Certified Argo Project Associate (CAPA) Practice Exam

What the Certified Argo Project Associate (CAPA) exam covers

• Argo Workflows256 questions
• Argo CD242 questions
• Argo Rollouts128 questions
• Argo Events88 questions

Free CAPA practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 714-question bank.

1. Question 1Argo CD

   In an Application's spec.source block, which property holds the address of the Git repository that Argo CD reads the manifests from?

   • ArepoURLCorrect
   • Bpath
   • CtargetRevision
   • Dserver
   ✓ Correct answer: A

   spec.source.repoURL is the address of the repository Argo CD clones or queries to retrieve manifests for the Application.

   Why the other options are wrong

   • Bpath points to a subdirectory inside the repository, not the repository address itself.
   • CtargetRevision selects which branch, tag, or commit to use, not the repository location.
   • Dserver belongs to spec.destination and identifies the target cluster, not the source repository.
2. Question 2Argo CD

   What does annotating a resource with argocd.argoproj.io/hook: Skip cause Argo CD to do?

   • AExclude that resource from being applied during syncCorrect
   • BDelete the resource permanently from the cluster
   • CRun the resource only as a PostSync hook
   • DForce the resource to run before PreSync hooks
   ✓ Correct answer: A

   Skip is one of the values of the argocd.argoproj.io/hook annotation. The docs define it as indicating to Argo CD to skip the application of the manifest, and hooks marked with Skip are not applied during the sync phases.

   Why the other options are wrong

   • BSkip only excludes the resource from being applied; it does not delete anything from the cluster.
   • CSkip is unrelated to hook phases; it simply omits the resource from sync actions.
   • DSkip does not reorder or force execution timing relative to hooks; it just excludes the resource from sync.
3. Question 3Argo Rollouts

   Why does running `kubectl rollout status` against a resource named the same as a Rollout typically fail or show unexpected output?

   • A`kubectl rollout` targets apps/v1 kinds like Deployment, not the argoproj.io Rollout CRDCorrect
   • BRollouts do not expose a status subresource at all
   • CThe Rollout must first be converted into a Deployment before status can be queried
   • Dkubectl rollout only works when Argo CD, not Argo Rollouts, manages the cluster
   ✓ Correct answer: A

   Because Rollout is a custom resource from argoproj.io rather than apps/v1, the native kubectl rollout commands do not target it; the kubectl argo rollouts plugin provides the equivalent status, promote, and undo commands for Rollouts.

   Why the other options are wrong

   • BRollouts do expose a rich status subresource with phase, step index, and hash information.
   • CThere is no requirement to convert a Rollout back into a Deployment for any operation.
   • DArgo CD is unrelated; the limitation is purely about kubectl's built-in command not recognizing the CRD.
4. Question 4Argo Workflows

   What does the workflowSpec field inside a CronWorkflow resource contain?

   • AThe RBAC role bindings and service account permissions required to let the controller create new Workflow objects
   • BA list of the names and completion timestamps of every past Workflow object already created by this schedule
   • CThe full Workflow spec, such as entrypoint and templates, instantiated as a new Workflow on each scheduled runCorrect
   • DThe cron expression alone, describing exactly when the schedule should fire, without any template information
   ✓ Correct answer: C

   Every time the schedule fires, the controller copies workflowSpec into a brand-new Workflow object, giving it a generated name derived from the CronWorkflow.

   Why the other options are wrong

   • ARBAC is handled through standard Kubernetes role bindings, not a CronWorkflow field.
   • BPast run names are not stored inside workflowSpec; that field only defines what to run next.
   • DThe cron expressions live in the separate schedules field (a list), not inside workflowSpec.
5. Question 5Argo Workflows

   What is the purpose of spec.onExit in a Workflow?

   • AIt names a template that runs once the workflow finishes, any outcomeCorrect
   • BIt sets the maximum allowed runtime for the whole workflow
   • CIt names the first template the workflow should execute
   • DIt defines a synchronization mutex for the whole workflow
   ✓ Correct answer: A

   spec.onExit names a template to run once the main workflow concludes, whether it succeeded, failed, or errored, commonly used for cleanup or notification logic. The documented exception is argo terminate, which immediately stops a workflow and does not run any exit handlers; argo stop still runs them.

   Why the other options are wrong

   • BRuntime bounding is handled by activeDeadlineSeconds, not onExit.
   • CThe first template to run is chosen by spec.entrypoint, not onExit.
   • DMutex configuration lives under spec.synchronization, unrelated to onExit.
6. Question 6Argo CD

   A team applies an Application manifest with kubectl into the team-a namespace. Argo CD runs in the argocd namespace with its default configuration. What happens to that Application?

   • AArgo CD does not reconcile itCorrect
   • BArgo CD reconciles it and deploys into team-a
   • CArgo CD moves the Application object into argocd
   • DArgo CD reconciles it, but never syncs it
   ✓ Correct answer: A

   Argo CD can manage Application resources in namespaces other than the control plane's namespace (usually argocd) only after that feature is explicitly enabled: each such namespace must be listed in --application-namespaces for the application controller and server, and allowed in the AppProject's sourceNamespaces.

   Why the other options are wrong

   • BBy default Argo CD only reconciles Applications in its control plane namespace; managing them in other namespaces must be explicitly enabled.
   • CArgo CD does not relocate Application objects between namespaces.
   • DThere is no read-only mode for Applications in namespaces that are not enabled; they are not managed at all.
7. Question 7Argo Workflows

   A CronWorkflow sets no history limits. How many completed Workflows does it keep by default?

   • A3 successful and 1 failedCorrect
   • B1 successful and 3 failed
   • Call of them until deleted
   • Dnone; each is deleted on completion
   ✓ Correct answer: A

   The CronWorkflow options table lists successfulJobsHistoryLimit with a default of 3 and failedJobsHistoryLimit with a default of 1, the number of successful and failed Workflows to persist.

   Why the other options are wrong

   • BThe defaults are the other way round: 3 successful and 1 failed.
   • CBoth limits have defaults, so not every Workflow is kept.
   • DCompleted Workflows are kept up to the default limits.
8. Question 8Argo CD

   An ApplicationSet uses the Cluster generator with a selector of matchLabels argocd.argoproj.io/secret-type: cluster. Argo CD runs in its own cluster, whose default in-cluster entry has never been edited, and it also manages two remote clusters added with argocd cluster add. How many Applications does the generator produce?

   • A3, as every cluster Argo CD manages carries that label
   • B0, as that label marks repository Secrets, not clusters
   • C3, as the selector is not applied to the local cluster
   • D2, as the local cluster has no Secret with that labelCorrect
   ✓ Correct answer: D

   Managed clusters are stored within Secrets in the Argo CD namespace, each labelled argocd.argoproj.io/secret-type: cluster, and the Cluster generator targets both local and non-local clusters that match its selector. A selector on that label will not match the default local cluster, since the default local cluster does not have a Secret and thus does not have the label. To include it while using label matching, a Secret must be created for the local cluster, for example by renaming it in the web UI.

   Why the other options are wrong

   • AThe default local cluster does not have a Secret, so it does not carry the argocd.argoproj.io/secret-type label and is not matched.
   • BEach cluster Secret must have the label argocd.argoproj.io/secret-type: cluster, so the two remote clusters match the selector.
   • CThe generator targets local and non-local clusters alike for every cluster that matches the selector; the local cluster is left out only because it does not match.
9. Question 9Argo Workflows

   A data pipeline Workflow creates a scratch PersistentVolumeClaim through spec.volumeClaimTemplates and sets no volumeClaimGC. After a month of daily runs, which runs have left their claim behind?

   • Anone, as claims are deleted whenever a run completes
   • Bonly the runs that did not succeed, such as Failed or ErrorCorrect
   • Cevery run, since claims are kept unless volumeClaimGC is set at all
   • Donly the runs whose step pods podGC had not removed
   ✓ Correct answer: B

   VolumeClaimGC describes how to delete volumes from completed Workflows. Its strategy is one of OnWorkflowCompletion or OnWorkflowSuccess and defaults to OnWorkflowSuccess. The cost optimisation guide puts it the same way: by default, claims are only deleted when a workflow is successful.

   Why the other options are wrong

   • ADeleting claims whenever a Workflow completes is the OnWorkflowCompletion strategy; the default is OnWorkflowSuccess.
   • CAn unset volumeClaimGC still has a default, OnWorkflowSuccess, so the claims of successful runs are deleted.
   • DpodGC describes how to delete completed pods; claims follow volumeClaimGC, which by default deletes them only when a workflow is successful.
10. Question 10Argo CD

    In the AppProject shop, the role ci carries the policy p, ci, applications, sync, shop/web, allow. A pipeline authenticates with a JWT token created for that role, but its sync requests are denied. Which cause does the user guide give?

    • AThe policy subject has to be written as proj:shop:ci, otherwise the policy is not effectiveCorrect
    • BThe token has to be created with an expiration, since tokens without one are not accepted
    • CThe policy object has to be a wildcard, because a policy naming one Application is not accepted
    • DThe role also needs a g line in argocd-rbac-cm that binds the token to the role
    ✓ Correct answer: A

    The guide says it is very important that policy roles follow the pattern proj:<project-name>:<role-name>, or they won't be effective during the Argo CD authorization process. Here the policy names the subject ci instead of proj:shop:ci. A token can be created with or without an expiration, a project policy can name a single Application as its object, and a JWT token is associated directly with the policies of its role.

    Why the other options are wrong

    • BJWT tokens can be created with or without an expiration, and the CLI creates them without an expiration date by default.
    • CThe guide's own example adds a policy whose object is a single Application, and a wildcard is shown as one alternative, so a named Application is accepted.
    • DThe JWT token is associated with the policies of its role; the g lines shown in the guide bind groups to a project role and are not required for a token.

Who this Certified Argo Project Associate (CAPA) practice exam is for

This practice set is for anyone preparing for the Certified Argo Project Associate (CAPA) exam at the intermediate level - from first-time candidates building a foundation to experienced Cloud Native practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Certified Argo Project Associate (CAPA) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Certified Argo Project Associate (CAPA) exam.

Related Cloud Native resources

• Certified Argo Project Associate (CAPA) study guideKey concepts
• Cloud Native practice examsAll Cloud Native
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Certified GitOps Associate (CGOA) practice examRelated
• CKA practice examRelated
• CKAD practice examRelated

Certified Argo Project Associate (CAPA) practice exam FAQ