KCA: CNCF KCA (Kyverno Certified Associate)

About the KCA Exam

Prove you can automate Kubernetes security, compliance, and governance with Kyverno

Master Kyverno end to end — the policy-as-code model for Kubernetes. The KCA covers Kyverno fundamentals (the ClusterPolicy and Policy resources and the validate, mutate, generate, and verifyImages rule types, admission controllers, and distributing policies as OCI images), installation and configuration (Helm installs into a dedicated Namespace, the admission/background/reports/cleanup controllers, CRDs, controller flags, RBAC, high availability, and upgrades), the Kyverno CLI (apply, test, and jp for shift-left policy testing), applying policies and resource selection, writing policies (validation pattern anchors, preconditions, mutation with strategic-merge and RFC-6902 JSON patches, generation with data and clone plus synchronize, verifyImage rules with cosign attestors, variables and API calls, autogen, cleanup policies, and CEL), and policy management (Policy Reports in the OpenReports format, PolicyExceptions, and Prometheus metrics). Original practice questions covering all 6 official KCA domains. Not affiliated with, endorsed by, or sourced from CNCF or Linux Foundation certification exams.

Who Should Take This Exam?

The KCA is designed for platform engineers, DevSecOps and security engineers, DevOps engineers, and SREs who use Kyverno to enforce policy-as-code on Kubernetes. There are no formal prerequisites; a working familiarity with Kubernetes resources, YAML, and admission control is helpful but not required. The exam is multiple-choice and focuses on how Kyverno works — writing validate, mutate, generate, and verifyImages rules, installing and configuring the controllers, using the CLI, and managing policy reports and exceptions.

Typical study time: 2-4 weeks of focused study

Exam Quick Facts

Exam Domains & Weights

The KCA exam covers 6 domains. Focus your study time based on the weights below — higher-weighted domains have more exam questions.

💡 Study tip: Writing Policies (32%) is by far the heaviest domain — you must be able to write and read validate rules (the pattern anchors: conditional, equality, existence, negation, and add-if-not-present), mutate rules (strategic-merge versus RFC-6902 JSON patches, and mutate-existing), generate rules (data versus clone, and synchronize), and verifyImages rules (cosign keyed versus keyless attestors and attestations). Next, know the two 18% domains — Fundamentals (the validate/mutate/generate/verifyImages rule types and how Kyverno runs as an admission controller) and Installation (the four controllers, Helm high availability, and RBAC). Then be fluent with the Kyverno CLI (apply, test, jp) and the difference between Enforce and Audit.

Practice Exam — 250 Questions

Prepare for the KCA with our 250-question practice exam covering all 6 exam domains. Every question includes detailed explanations and maps to official exam objectives.

What you get:

• ✅ Exam simulation mode with timer
• ✅ Spaced repetition for weak areas
• ✅ Detailed explanations for every question
• ✅ Progress tracking across domains
• ✅ 20 free questions — no account needed

CNCF Certification Path

Start with KCNA (Kubernetes and Cloud Native Associate) for cloud native fundamentals. The KCA (Kyverno) certifies your ability to enforce policy-as-code on Kubernetes, and pairs naturally with the security track — KCSA (security associate) and CKS (Certified Kubernetes Security Specialist) — as well as the core Kubernetes track (CKA administrator and CKAD developer), CCA (Cilium) for networking and runtime security, and CGOA/CAPA for GitOps continuous delivery.

Related CNCF Certifications

If you’re studying for the KCA, you might also be interested in these CNCF certifications:

• KCSA: CNCF Kubernetes and Cloud Native Security Associate — 250 practice questions
• CKS: CNCF Certified Kubernetes Security Specialist — 250 practice questions
• CCA: CNCF Certified Cilium Associate — 250 practice questions
• KCNA: CNCF Kubernetes and Cloud Native Associate — 250 practice questions

Study Tips

1. Master writing policies — Writing Policies (32%) is the biggest domain; be able to author and interpret validate, mutate, generate, and verifyImages rules, know the pattern anchors, and understand strategic-merge versus JSON patches and generate data versus clone
2. Use our practice exam — try the 20 free questions first to gauge your readiness
3. Review explanations — don’t just check if you got it right; read why each answer is correct
4. Simulate exam conditions — use the timed exam mode to practice under pressure