback' rule type.

6In Kyverno, what does a 'match' block define?

A.The resources a rule applies to, by kind, name, namespace, labels, or other selectors

B.Which node the Pod runs on

C.Which container image to pull

D.Which Pod restart policy to use

Explanation: The match block (including 'resources' and 'any'/'all' selectors) identifies which resources a rule applies to. Exclude blocks narrow the set further.

7In Kyverno, what does an 'exclude' block define?

A.Resources that the rule should NOT apply to, narrowing matches

B.A list of CPU architectures

C.Nodes to drain

D.Secrets to rotate

Explanation: Exclude refines the match by removing specific resources, namespaces, users, or ClusterRoles from consideration. It is essential for real-world policy authoring.

8Kyverno policies are authored in what format?

A.Kubernetes YAML manifests

B.A custom DSL

C.OPA Rego

D.Starlark

Explanation: Kyverno policies are native Kubernetes resources written in YAML. This is a deliberate design choice so Kubernetes users do not need to learn a new language.

9What does 'OCI image' mean in the Kyverno context?

A.Open Container Initiative image, the industry standard format Kyverno can inspect and verify

B.A proprietary Kubernetes image

C.A Kyverno-specific file format

D.A kernel module

Explanation: OCI is the standardized container image format, and Kyverno supports inspecting and verifying OCI images (for example with Cosign signatures) via verifyImages rules. Kyverno also supports OCI artifacts to distribute policies.

10Which of these Kubernetes objects does Kyverno typically NOT define as its own CRD?

A.Deployment

B.ClusterPolicy

C.PolicyReport

D.PolicyException

Explanation: Deployment is a core Kubernetes resource, not a Kyverno CRD. ClusterPolicy, PolicyReport, and PolicyException are all Kyverno/WGPolicyK8s-aligned CRDs.

About the KCA Exam

The Kyverno Certified Associate (KCA) is a foundational certification for engineers implementing Kubernetes policy with Kyverno. It validates conceptual knowledge of Kyverno installation, CLI, applying and writing policies, and policy management in a remotely proctored multiple-choice format.

Assessment

60 multiple-choice questions

Time Limit

90 minutes

Passing Score

75%

Exam Fee

$250 (Cloud Native Computing Foundation (CNCF) / Linux Foundation)

KCA Exam Content Outline

32%

Writing Policies

Validation, mutation, generation, and verifyImages rules; variables; context entries; CEL expressions; and cleanup policies.

18%

Fundamentals of Kyverno

Policies and rules, YAML manifests, admission controllers, and OCI image concepts underpinning Kyverno.

18%

Installation, Configuration, and Upgrades

Helm-based installation, CRDs, controller configuration, RBAC, high availability, and upgrade workflows.

12%

Kyverno CLI

kyverno apply, kyverno test, kyverno jp commands, and installing the CLI.

10%

Applying Policies

Cluster application, resource selection via match/exclude, and common policy settings like failureAction and background.

10%

Policy Management

Policy reports, PolicyExceptions, and metrics for observing policy outcomes.

How to Pass the KCA Exam

What You Need to Know

Passing score: 75%
Assessment: 60 multiple-choice questions
Time limit: 90 minutes
Exam fee: $250

Keys to Passing

Complete 500+ practice questions
Score 80%+ consistently before scheduling
Focus on highest-weighted sections
Use our AI tutor for tough concepts

KCA Study Tips from Top Performers

1Start with Writing Policies because that single domain is 32% of the exam blueprint.

2Know the four rule types (validate, mutate, generate, verifyImages) and the difference between each.

3Understand how Kyverno integrates with the Kubernetes admission controller chain (ValidatingWebhook, MutatingWebhook).

4Practice reading common policy fields: match, exclude, pattern, preconditions, context, failureAction.

5Learn the CLI verbs: kyverno apply for local application, kyverno test for test suites, kyverno jp for JMESPath.

6Review PolicyReport, ClusterPolicyReport, and PolicyException resources used in policy management.

Frequently Asked Questions

How many questions are on the KCA exam?

Linux Foundation's KCA page and multiple-choice instructions describe a 60-question exam delivered online through PSI Bridge. Candidates receive 90 minutes to complete the questions and the certification is valid for two years after passing.

What score do you need to pass KCA?

Linux Foundation multiple-choice exams typically require a 75% passing score. You should aim comfortably above that threshold on timed practice sets, especially on the Writing Policies domain which alone is 32% of the exam.

What are the official KCA domain weights?

The KCA curriculum weights Writing Policies at 32%, Fundamentals at 18%, Installation/Configuration/Upgrades at 18%, CLI at 12%, Applying Policies at 10%, and Policy Management at 10%. Nearly one-third of the exam is about writing validation, mutation, generation, and verifyImages rules, so hands-on YAML practice matters even though the exam itself is multiple choice.

Do I need to memorize Kyverno YAML syntax?

You do not need to write perfect policies from scratch, but you should read Kyverno YAML fluently. Expect questions showing a policy fragment and asking what it does, which rule type applies, or which field controls the behavior. Skim the Writing Policies docs and practice reading match/exclude, pattern, mutate, generate, and verifyImages blocks.

How much does the KCA exam cost?

The exam-only KCA price on the Linux Foundation product page is $250 with one retake included. A THRIVE-ONE annual subscription bundle is available at $495 for candidates who want broader training access alongside the exam.

How long should I study for KCA?

Most candidates prepare in 3 to 6 weeks with 25 to 40 focused study hours, depending on prior experience with Kubernetes admission control and policy languages. Spend the most time on policy writing and admission controller behavior because those concepts dominate the blueprint.