When troubleshooting a Kyverno policy, which command should you use to check if a specific resource complies with the policy?
kyverno apply runs policy rules against given resource manifests locally, reporting pass or fail per resource without needing a cluster. This directly satisfies the stem's requirement to check whether a specific resource complies with a Kyverno policy.
Why this answer
The 'kyverno apply' command is used to apply Kyverno policies to a given resource or set of resources and check compliance. It simulates policy enforcement and reports whether the resource complies with the specified policies. This is the correct command for troubleshooting whether a specific resource adheres to a policy.
Exam trap
CGOA often tests Kyverno CLI commands, and candidates may confuse 'kyverno apply' with 'kyverno test'; the former checks resource compliance, while the latter runs policy unit tests.
How to eliminate wrong answers
Option A is wrong because 'kubectl get policies' is not a valid command; Kyverno policies are custom resources, typically retrieved with 'kubectl get clusterpolicy' or 'kubectl get policy'. Option B is wrong because 'kyverno test' is used to run unit tests against policies, not to check a specific resource's compliance. Option C is wrong because 'kubectl describe policy' is not a standard command for Kyverno policies; you would use 'kubectl describe clusterpolicy'.