Question 1

Which integration strategy minimizes Kyverno's processing load by using PSA to enforce a baseline cluster-wide while Kyverno handles a more restrictive profile?

Options :

A : Use PSA to enforce the baseline profile cluster-wide and Kyverno’s podSecurity subrule to enforce the restricted profile.

B : Apply both PSA and Kyverno to enforce the same profile at the same scope.

C : Configure PSA to enforce baseline per namespace and Kyverno cluster-wide.

D : Enforce the restricted profile with PSA cluster-wide and handle baseline with Kyverno.

Answer: A

Question 2

What is the function of setting 'synchronize: true' in a Kyverno generate rule?

Options :

A : It allows the generated resource to be periodically synced with an external data source.

B : It ensures that any changes to the source resource will automatically update the generated resource.

C : It enables bidirectional synchronization between source and destination resources.

D : It forces the generated resource to remain read-only.

Answer: B

Question 3

What is the behavior of Kyverno when a deny rule with multiple conditions uses an 'any' block and one of the conditions evaluates to true?

Options :

A : Kyverno ignores the true condition and checks if all other conditions are also true.

B : Kyverno logs the violation but allows the resource to be created.

C : Kyverno stops evaluating further conditions and denies the resource immediately.

D : Kyverno continues evaluating the remaining conditions to collect all violations.

Answer: C

Question 4

What is the default failure mode for Kyverno's admission webhooks, and what is its implication for cluster operability?

Options :

A : Fail-open; the cluster remains operable even if Kyverno is unavailable.

B : Retry until successful; the cluster continuously attempts to restore operability.

C : Ignore failures; the cluster operates without enforcing policies if Kyverno fails.

D : Fail-closed; the cluster may become inoperable if Kyverno is unavailable.

Answer: D

Question 5

What was a major breaking change introduced in Kyverno version 1.13?

Options :

A : Removal of wildcard view permissions for Kyverno controllers.

B : Introduction of a new Kyverno CLI tool for policy management.

C : Addition of new policy types for network management.

D : Deprecation of Helm as a supported installation method.

Answer: A

Confidently Practice Online with Free Kyverno-Certified-Associate Exam Cram

Buying Options: