20 CNPA Sample Questions with Answers

How to use these CNPA practice questions

Work through the 20 CNPA sample questions in one sitting without looking anything up. For each question, decide on an answer first, then open the answer and read the explanation, including when you were right, because a correct guess and a correct line of reasoning look identical until the exam rewords the question. Mark every question as right, wrong or guessed, and count a guess as wrong when you score yourself. Give the set about 28 minutes, which is the average time per question on the real exam multiplied by twenty. The aim is to find out which exam domains are already solid and which ones need study before you buy the exam.

The official exam format is 85 questions in 120 minutes, with a passing score of 75%, according to the Linux Foundation documentation checked on 2026-10-28.

With JavaScript enabled, each answer starts collapsed behind a Show answer button so you can test yourself. Without JavaScript, and for any crawler or screen reader that reads the raw page, every answer and explanation is already visible below its question.

These questions were written for GoldenKube practice. They are not copied from the real exam, and nothing on this page tells you what the real exam will ask.

These 20 questions are published here with answers and explanations. In the practice app you can answer 10 questions as a guest; a free account unlocks the full CNPA bank of more than 100 questions.

• Read the question twice and underline the constraint words: "most", "least", "first", "only", "not".
• Eliminate options you can prove wrong before you pick between the rest.
• Where a question says to select all that apply, every correct option must be chosen and none of the wrong ones.
• Read the explanation even for questions you got right; it often names the nearby concept the exam likes to swap in.

Platform Engineering Core Fundamentals (7 questions)

Platform Observability, Security, and Conformance (4 questions)

Continuous Delivery & Platform Engineering (3 questions)

Platform APIs and Provisioning Infrastructure (2 questions)

IDPs and Developer Experience (2 questions)

Measuring your Platform (2 questions)

Score yourself

The Linux Foundation lists a passing score of 75% for CNPA. On a set of 20 questions that is 15 correct. Reaching 15 here is a useful signal and not a prediction: 20 questions is a small sample, and the real exam covers every domain in its published weights. Use the table below to decide what to do next. Count only the questions you answered correctly without help, and be strict about it: a question you got right for the wrong reason belongs in the missed pile. Then repeat the exercise a few days later with a different set from the full bank so that you are measuring understanding and not memory of these specific questions.

Count your misses per domain, using the headings above. One missed question in a domain is noise; three misses in one domain is a study plan. The practice mode on GoldenKube does this sorting for you by sending you back to the domains where you are weakest.

Platform Engineering Core Fundamentals: what it tests

Platform Engineering Core Fundamentals is the largest CNPA domain. The curriculum lists declarative resource management, DevOps practices, application environments and infrastructure, platform architecture and capabilities, the goals and approaches of platform engineering, continuous integration, and continuous delivery with GitOps. Expect questions on why a platform is treated as a product for internal users, how self-service and golden paths reduce cognitive load, how kubectl apply differs from imperative commands, what namespaces, quotas and probes do for an environment, and what the OpenGitOps principles say. A common trap is an answer that sounds like good engineering but describes a central team doing the work for others on request, which the CNCF Platforms White Paper contrasts with self-service. Read each scenario for who acts: the user or the platform team.

List the seven competencies of this domain and write one sentence on each from memory. The domain is broad, and the gaps show up as blank lines.

Platform Observability, Security, and Conformance: what it tests

Platform Observability, Security, and Conformance covers what a platform needs to watch, protect and enforce. The curriculum names observability with traces, metrics, logs and events, secure service communication, policy engines, Kubernetes security essentials, and security in CI/CD pipelines. Expect questions on OpenTelemetry signals and context propagation, mutual TLS and workload identity with SPIFFE, admission policy with OPA Gatekeeper or Kyverno, Pod Security Admission modes, RBAC, NetworkPolicy isolation, Secrets at rest, and supply chain controls such as SBOMs, Sigstore signing, SLSA levels and image digests. The trap is defaults: a Secret is not encrypted in etcd unless encryption at rest is configured, and a NetworkPolicy isolates only the Pods it selects. Learn what each control does by default before you learn its options.

For each control in this domain, write down its default and the one setting that changes it. Most scenario questions turn on exactly that pair.

Continuous Delivery & Platform Engineering: what it tests

Continuous Delivery & Platform Engineering covers how changes reach production and what happens when they break. The curriculum lists continuous integration pipelines, incident response, the relationship between CI and CD, GitOps basics and workflows, and GitOps for application environments. Expect questions on pipeline triggers such as Tekton Triggers, what DORA advises when the build on trunk fails, incident roles and blameless postmortems from the Google SRE book, how a CI pipeline hands a new image to a GitOps controller through Git, and how Argo CD ApplicationSets or Flux Kustomizations model several environments or clusters. The trap is the default behaviour of GitOps tools: automated sync in Argo CD does not prune or self-heal unless those options are enabled. Questions often hinge on one such setting.

Draw the path of one change from commit to a running Pod, naming the tool and the actor at each step. Then mark where an incident would be declared and who would act.

Platform APIs and Provisioning Infrastructure: what it tests

Platform APIs and Provisioning Infrastructure covers how a platform exposes infrastructure as an API. The curriculum lists the Kubernetes reconciliation loop, APIs for self-service platforms built with custom resource definitions, infrastructure provisioning with Kubernetes, and the operator pattern. Expect questions on what a controller does with desired and current state, what a CRD gives you without a controller, when a stand-alone API fits better than a custom resource, how Crossplane composite resources, compositions and managed resources fit together, and which tasks an operator automates. The trap is assuming a custom resource does something by itself: without a controller it is stored data only. Questions describe a goal, such as a self-service database API, and ask which extension mechanism or Crossplane object provides it.

Sketch one self-service API end to end: the resource a user creates, the controller that reconciles it and the external resource it manages. Each box is a likely question.

IDPs and Developer Experience: what it tests

IDPs and Developer Experience covers how users reach the platform. The curriculum lists simplified access to platform capabilities, API-driven service catalogs, developer portals for platform adoption, and AI and machine learning in platform automation. Expect questions on the self-service attribute and on meeting users where they are in the CNCF Platforms White Paper, how a Backstage software catalog is fed from metadata files in source control, what software templates do, the maturity model levels for interfaces and adoption, and what DORA and CNCF material say about AI workloads and AI adoption on a platform. The trap is equating a portal with a platform: the white paper treats the portal as one interface among several, alongside APIs and command-line tools. The domain is small, so a few clear concepts carry most questions.

Name three interfaces through which a user could request the same capability, and say which kind of user each one suits. That framing answers most questions here.

Measuring your Platform: what it tests

Measuring your Platform covers how a platform team shows that its work helps. The curriculum lists platform efficiency and team productivity, and DORA metrics for platform initiatives. Expect questions on the metric categories in the CNCF Platforms White Paper, such as user satisfaction and productivity, organizational efficiency, and product and feature delivery, the SPACE framework for developer productivity, the measurement levels in the Platform Engineering Maturity Model, and the DORA software delivery metrics with their split into throughput and instability. The trap is misuse of metrics: DORA advises against comparing unlike applications or ranking teams, and the maturity model warns about Goodhart's law. Know the definition of each DORA metric exactly, because options often swap one for another.

Write each DORA metric with its start and end point, for example from commit to production for change lead time. Exact definitions are the cheapest points in this domain.

What a 20-question CNPA sample can and cannot tell you

A set of 20 questions is a screening test, not a measurement. With only a few questions per domain, one lucky guess or one unlucky wording moves your result by five percentage points, and a domain with only two questions behind it says almost nothing about that domain's true strength. The set is also fixed, so after one read-through it measures your memory of these items and not your command of CNPA. Use it to choose where to start studying, not to decide whether you are ready, and then rely on the larger bank, where questions repeat only after a gap and the app tracks which domains stay weak.

A second limit is style. Written practice questions share one author voice, while a real exam draws on many writers and reads differently. Treat any practice score, here or elsewhere, as one input next to the official curriculum, hands-on experience with the technology, and the documentation of the project itself.

A one-week plan after the CNPA sample set

After the sample set, spend a week turning the result into a plan. Start with the domains where you missed questions and read the matching part of the official curriculum before you try more questions, because practice is far more useful once you can explain the topic. Return to practice in short daily sessions, review every missed question the next day, and leave the last day for a fresh mixed set. Keep a simple note of which concepts caused misses; the same three or four ideas usually explain most of them, and naming them is what turns practice into progress.

The largest CNPA domain is Platform Engineering Core Fundamentals, at 36% of the published weights. If two domains tie for weakest in your tally, start with the heavier one, and keep the other 5 domains ticking over with short reviews.

Adjust the pace to your calendar. If you have more time, spread the same steps over two or three weeks and add a second mixed session at the end of each week. If you have less, keep days 1 to 3 and day 6 and accept a rougher picture. What matters is that every study session starts from a specific weak domain and ends with a check, not that the plan is followed to the letter.

Practice the full CNPA bank

These 20 questions are a small slice of the GoldenKube CNPA bank, which holds more than 100 questions. In practice mode the app serves the questions you are due to review first, then the domain where you are weakest, and it brings missed questions back after a gap until you answer them correctly. You can answer 10 questions as a guest without an account; after that a free account keeps your progress, and no credit card is asked for at any point. Each answer comes with the same kind of written explanation you saw on this page, so a wrong answer is always followed by the reasoning that fixes it.

Practice mode shows one question at a time and gives the verdict and explanation as soon as you answer. A focus option lets you stay inside a single domain until it feels solid, which is the natural next step after finding your weakest domain on this page. There is no timer and no exam simulation in practice mode; the goal is learning, not performance under pressure.

Frequently asked questions