CertArea
All Linux Foundation / CNCF exams

Free CNPE practice test: 30 questions with answers

30 original questions for Certified Cloud Native Platform Engineer, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

CNPE exam guide: topics, cost and format

All 30 CNPE questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Kubernetes operations (4 questions)

  1. Question 1

    A platform team wants a Deployment to keep a fixed number of Pods running even when a node fails. Which Kubernetes controller behaviour provides this?

    1. AThe kubelet on each node schedules new Pods across the cluster
    2. BThe kube-proxy rewrites Service rules
    3. CThe ReplicaSet controller reconciles the desired replica count
    4. DThe etcd snapshot job copies Pod specs
    Show answer and explanation
    Correct answer: C

    A Deployment manages ReplicaSets, which reconcile the desired replica count. The kubelet runs Pods on its own node, kube-proxy handles Service networking, and etcd snapshots do not schedule Pods.

  2. Question 2

    A namespace-scoped team needs read access to Pods in its own namespace only. Which Kubernetes object expresses this permission?

    1. AA ClusterRole bound cluster-wide with a ClusterRoleBinding
    2. BA NetworkPolicy allowing ingress to Pods
    3. CA ConfigMap containing the team's credentials
    4. DA Role bound to the team with a RoleBinding
    Show answer and explanation
    Correct answer: D

    A Role with a RoleBinding grants permissions limited to one namespace. A cluster-wide binding grants more than needed, NetworkPolicies control traffic rather than API access, and ConfigMaps do not grant permissions.

  3. Question 3

    A Pod keeps restarting because its container exceeds its memory limit. Which field should the platform team inspect first?

    1. AThe Pod's labels and annotations only, reviewed alongside node taints
    2. BThe container's resources.limits.memory setting and the termination reason
    3. CThe Service's session affinity and load-balancing algorithm, which spreads client connections
    4. DThe namespace's display name and description annotation shown in dashboards
    Show answer and explanation
    Correct answer: B

    Checking the memory limit and the termination reason, such as OOMKilled, identifies the cause. Labels, session affinity and display names do not affect memory termination.

  4. Question 4

    A team needs to ensure that Pods are spread across availability zones so that a single zone failure does not take down the whole service. Which scheduling feature addresses this?

    1. APod disruption budgets alone
    2. BIncreasing the log retention period
    3. CA larger container image
    4. DTopology spread constraints
    Show answer and explanation
    Correct answer: D

    Topology spread constraints distribute Pods across zones or other topology domains. A disruption budget limits voluntary evictions, image size is unrelated, and log retention does not affect placement.

Observability (4 questions)

  1. Question 5

    Which three pillars are commonly used to describe observability data?

    1. AServers, routers and switches
    2. BMetrics, logs and traces
    3. CUsers, roles and groups
    4. DImages, containers and volumes
    Show answer and explanation
    Correct answer: B

    Metrics, logs and traces are the core observability signals. Hardware, container artifacts and identity objects are infrastructure or access concepts.

  2. Question 6

    A platform team wants to measure the reliability of a service from the user's perspective. Which concept best fits?

    1. AThe size of the container registry image layers stored
    2. BThe number of lines of code in the service repository
    3. CThe number of engineers on the team who hold on-call rotations
    4. DService level indicators and objectives based on user-facing requests
    Show answer and explanation
    Correct answer: D

    SLIs and SLOs measure reliability from the user's perspective. Code size, team size and registry size do not measure user experience.

  3. Question 7

    Distributed tracing helps a platform team identify which component in a request path causes latency. What does a trace record?

    1. AThe total disk usage of each node and the volume mounts attached to every container
    2. BThe developer's keyboard layout and preferred IDE theme settings stored locally
    3. CThe list of installed packages on each image and the base layer digest for every build
    4. DThe timing and relationships of spans as a request moves across services
    Show answer and explanation
    Correct answer: D

    Traces record spans with timing and parent-child relationships across services. Disk usage, package lists and keyboard layouts are not trace data.

  4. Question 8

    Which two practices make alerting more useful for on-call engineers? (Choose two.)

    1. AInclude a link to a runbook in the alert
    2. BAlert on every single log line that contains the word error
    3. CSend all alerts to a shared inbox with no owner
    4. DAlert on symptoms that affect users, such as SLO burn rate
    5. ESet thresholds so low that alerts fire constantly
    Show answer and explanation
    Correct answer: A, D

    Symptom-based alerts such as SLO burn rate and runbook links make alerts actionable. Alerting on every error log, unowned inboxes and constant noise lead to fatigue and missed issues.

Security and policy (4 questions)

  1. Question 9

    Which approach enforces a rule such as 'all containers must run as non-root' for every workload admitted to a cluster?

    1. AA monthly manual spreadsheet review of container securityContext fields
    2. BA policy engine running as an admission controller, such as Kyverno or OPA Gatekeeper
    3. CA comment in the application code reminding developers to set runAsNonRoot
    4. DRelying on each developer to remember the rule when writing new manifests
    Show answer and explanation
    Correct answer: B

    A policy engine as an admission controller enforces rules on every admitted workload. Spreadsheets, comments and memory are not enforcement mechanisms.

  2. Question 10

    A team stores database passwords in a Kubernetes Secret. Which additional practice reduces the risk of exposure?

    1. ARestrict access with RBAC and encrypt Secrets at rest
    2. BPrint the decoded Secret value in CI build logs
    3. CShare the Secret in a team chat channel for review
    4. DPush the Secret manifest to a public repository
    Show answer and explanation
    Correct answer: A

    RBAC restricts who can read Secrets and encryption at rest protects them in etcd. Public commits, log output and chat sharing expose them.

  3. Question 11

    Which principle is most important when designing platform access for many application teams?

    1. AShared credentials for several teams stored in one common vault and reused
    2. BFull administrator access for every team to avoid delays
    3. CLeast privilege, granting only the permissions each team needs
    4. DUnlimited access to production data, including customer records and backups
    Show answer and explanation
    Correct answer: C

    Least privilege limits access to what each team needs. Universal administrator access, shared credentials and unlimited production access all expand risk.

  4. Question 12

    A supply chain security requirement asks teams to prove that a container image was built from an approved source. Which practice addresses this?

    1. AImage signing and provenance attestations verified before deployment
    2. BUsing the latest tag for each release candidate build
    3. CRenaming images to a shorter name to save registry storage
    4. DDisabling image scanning in the pipeline to save build minutes
    Show answer and explanation
    Correct answer: A

    Signatures and provenance attestations verified before deployment prove the origin of an image. Renaming, using latest tags and disabling scanning do not provide that proof.

Platform fundamentals (4 questions)

  1. Question 13

    A platform team wants to reduce the cognitive load on application developers. Which goal best describes the purpose of an internal developer platform?

    1. ARequire every application team to provision and operate its own dedicated Kubernetes cluster from scratch
    2. BReplace application development teams with dedicated platform engineers who take over writing, testing and releasing services in production
    3. CProvide self-service, paved paths so developers can deliver software without needing deep infrastructure expertise
    4. DCentralize application source code, build pipelines and deployment manifests in one shared monorepo that teams commit to directly
    Show answer and explanation
    Correct answer: C

    An internal developer platform offers self-service paved paths that reduce cognitive load. Replacing teams, per-team clusters and a single repository do not describe the platform's purpose.

  2. Question 14

    Which term describes a standard, well-supported route that a team can follow to build, deploy and operate a common type of application?

    1. AGolden path
    2. BSingle point of failure
    3. CTechnical debt register
    4. DShadow IT
    Show answer and explanation
    Correct answer: A

    A golden path is a supported, opinionated route for a common workload. A single point of failure is a reliability risk, shadow IT is unsanctioned tooling, and a debt register records known problems.

  3. Question 15

    Which two outcomes indicate a platform is delivering value to application teams? (Choose two.)

    1. AThe platform team has the largest budget in the company
    2. BLead time for changes decreases over time
    3. CEvery team uses a different deployment method
    4. DDevelopers need to learn every underlying cloud API
    5. ETeams can provision standard environments without filing manual tickets
    Show answer and explanation
    Correct answer: B, E

    Self-service provisioning and shorter lead times are signs of platform value. Budget size, fragmented deployment methods and developers needing every cloud API are not indicators of value.

  4. Question 16

    A platform team measures its success by how quickly application teams can ship safely. Which metric family is most directly relevant?

    1. ANumber of platform features shipped regardless of adoption by application teams
    2. BDelivery performance metrics such as deployment frequency and lead time for changes
    3. CNumber of bare-metal servers and virtual machines owned by the platform team
    4. DVolume of internal documentation pages written each sprint for the team wiki
    Show answer and explanation
    Correct answer: B

    Deployment frequency and lead time for changes measure how quickly teams deliver safely. Feature counts regardless of use, server counts and documentation volume do not measure delivery outcomes.

Infrastructure as code (3 questions)

  1. Question 17

    Which property makes an infrastructure-as-code definition idempotent?

    1. AApplying it repeatedly produces the same end state without duplicating resources
    2. BEach run creates a new copy of every resource, leaving duplicate instances untracked by state
    3. CIt is applied once per environment, because a second apply would conflict with the existing state
    4. DIt requires manual approval steps and console clicks between each run in production
    Show answer and explanation
    Correct answer: A

    Idempotence means repeated application converges to the same state without duplicating resources. Creating new copies, one-time application and manual steps are the opposite of idempotence.

  2. Question 18

    A team stores its Terraform state file locally on one engineer's laptop. What is the main risk?

    1. AFaster provisioning times, because local state lets the apply skip the remote lock and the refresh
    2. BBetter naming consistency across teams, because the provider enforces resource names in state
    3. CLoss of the state, concurrent changes, and exposure of sensitive values in the state
    4. DAutomatic backups of every resource stored in the cloud provider's snapshot
    Show answer and explanation
    Correct answer: C

    Local state can be lost, causes conflicts when several people apply changes, and may contain sensitive values. It does not speed provisioning or provide backups or naming consistency.

  3. Question 19

    Which practice helps prevent accidental deletion of a critical production database managed by infrastructure as code?

    1. ADeleting the state file regularly so each plan starts from a clean baseline snapshot
    2. BProtective settings such as deletion protection plus review of destructive plan changes
    3. CRunning every change directly in production without a plan, applying with auto-approve to skip plan review
    4. DGranting every engineer full administrator rights on the production cloud account
    Show answer and explanation
    Correct answer: B

    Deletion protection and review of destructive plan changes guard against accidental loss. Deleting state, unplanned production changes and broad administrator rights all increase risk.

GitOps and delivery (3 questions)

  1. Question 20

    In a GitOps workflow, what is the role of a reconciliation controller such as Argo CD or Flux?

    1. AWrite application source code on behalf of developers during feature builds
    2. BReplace the container registry by pulling images directly from Git commits
    3. CStore secrets in plain text in the repository as unencrypted YAML values
    4. DContinuously compare the desired state in Git with the live cluster and correct drift
    Show answer and explanation
    Correct answer: D

    GitOps controllers continuously reconcile the live cluster with the desired state stored in Git. They do not write application code, replace registries, or store plain-text secrets.

  2. Question 21

    A platform team wants changes to production to be made only through pull requests that are reviewed and recorded. Which practice does this describe?

    1. AManual kubectl edits applied directly on production nodes during an outage
    2. BUnversioned configuration files kept on engineers' laptops and emailed
    3. CDeclarative configuration with an audit trail in version control
    4. DShared administrator passwords stored in a team wiki page
    Show answer and explanation
    Correct answer: C

    Declarative configuration in version control, changed through reviewed pull requests, gives an audit trail. Manual edits, shared passwords and unversioned files remove that control.

  3. Question 22

    Which two statements about GitOps are correct? (Choose two.)

    1. AGit must contain plain-text production secrets for GitOps to work
    2. BGitOps eliminates the need for code review
    3. CGitOps requires developers to apply changes with kubectl edit
    4. DManual changes made directly to the cluster are reverted by the reconciler when they drift
    5. EThe desired state is declared in version control and reconciled to the cluster
    Show answer and explanation
    Correct answer: D, E

    GitOps declares desired state in Git and reconciles the cluster to it, which reverts drift. Plain-text secrets are not required, code review remains valuable, and kubectl edits bypass the model.

CI/CD (3 questions)

  1. Question 23

    A pipeline builds an image once and promotes the same image digest through staging to production. Why is this preferred?

    1. AIt ensures the tested artifact is the exact artifact deployed, which improves traceability
    2. BIt guarantees the image contains no known vulnerabilities after scanning
    3. CIt removes the need for unit and integration tests in the build pipeline
    4. DIt makes builds slower, which improves quality because each rebuild adds delay
    Show answer and explanation
    Correct answer: A

    Promoting the same immutable artifact means the tested image is the deployed image, which improves traceability. Slowness is not a quality goal, tests remain necessary, and promotion does not guarantee a vulnerability-free image.

  2. Question 24

    Which practice reduces the blast radius of a faulty release to production?

    1. AProgressive delivery such as canary releases with automated rollback on error signals
    2. BDisabling liveness and readiness health checks to speed up rollout across the whole cluster
    3. CSkipping intermediate versions during the rollout to avoid staged database migration checks
    4. DDeploying every change to every region at the same moment without a staged rollout or rollback plan
    Show answer and explanation
    Correct answer: A

    Canary releases with automated rollback limit exposure to a faulty change. Simultaneous global rollout, disabled health checks and skipping versions increase the blast radius or hide problems.

  3. Question 25

    A pipeline runs the same test suite on every commit. Which property of the test suite is most important for trustworthy pipelines?

    1. ATests are reliable and deterministic, so a failure indicates a real problem
    2. BTests should take as long as possible to catch rare and subtle faults
    3. CTests are written to pass unconditionally, so builds stay green regardless of the code
    4. DTests are executed once a year during a scheduled release freeze window, with results archived
    Show answer and explanation
    Correct answer: A

    Reliable, deterministic tests make a failure meaningful. Long tests, always-passing tests and annual runs make the pipeline less useful.

Platform APIs and abstractions (3 questions)

  1. Question 26

    A platform team wants to offer a database to developers without exposing cloud provider details. Which mechanism supports this?

    1. AGiving developers the cloud provider's root account credentials with console and CLI access
    2. BA custom resource that a control plane reconciles into the underlying cloud resources
    3. CAsking developers to create databases manually in the console each time
    4. DHard-coding database connection strings in container images at build time
    Show answer and explanation
    Correct answer: B

    A custom resource reconciled by a control plane, as in Crossplane-style abstractions, hides provider details behind a simple API. Root access, manual console work and hard-coded strings do not provide that abstraction.

  2. Question 27

    Which benefit is most associated with a software catalogue in a developer portal?

    1. ADiscovering services, their owners, documentation and dependencies in one place
    2. BStoring production database passwords and API tokens in plain catalogue entries for each service
    3. CReplacing the source control system with a developer portal's built-in file editor
    4. DAutomatically rewriting application code across deployment pipeline stages
    Show answer and explanation
    Correct answer: A

    A software catalogue helps developers find services, owners, docs and dependencies. It does not replace source control, store production passwords, or rewrite code.

  3. Question 28

    A platform team wants developers to request a complete environment with one declarative resource that the platform expands into several underlying resources. Which concept describes this?

    1. AA manual runbook that operators follow with copy-paste steps
    2. BComposition of resources behind a higher-level API
    3. CA shared team spreadsheet that records assigned IP addresses
    4. DA single hard-coded virtual machine image with fixed IPs
    Show answer and explanation
    Correct answer: B

    Composition exposes a higher-level API that expands into several underlying resources. Manual runbooks, spreadsheets and a single hard-coded machine do not provide a declarative abstraction.

Reliability (2 questions)

  1. Question 29

    A team defines an error budget for its service. What does the error budget express?

    1. AThe amount of unreliability the SLO allows over a period before reliability work takes priority
    2. BThe total money allocated for errors in the cloud bill, which finance reconciles against monthly infrastructure costs
    3. CThe number of bugs the team may introduce into production each week before the next release review takes place
    4. DThe number of incidents the team is allowed to leave unreviewed during each quarter
    Show answer and explanation
    Correct answer: A

    An error budget is the unreliability an SLO allows, and when it is spent, reliability work takes priority. It is not a cloud cost, a bug quota, or permission to ignore incidents.

  2. Question 30

    A team is designing for resilience. Which practice helps a service continue working when a dependency becomes slow?

    1. AUnlimited retries with no timeout, retried in a tight loop against the dependency
    2. BSend every request to the slow dependency in parallel without a cap
    3. CTimeouts, retries with backoff, and circuit breaking for that dependency
    4. DRemoving error handling so that failed calls are treated as successful responses
    Show answer and explanation
    Correct answer: C

    Timeouts, backed-off retries and circuit breakers protect a service from a slow dependency. Unlimited retries and parallel floods worsen the slowdown, and removing error handling makes failures worse.