Linux Foundation / CNCF CNPA: Certified Cloud Native Platform Engineering Associate

Last checked October 22, 2026 against the official Linux Foundation / CNCF exam page.

1. Question 1Platform Engineering Core Fundamentals

   A platform team wants developers to describe the desired state of their services in version-controlled files instead of running imperative commands against the cluster. Which principle does this apply?

   1. ADeclarative resource management
   2. BImperative scripting with manual sequencing
   3. CAd hoc configuration through a shared terminal
   4. DSnapshot-based recovery of server disks
   Show answer and explanationHide answer

   Correct answer: A

   Declarative management describes the desired state, and a controller works to make the actual state match it. Imperative scripts and ad hoc terminal changes record steps rather than intent and drift over time.

2. Question 2Platform Observability, Security, and Conformance

   A microservice team wants to understand why one request took 900 milliseconds across five services. Which observability signal is designed for this purpose?

   1. AA list of container image tags and digests from the registry
   2. BAggregate CPU and memory usage graphs for each worker node sampled every 60 seconds
   3. CThe configuration file of the external cloud load balancer
   4. DDistributed traces that link spans across services for a single request
   Show answer and explanationHide answer

   Correct answer: D

   Traces record the timing and path of one request through each service as linked spans, which makes latency hotspots visible. Node CPU graphs and image lists do not show per-request paths.

3. Question 3Continuous Delivery & Platform Engineering

   A team is choosing deployment strategies for a customer-facing service. Which strategy sends a small share of live traffic to a new version first so that problems are detected before a full rollout?

   1. ADeploying only to a test cluster and never to production
   2. BBig-bang replacement of all instances at once
   3. CDeleting the old version before deploying the new one
   4. DCanary release
   Show answer and explanationHide answer

   Correct answer: D

   A canary release routes a small percentage of traffic to the new version and expands only if metrics stay healthy. Big-bang and delete-first approaches expose all users at once, and test-only deployment does not validate production behavior.

4. Question 4Platform APIs and Provisioning Infrastructure

   A platform team wants developers to request a managed database through a Kubernetes API object rather than a ticket. Which extension mechanism provides a new custom resource type for this?

   1. ANode labels applied by hand
   2. BPod security standards
   3. CConfigMaps containing free-form text
   4. DCustom Resource Definitions (CRDs)
   Show answer and explanationHide answer

   Correct answer: D

   CRDs extend the Kubernetes API with new resource kinds, which a controller can then reconcile into real infrastructure. ConfigMaps store data rather than define types, labels describe nodes, and pod security standards govern pod settings.

5. Question 5IDPs and Developer Experience

   A platform team wants developers to find services, documentation, and ownership information from one place. Which kind of tool is designed for this?

   1. AA network packet capture appliance
   2. BA developer portal and service catalog
   3. CA PostgreSQL streaming replication monitor
   4. DA nightly batch tape backup system
   Show answer and explanationHide answer

   Correct answer: B

   A developer portal with a service catalog centralizes discovery of services, owners, and documentation, which reduces friction. Packet capture, tape backup, and replication monitoring do not serve discovery.