CAPA Mock Exam · Set 2

This is the companion paper to Set 1: forty more multiple-choice questions, weighted question-for-question to the same four domains of the official CAPA curriculum — fourteen on Argo Workflows, fourteen on Argo CD, seven on Argo Rollouts, five on Argo Events. Where Set 1 leans on straight recall — naming template types, matching a component to its job — this set leans harder into reading a manifest or a scenario and working out what actually happens, which is the question shape CAPA candidates report most often. CAPA is knowledge-based, so there is nothing to install here and no cluster to break: read the stem, pick an answer, then read the explanation underneath it whether you got it right or not. Sit it as one uninterrupted block, answer every question even when guessing, and treat a wrong answer as a free pointer to exactly which part of the blueprint page to re-read.

How to sit this paper

☺ Like you're 10: Set a timer, close every other tab, and go straight through without stopping to look anything up.

A mock paper only tells you the truth if you sit it under the conditions it's imitating. Looking things up mid-paper measures your search skills, not your recall — so treat this like the real 90-minute sitting: one block, no documentation open, no other tabs, and a committed answer on every question, even a guessed one. Nothing published states that Linux Foundation multiple-choice exams deduct marks for a wrong answer, so there is no reason to ever leave one blank.

The protocol

1. Set a clock for 90 minutes. That's the duration the Linux Foundation publishes for CAPA — see the logistics table on the blueprint page for the full picture and why it's worth re-verifying before you book.
2. Answer, then open the explanation. If it just confirms what you thought, move on. If it surprises you, write down the concept — that list becomes your revision plan for the next two days.
3. Don't re-sit immediately. Go and re-read your two weakest domains first. A second attempt an hour later measures short-term memory, not knowledge.
4. Sit Set 1 and this paper on separate days if you haven't already — same weighting, different question shapes, and together they're a much more honest signal than either alone.

What this paper deliberately is not

It isn't a leaked or reconstructed exam — the wording, the scenarios and the fictional service names below are original to this course, not the CNCF's. And a multiple-choice paper is the right shape of practice specifically because CAPA is knowledge-based: you pick answers, you never touch a live cluster. That's a genuinely different exam family from the five core Kubernetes certifications this course assumes and doesn't re-teach — covered in full over in Kubernetes — which are almost entirely performance-based, live-terminal exams that no quantity of multiple choice can substitute for.

How the forty questions are weighted

☺ Like you're 10: The questions are shared out the same way the real test shares out its marks — the two biggest topics get about a third each, and the two smaller ones get the rest.

The four published weights — 36%, 34%, 18%, 12% — are applied to forty questions the same way the blueprint page applies them to the real exam. The arithmetic is worth doing in full: 36% of 40 is 14.4, 34% of 40 is 13.6, 18% of 40 is 7.2, and 12% of 40 is 4.8. Rounding each to the nearest whole question gives 14, 14, 7 and 5 — and 14 + 14 + 7 + 5 is exactly 40, so no domain needs a tie-break the way some sixty-question papers do. Notice what the rounding does, though: Argo Workflows and Argo CD land on the same headcount here, fourteen apiece, even though the real curriculum weighs Workflows very slightly higher. Don't let that flatten your sense of which domain is actually bigger — re-read the blueprint's domain table if the 36-vs-34 distinction is fuzzy.

The forty questions run across four blocks of ten, each block mixing all four domains rather than grouping them — exactly like the real exam, where you never know which domain the next question belongs to. Budget roughly twenty minutes per block against the 90-minute clock, with ten minutes held back at the end for anything you flagged:

The paper — 40 questions in exam order

☺ Like you're 10: Read the recipe card if there is one, pick your best answer, then check yourself before moving to the next one.

Each question names its domain in parentheses. On the real exam you won't get that label, so if you sit this paper a second time, try covering the domain tags and see how many you can still place by content alone.

Block 1 — Q1–10

Q1 (Argo Workflows). Which of the six core template types is classified only as an invocator — its entire purpose is composing other templates, never running anything itself — and expresses ordering as nested lists, sequential outer and parallel inner?

• A. dag
• B. steps
• C. resource
• D. suspend

Q2 (Argo CD). An Application has syncPolicy.automated: { prune: true, selfHeal: true }. An engineer manually deletes a Service that the Git source still declares. What happens?

• A. Argo CD leaves it deleted — selfHeal only reverts field-level changes, never deletions
• B. Argo CD recreates it on the next reconciliation, because a missing declared resource counts as drift and selfHeal reverts drift in either direction
• C. The Application sits OutOfSync until someone runs a manual sync
• D. prune deletes the Service from Git to match the cluster

Q3 (Argo Workflows). Which field lets a Workflow reuse a template defined elsewhere by name, rather than declaring the template's steps inline every time?

• A. templateRef, pointing at a WorkflowTemplate
• B. exitHandler
• C. entrypoint
• D. activeDeadlineSeconds

Q4 (Argo CD). An AppProject named launch-platform restricts sourceRepos to one Git URL and destinations to one cluster/namespace pair. What is this actually enforcing?

• A. Which Helm chart versions may be deployed
• B. A tenancy boundary — which repositories and destinations Applications inside this project may sync from and to
• C. The order resources apply in during a sync
• D. Whether pruning is globally disabled

Q5 (Argo Rollouts). A canary Rollout's steps are [{setWeight: 20}, {pause: {duration: 10m}}], and no traffic router (no service mesh VirtualService, no ALB annotation, no SMI TrafficSplit) is configured anywhere in the spec. How does the controller actually approximate that 20%?

• A. It can't, and the Rollout stays Progressing forever
• B. Only through replica-count ratios between the canary and stable ReplicaSets — roughly one canary pod for every four stable pods at six replicas — rather than a true weighted traffic split
• C. It silently installs Istio to enforce the weight
• D. It sends all traffic to the canary immediately, ignoring the weight

Q6 (Argo Workflows). A dag has tasks build, test and deploy, where deploy lists dependencies: [build, test]. If build succeeds but test fails, what happens to deploy by default?

• A. It runs anyway using only build's output
• B. It never starts — one of its two dependencies did not succeed, so the DAG fails without running deploy
• C. It runs but is marked Error rather than Failed
• D. test is silently retried until it passes, then deploy runs

Q7 (Argo CD). Which resource hook fires only when the sync operation as a whole has failed — useful for a rollback notification or cleanup of a half-applied change?

• A. PreSync
• B. PostSync
• C. SyncFail
• D. Skip

Q8 (Argo Events). What is the EventBus component's job, specifically?

• A. Authenticating incoming webhook senders
• B. The transport layer — typically NATS/JetStream or Kafka — that carries events an EventSource publishes to whichever Sensors are subscribed
• C. Rendering a Sensor's trigger template into a Kubernetes object
• D. Acting as a Kubernetes Ingress in front of webhook EventSources

Q9 (Argo Workflows). Which two fields on a container template control automatic retries after a transient pod failure?

• A. parallelism and activeDeadlineSeconds
• B. retryStrategy.limit and retryStrategy.retryPolicy
• C. ttlStrategy and podGC
• D. suspend and a manual resume

Q10 (Argo CD). An Application's ignoreDifferences block targets group: apps, kind: Deployment, jsonPointers: ["/spec/replicas"]. Why would a team add exactly this?

• A. To stop Argo CD from ever syncing that Deployment again
• B. To stop a HorizontalPodAutoscaler's legitimate replica changes from being flagged as drift and reverted by selfHeal
• C. To make prune delete the Deployment
• D. To pin the Deployment's container image tag

Block 2 — Q11–20

Q11 (Argo CD). Which field pair on an Application's source block renders the source through Helm rather than applying raw manifests, and picks a specific values file?

• A. kustomize.namePrefix and images
• B. helm.valueFiles and helm.releaseName
• C. syncPolicy.automated
• D. destination.namespace

Q12 (Argo Workflows). A CronWorkflow has schedule: "0 */6 * * *" and concurrencyPolicy: Forbid. If the previous scheduled run is still executing when the next trigger time arrives, what happens?

• A. Both runs execute concurrently
• B. The new run is skipped until the current one finishes
• C. The running Workflow is terminated and replaced by the new one
• D. The schedule is disabled going forward

Q13 (Argo CD). Which annotation orders resources within a single sync — for example, making sure a Namespace and a ConfigMap apply before the Deployment that depends on them?

• A. argocd.argoproj.io/sync-wave
• B. argocd.argoproj.io/hook
• C. argocd.argoproj.io/tracking-id
• D. argocd.argoproj.io/compare-options

Q14 (Argo Workflows). A container template declares outputs.artifacts, but no artifact repository (S3, GCS or MinIO) has been configured anywhere. What actually happens to that artifact?

• A. Nothing to worry about — Argo Workflows stores all artifacts in etcd by default
• B. The artifact has nowhere to persist to; a repository must be configured (cluster-wide, or per-Workflow) or the step fails to save its output
• C. It's automatically written to the Sensor's EventBus instead
• D. It's stored inside the Workflow's parameters block

Q15 (Argo Events). A Sensor depends on a webhook EventSource and triggers a Workflow submission. A developer POSTs to the webhook endpoint, but nothing fires. Following the flow EventSource → EventBus → Sensor → trigger, which single component is the first thing to check?

• A. The submitted Workflow's retryStrategy
• B. The EventBus — if it's missing, unhealthy or unreachable, no event ever reaches the Sensor regardless of how correct the EventSource and Sensor look
• C. Argo CD's repo-server
• D. The Rollout's AnalysisTemplate

Q16 (Argo CD). What does an Application's health status tell you that its sync status does not?

• A. Whether Git and the live cluster currently match
• B. Whether the live resource is actually functioning — Healthy, Progressing or Degraded — independent of whether it matches Git
• C. Whether the AppProject permits this sync
• D. Whether prune is currently enabled

Q17 (Argo Workflows). Which template type is purpose-built to pause a Workflow indefinitely until a human (or the API) explicitly resumes it — a manual approval gate mid-pipeline?

• A. resource
• B. suspend
• C. script
• D. dag

Q18 (Argo Rollouts). In a blueGreen strategy, which field, set to false, requires an explicit promotion before the new version's Service starts receiving production traffic?

• A. scaleDownDelaySeconds
• B. autoPromotionEnabled
• C. previewService
• D. abortScaleDownDelaySeconds

Q19 (Argo CD). An ApplicationSet uses a git generator pointed at a directory of per-environment folders. What does the ApplicationSet controller actually do with this?

• A. It replaces the need for an AppProject entirely
• B. It templates one Argo CD Application per matched folder, so a new environment folder in Git automatically produces a new Application without anyone hand-writing it
• C. It acts as a Helm chart repository
• D. It performs the raw kubectl apply itself, bypassing the application controller

Q20 (Argo Workflows). What's the practical difference between WorkflowTemplate and ClusterWorkflowTemplate?

• A. WorkflowTemplate can run only once; ClusterWorkflowTemplate can be scheduled
• B. WorkflowTemplate is namespaced and reusable within that namespace; ClusterWorkflowTemplate is cluster-scoped and referenceable from any namespace
• C. ClusterWorkflowTemplate can't contain a dag
• D. They're interchangeable aliases for the same object

Block 3 — Q21–30

Q21 (Argo Rollouts). When a canary Rollout reaches an analysis step, what object does the controller create, and what does it carry that the AnalysisTemplate itself does not?

• A. Another Rollout, carrying a new replica count
• B. An AnalysisRun, carrying the live measured metric values and a pass/fail/inconclusive status for this specific attempt
• C. A Sensor, carrying event filters
• D. A ConfigMap, carrying the Prometheus address

templates:
  - name: pipeline
    dag:
      tasks:
        - name: extract
          template: extract
        - name: transform-a
          template: cruncher
          dependencies: [extract]
        - name: transform-b
          template: cruncher
          dependencies: [extract]
        - name: load
          template: loader
          dependencies: [transform-a, transform-b]   # waits for BOTH to succeed

Q22 (Argo Workflows). Using the DAG fragment above: extract succeeds, transform-a succeeds, but transform-b fails. What happens to load?

• A. It runs anyway, using only transform-a's output
• B. It never starts — one of its two dependencies didn't succeed, so the DAG (and the Workflow) fails without running load
• C. It starts and waits indefinitely for transform-b to eventually succeed
• D. It automatically retries transform-b even though no retryStrategy is set on that template

Q23 (Argo CD). A team wants one Application whose only job is pointing at a Git directory containing several other Application manifests, so a new file in that directory brings a new Application under management automatically. Which pattern is this?

• A. Sync waves
• B. App-of-Apps
• C. ignoreDifferences
• D. Resource hooks

Q24 (Argo Rollouts). Midway through a canary rollout, the AnalysisRun's failureLimit is exceeded. What's the controller's default behaviour?

• A. It automatically restarts the entire rollout from setWeight: 0
• B. It aborts the rollout, shifts traffic back to the stable ReplicaSet, and parks the Rollout in a Degraded state rather than silently retrying, so a human has to look at it
• C. It ignores the failed analysis and promotes anyway
• D. It deletes the stable ReplicaSet

Q25 (Argo Workflows). Which field lets a later step consume a computed value — like a short string — from an earlier step, without going through the artifact repository at all?

• A. outputs.artifacts
• B. outputs.parameters, populated via valueFrom (a file path or a JSONPath) and read downstream as {{tasks.x.outputs.parameters.y}}
• C. outputs.exitCode alone
• D. inputs.artifacts

metadata:
  name: run-migration
  annotations:
    argocd.argoproj.io/hook: PreSync   # runs, and must finish, before the Deployment applies
spec:
  template:
    spec:
      restartPolicy: Never
      containers:
        - name: migrate
          image: kubestronaut/orbit-db-migrate:2.1.0
          command: ["./migrate", "up"]

Q26 (Argo CD). Given the Job above, why is PreSync — rather than Sync or PostSync — the correct hook for a database migration that must finish before the new Deployment rolls out?

• A. Sync-phase hooks run concurrently with the main sync's resources, so the Deployment could roll out before the migration finishes
• B. PreSync runs and must complete before the main sync's resources — including the Deployment — are applied at all
• C. PostSync is reserved for notifications only, never for Jobs
• D. It makes no difference which hook phase is used

Q27 (Argo Rollouts). Which kubectl argo rollouts plugin command explicitly advances a paused canary or blue/green Rollout to its next step (or to full traffic) without waiting out the remaining pause duration?

• A. kubectl argo rollouts promote
• B. kubectl argo rollouts pause
• C. kubectl argo rollouts get rollout
• D. kubectl argo rollouts abort

Q28 (Argo Workflows). A Workflow sets spec.parallelism: 2 on a DAG containing five mutually independent tasks. What does this actually control?

• A. The number of retries permitted per task
• B. A ceiling on how many of those five tasks the controller will run as pods at once, even though all five are otherwise eligible to start simultaneously
• C. The overall Workflow timeout
• D. How many WorkflowTemplates may be referenced

Q29 (Argo CD). What actually renders a Kustomize overlay or a Helm chart into plain manifests before Argo CD compares and applies anything?

• A. The application controller applies the raw chart directly, unrendered
• B. The repo-server, using Helm- or Kustomize-equivalent rendering logic driven by the source.helm or source.kustomize block, before the application controller ever sees plain manifests
• C. The Kubernetes API server renders Helm charts natively
• D. The argocd-server renders it client-side, in the browser, only when the UI is open

Q30 (Argo Events). Which statement correctly distinguishes Argo Events from KEDA, a distinction the exam expects candidates to get right?

• A. They're the same project published under two names
• B. Argo Events creates new Kubernetes objects (like a Workflow) in reaction to a discrete external event; KEDA scales the replica count of an already-existing workload up or down based on a backlog or metric
• C. KEDA is one of the four projects under the Argo umbrella
• D. Argo Events only reacts to Prometheus metrics

Block 4 — Q31–40

Q31 (Argo Workflows). Which template type would you use to create or patch an arbitrary Kubernetes object — say, a ConfigMap, or a patch to an existing Deployment — as one step of a Workflow, rather than running a container image?

• A. script
• B. resource
• C. suspend
• D. dag

Q32 (Argo CD). An Application shows Synced and Degraded at the same time. What does that combination actually tell an on-call engineer?

• A. Git and the live cluster match exactly, but the live resource — say, a Deployment whose pods are crash-looping — isn't actually healthy; sync success says nothing about runtime health
• B. This state is impossible and indicates a controller bug
• C. Argo CD will auto-heal within seconds regardless of the underlying cause
• D. prune is stuck mid-operation

Q33 (Argo Rollouts). For a canary Rollout to shift a precise percentage of live production traffic — not just an approximate replica-count ratio — to the new version, what does it need in addition to the steps list?

• A. Nothing further — setWeight always produces an exact traffic percentage on its own
• B. A configured trafficRouting block pointing at a traffic router — an ingress controller, a service mesh, SMI, or the Gateway API
• C. A second Kubernetes cluster
• D. An EventBus

Q34 (Argo Events). Which Sensor field lets it react only to events matching specific criteria — for example, only webhook pushes to the main branch — rather than firing on every event from its dependency?

• A. eventSourceName alone
• B. filters — for example a dataFilter matching a JSONPath inside the event payload
• C. triggers.template.name
• D. The EventBus's replica count

Q35 (Argo Workflows). What's the scope difference between a Workflow's spec.arguments.parameters (global) and a template's own inputs.parameters (local)?

• A. There is no real difference between them
• B. Global parameters are set once at submission and can be referenced anywhere via {{workflow.parameters.x}}; a template's local inputs are scoped to that template and populated per invocation by whoever calls it
• C. Global parameters can only ever hold artifacts, never strings
• D. Local inputs silently override the entrypoint field

Q36 (Argo CD). What's the correct default direction for prune: true under syncPolicy.automated — what gets deleted, and from where?

• A. Resources present in the live cluster but no longer declared in Git are deleted from the cluster
• B. Resources that were removed from the cluster get deleted from Git too
• C. prune deletes the Application object itself
• D. prune only ever affects Helm-managed resources, never raw manifests

Q37 (Argo Rollouts). A Rollout points at an existing Deployment via workloadRef instead of inlining its own pod template. What's the actual benefit of this pattern?

• A. It disables canary strategies entirely
• B. It lets a team keep managing the Deployment's pod template through their existing tooling, while Rollouts drives the progressive-delivery strategy on top of it, instead of duplicating the pod spec inside the Rollout
• C. It removes the need for an AnalysisTemplate
• D. It automatically converts the strategy to blueGreen

Q38 (Argo Events). Beyond submitting a Workflow, name a trigger type a Sensor can execute that acts on any Kubernetes object type generically — for instance, patching an Argo CD Application's annotation to force an out-of-band refresh.

• A. The k8s trigger, which can create or patch any Kubernetes resource, not only Workflows
• B. The slack trigger only
• C. The argoWorkflow trigger, which is limited to Workflow objects and can't touch other resource kinds
• D. There is no generic trigger type — every trigger is Workflow-specific

Q39 (Argo Workflows). What does an onExit handler on a Workflow's spec guarantee?

• A. It runs a named template exactly once when the Workflow finishes, regardless of whether it succeeded or failed — commonly used for cleanup or a notification
• B. It retries the entrypoint template automatically
• C. It suspends the Workflow before it even starts
• D. It deletes the Workflow's pods immediately on any failure, skipping the exit template entirely

Q40 (Argo CD). Which single statement best distinguishes selfHeal from a plain, non-automated sync?

• A. selfHeal is a one-time manual action; a plain sync happens automatically on a timer
• B. selfHeal is automated sync's continuous behaviour of reverting out-of-band drift the moment it's detected; a non-automated sync only reconciles when a human or the CLI explicitly triggers it
• C. selfHeal only works when the source is Kustomize, never Helm
• D. A plain sync ignores Git entirely and only checks live cluster state

Marking yourself, and what to do next

☺ Like you're 10: Your score is a thermometer, not a verdict — the list of questions you got wrong is the actual useful part.

Count your correct answers out of 40 and convert to a percentage. The number to beat is 75%: per the blueprint page's logistics table, the Linux Foundation's Multiple Choice Exam FAQ states that a score of 75% or above must be earned to pass a multiple-choice exam, and CAPA is one — though that figure lives on the Foundation's general FAQ, not a CAPA-specific page, so it's worth re-confirming before you book. This paper isn't calibrated to the real exam's difficulty and the wording is entirely original to this course, so don't read a score here as a literal prediction of your real result — but the pattern of where you lost points travels reliably:

Whatever you scored, do one more thing before closing the tab: for every question you missed, write in your own words why the option you picked was wrong — not just why the correct one was right. That sentence is what actually stops the same mistake happening again in the real sitting.

Where each domain is taught

☺ Like you're 10: Every question here traces back to one page. Go back to that page, not to a search engine.

Nothing in this paper is examined that isn't taught on this course. The CAPA blueprint page is the direct answer key at exam depth for all four domains; the wider Platform Engineering course covers the same tools at greater operational depth if you want more than the associate exam asks for.

Round it out with the fourteen-day study plan for a pacing schedule funded by domain weight, the practice question bank for drilling between full papers, the glossary for terminology, and the certifications overview for where CAPA sits against the other eight badges on this ladder.