CNPA Exam Guide 2026: cost, format, passing score and study plan

CNPA exam facts

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation.

Booking, the ID and room checks, pacing, results and retakes are the same for every Linux Foundation multiple-choice exam: how Linux Foundation multiple-choice exams work.

CNPA exam domains and weights

How many questions and how long is CNPA?

The CNPA exam has 85 questions and a 120-minute limit, per the Linux Foundation exam instructions checked on 28 October 2026, which is about 85 seconds per question. CNPA items are usually short scenarios. A platform team wants a capability, a user hits a problem, or a tool behaves unexpectedly, and you choose the concept, tool or setting that explains or solves it. Other items test a definition: an OpenGitOps principle, a DORA metric, a maturity model level, a SLSA build level or a Crossplane object. A few ask you to select two answers. Options are often all plausible practices, so the deciding detail is usually who does the work, what a tool does by default, or which category a framework places something in.

CNPA questions are mostly short scenarios about a platform team and its users, so practise naming which actor does the work and which tool or concept fits the stated goal.

Pacing, flagging and the exam-day routine are the same for every Linux Foundation multiple-choice exam, so they are covered once in the shared guide on how those exams work.

What is the passing score for CNPA?

The Linux Foundation lists the CNPA passing score as 75% (checked 28 October 2026). The largest CNPA domain, Platform Engineering Core Fundamentals, carries 36% of the exam and Platform Observability, Security, and Conformance carries 20%, 56% together. The deciding points sit in the fundamentals domain, which is broad enough that candidates skip parts of it. Typical gaps are the difference between imperative and declarative object management, what a ResourceQuota or a probe does to a Pod, and the four OpenGitOps principles. In the smaller domains, tool defaults decide many items, such as Argo CD automated sync without pruning or self-heal, or Pod Security Admission warn versus enforce. Measurement questions are cheap points when the DORA definitions are known exactly and expensive when they are guessed.

Track practice accuracy per domain rather than one overall number; a good average can hide a weak, heavily weighted domain.

How much does CNPA cost and how long is it valid?

The CNPA exam fee is $250 (USD) on the official certification page, checked 28 October 2026. The certification is valid for 2 years. Prerequisites: None. Retake policy: One retake per exam purchase if a passing score is not achieved. CNPA is a multiple-choice exam about concepts, so the preparation cost is time, not infrastructure; a local cluster with kind or minikube is enough to try Argo CD, Flux, Kyverno or Crossplane if you want to see their defaults yourself. The CNPA curriculum PDF in the CNCF curriculum repository lists the competencies of each domain; its last change there is dated 1 April 2025, so compare it with the certification page before you start.

Booking, identification, the testing environment and the retake process are the same for every Linux Foundation multiple-choice exam and are covered once in the shared guide. GoldenKube practice is free: 10 guest answers, then a free account, no credit card. The exam fee is paid to the Linux Foundation.

How hard is CNPA?

CNPA is hard because it is wide rather than deep. Platform Engineering Core Fundamentals is 36% of the exam, Platform Observability, Security, and Conformance is 20%, Continuous Delivery & Platform Engineering is 16%, Platform APIs and Provisioning Infrastructure is 12%, and IDPs and Developer Experience and Measuring your Platform are 8% each. Few questions need deep command knowledge, but the material spans Kubernetes APIs, GitOps tools, policy engines, telemetry, supply chain security, incident practice, developer portals and delivery metrics. Many options are statements that are true in general but answer a different question, so precise reading decides the result. Candidates from an operations background tend to lose points on the product and measurement ideas, and candidates from a management background on the Kubernetes mechanics. The practical test is explaining each curriculum competency in two sentences.

CNPA puts 36% of its weight on Platform Engineering Core Fundamentals, as much as Platform Observability, Security, and Conformance and Continuous Delivery & Platform Engineering together at 20% and 16%. Platform APIs and Provisioning Infrastructure is 12%, and the two smallest domains are 8% each. With six domains and one dominant, the exam rewards a clear picture of what a platform is and how it is delivered.

The fundamentals domain itself is broad: declarative resource management, DevOps practices, environments, architecture and capabilities, goals and approaches, continuous integration, and continuous delivery with GitOps. The smaller domains are narrower and more factual, for example the defaults of a policy or GitOps tool, the parts of a Crossplane API, or the exact definition of a DORA metric.

Turn each curriculum competency into one question you could answer from memory, then check it against the official documentation. The competency list is short enough to cover completely, and the gaps show up quickly.

What to know cold for CNPA

Know the platform vocabulary from the CNCF Platforms White Paper and the Platform Engineering Maturity Model, because many questions use it directly: platforms as products, self-service, golden paths, reduced cognitive load, and the maturity levels from provisional to optimizing. Know the Kubernetes mechanics a platform is built on: declarative configuration with kubectl apply, controllers that reconcile current state toward desired state, custom resource definitions and operators. Know the GitOps principles and how Argo CD and Flux apply them, including their defaults. Know the security controls a platform enforces, from RBAC and Pod Security Admission to policy engines and signed artifacts. Finally, know the DORA software delivery metrics precisely, with their split into throughput and instability, and the warnings against using them to rank teams.

• OpenGitOps v1.0.0 has four principles: declarative, versioned and immutable, pulled automatically, and continuously reconciled.
• A controller watches cluster state and acts to move the current state toward the desired state; a CRD without a controller only stores structured data.
• Crossplane builds a custom API from a CompositeResourceDefinition and a Composition; managed resources are the custom resources whose controllers manage external resources.
• Argo CD automated sync neither prunes resources removed from Git nor reverts live changes unless pruning and self-heal are enabled.
• Pod Security Admission has three modes: enforce rejects violating Pods, while audit and warn allow them and only record or display the violation.
• Kubernetes Secrets are stored unencrypted in etcd by default; encryption at rest has to be configured.
• DORA throughput covers change lead time, deployment frequency and failed deployment recovery time; instability covers change fail rate and deployment rework rate.

A 3-week CNPA study plan

Week one is given to Platform Engineering Core Fundamentals, 36% of the exam, because every other domain uses its vocabulary: what a platform is for, self-service, declarative management, environments, CI and GitOps. Week two pairs Platform Observability, Security, and Conformance with Platform APIs and Provisioning Infrastructure, 32% together; both are about what the platform runs on and enforces, from telemetry and policy to controllers, CRDs, Crossplane and operators, and both reward reading the Kubernetes and project documentation closely. Week three covers Continuous Delivery & Platform Engineering, IDPs and Developer Experience and Measuring your Platform, another 32%. They describe how the platform is used and judged, through delivery workflows and incidents, portals and catalogs, and the metrics that show whether it works, so they read more easily once the mechanics are in place and lead naturally into a mixed review.

In the last few days, stop adding material: run mixed practice and review only the questions you missed.

Resources

The official CNPA certification page holds the current domain list, the fee and the booking link. For the subject itself, use CNCF Platforms White Paper (TAG App Delivery). Read the CNPA curriculum PDF in the CNCF curriculum repository first, so you have the competency list. Then read the Platforms White Paper and the Platform Engineering Maturity Model from TAG App Delivery, which define most of the vocabulary. For the Kubernetes mechanics use kubernetes.io: object management, controllers, custom resources, operators, Pod Security Admission and Secrets. For delivery read the OpenGitOps principles and the Argo CD and Flux documentation, and for measurement the DORA metrics guide on dora.dev. The Crossplane, Backstage, OpenTelemetry and Sigstore documentation cover the remaining tools.

• Official CNPA certification page and exam details on the Linux Foundation site.
• CNCF Platforms White Paper (TAG App Delivery).
• GoldenKube CNPA practice questions, free to start with 10 guest answers.

Frequently asked questions