CGOA Tooling Practice Question
You are configuring Flux to manage a multi-tenant cluster. You need to ensure that specific namespaces only allow images from an internal registry. Which tool should you use to enforce this at admission time?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Kyverno
Kyverno is a Kubernetes-native policy engine that can restrict image registries via admission controllers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ArgoCD Notifications
Why it's wrong here
Notifications provide alerts but do not block unauthorized resource creation.
- ✓
Kyverno
Why this is correct
Kyverno policies can validate image registry sources during admission.
- ✗
Sealed Secrets
Why it's wrong here
Sealed Secrets is strictly for secret management.
- ✗
Flux Image Automation Controller
Why it's wrong here
This controller handles image updates, not runtime admission policy.
About these practice questions
One of 325 original CGOA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This CGOA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CGOA exam.