Cloud Native Platform Engineering Associate (CNPA) - Practice Questions¶
15 questions for CNPA prep. The organizing idea: a platform is a product whose users can choose not to use it.
Cert page: exams/kubernetes/cnpa/
Question 1¶
Scenario: A platform team spent a year building a deployment system. Six months post-launch, 4 of 40 teams use it. Leadership proposes mandating it.
A. Mandate it to drive adoption B. Build a portal on top to improve discoverability, since teams that cannot find the platform will never adopt it, and discovery is the main barrier C. Run user research with the 36 non-adopting teams and make the golden path easier than their current approach D. Add more features
Answer
**Correct: C** **Why:** Low voluntary adoption is a product signal. A mandate hides the signal and creates resentment without fixing the cause. More features rarely address it, because the problem is usually onboarding friction, a missing escape hatch, or solving a problem teams do not have. A portal is a nicer front door to something people do not want.Question 2¶
Scenario: A platform hosts 40 trusted internal teams, a regulated payments division, and an external partner running code the company does not control.
A. Namespaces for internal teams, dedicated nodes or a cluster for payments, and a sandboxed dedicated cluster for the partner B. One shared cluster for all three groups, separated only by node labels and taints C. Namespace isolation for all three groups on the same shared nodes, with network policies, resource quotas, and Pod Security Standards enforced between them D. Virtual control planes for all three, on one shared node pool
Answer
**Correct: A** **Why:** Match isolation to trust level and compliance boundary. Namespace isolation shares a kernel and control plane, so it is not a boundary against untrusted code. Virtual control planes on shared nodes (D) still share the kernel. One shared cluster separated only by labels and taints (B) gives no real isolation boundary at all.Question 3¶
Scenario: A team needs a GPU workload with a custom scheduler that the golden path does not support.
A. Refuse the exception to keep the platform consistent, since supporting one-off schedulers would fragment the golden path B. Grant it while keeping the thin conformance layer (policy, telemetry, supply chain), and record it as input C. Immediately build GPU support into the golden path D. Grant the exception with no guardrails or conformance checks, and let the team run its own scheduler however it likes
Answer
**Correct: B** **Why:** Golden paths are the easiest route, not the only route. Refusing drives shadow platforms and loses visibility. What must never be optional is the conformance layer. Building GPU support for one team is premature; wait for the pattern to repeat.Question 4¶
Scenario: Developers wait five days for a database because they file a ticket and the platform team runs Terraform manually. Self-service is required without giving developers cloud credentials.
A. Expose the full cloud resource as a custom resource, with every provider field and option editable by developers B. Give developers Terraform and tightly scoped cloud credentials, with remote state, locking, and a pull request approval step C. A control plane pattern: a composite resource definition, a composition, and a policy-constrained claim D. A web form that files the ticket automatically, with the platform team still running Terraform by hand afterwards
Answer
**Correct: C** **Why:** Expose a simple claim, hide the composition, constrain with policy. The abstraction stays stable while the implementation changes underneath. Handing over credentials abandons the guardrails. A faster ticket is still ticket-driven. Exposing the full resource leaks the complexity the abstraction exists to hide.Question 5¶
Scenario: A platform team is asked to justify its budget and proposes reporting features shipped, lines of platform code, and tickets closed.
A. Add uptime as a fourth measure and keep the rest, since availability shows the platform is reliable for users B. Report only cost savings C. These are reasonable measures of team output, and finance teams generally accept them as evidence of value D. Replace them with DORA metrics, adoption, time to first deployment, satisfaction, and platform SLOs
Answer
**Correct: D** **Why:** All three proposed measures are vanity metrics. Tickets closed is actively misleading, because a successful self-service platform drives the ticket count down. Uptime is necessary but not sufficient: a reliable platform nobody uses has still failed.Question 6¶
Scenario: Leadership asks the team to "build an IDP" and points at Backstage. Three months after installing it and importing a catalog, developers report no improvement.
A. The capability layer was never built; a portal without a platform behind it is a catalog of links B. Install more Backstage plugins for CI status, Kubernetes views, and cost, so the portal shows more of each service C. The catalog metadata is incomplete, so owners, lifecycle and dependencies are missing for many components D. Abandon the portal
Answer
**Correct: A** **Why:** An Internal Developer Platform is the capability layer; an Internal Developer Portal is an interface onto it. The ordering was wrong. Build self-service provisioning, a golden path, and delivery automation, then use the portal for discovery and scaffolding.Question 7¶
Scenario: Security requires signed images, no critical CVEs, declared resource limits, and non-root execution in production, without the platform team becoming a review bottleneck.
A. Manual security review per release B. A check in the CI pipeline that fails the build when an image is unsigned, vulnerable, or missing limits C. Documentation and training D. Policy as code enforced at admission, rolled out in audit mode first, with a compliant golden path
Answer
**Correct: D** **Why:** Admission control is the enforcement point because everything reaching the cluster passes through it; a CI-only check is bypassable by anyone deploying outside the pipeline. Audit mode first prevents breaking delivery on day one, and a compliant golden path makes the right thing the easiest thing.Question 8¶
Scenario: Which best describes a golden path?
A. A set of approved tools teams may choose from B. A document describing best practices C. An opinionated, supported, documented route that is the easiest option, with escape hatches D. The only permitted way to deploy, enforced by blocking any workload that does not use the standard template
Answer
**Correct: C** **Why:** A path that forbids alternatives is a gate, not a paved road, and teams route around gates. A document is not a path because it does not make anything easier. A list of tools is not opinionated enough to reduce cognitive load.Question 9¶
Scenario: What is the central justification for platform engineering?
A. Centralizing control of production B. Reducing extraneous cognitive load so teams spend capacity on their own domain C. Standardizing tooling across the organization D. Reducing infrastructure cost
Answer
**Correct: B** **Why:** Cognitive load reduction is the stated purpose in the CNCF Platforms White Paper and in Team Topologies. Standardization, cost, and control may follow, but a platform that standardizes tooling while adding concepts developers must learn has made things worse.Question 10¶
Scenario: An organization has a recognized platform team that responds to requests through a ticket queue, with some standardization but little self-service. Which maturity level does this describe?
A. Scalable, where the platform is self-service and managed as a product B. Provisional, where work is ad hoc and depends on individual effort C. Optimizing, where decisions are driven by continuous measurement D. Operational, where a team works reactively
Answer
**Correct: D** **Why:** Provisional is ad hoc individual effort. Operational means a team exists but works reactively, typically through tickets. Scalable adds self-service and product management. Optimizing means decisions are driven by measurement. The ticket queue is the operational-level tell.Question 11¶
Scenario: Which measure best captures whether a platform is succeeding with its users?
A. Number of clusters managed B. Voluntary adoption rate and time to first deployment C. Platform team headcount D. Number of policies enforced
Answer
**Correct: B** **Why:** Voluntary adoption is the honest signal because users could choose otherwise, and time to first deployment is a direct proxy for the cognitive load the platform removed. The other three measure scale or effort, not outcome.Question 12¶
Scenario: What is the "thinnest viable platform" idea?
A. Building the least that delivers value, and buying managed services over building B. Keeping the platform team small, ideally one team of under ten people who own every capability C. Running the platform on minimal infrastructure, with the smallest cluster and node sizes that work D. Supporting only one programming language and framework, so that every team builds the same way
Answer
**Correct: A** **Why:** A wiki page and two scripts can be a legitimate first platform. Every capability is a permanent operational commitment, so capability should follow demonstrated demand. Rebuilding what a managed service already provides is a named anti-pattern.Question 13¶
Scenario: Which isolation model gives many tenants cluster-level API access without provisioning a full cluster each?
A. Virtual control plane per tenant B. Cluster per tenant C. Node pool per tenant D. Namespace per tenant
Answer
**Correct: A** **Why:** A virtual control plane gives each tenant its own API server on shared infrastructure, so tenants can create cluster-scoped objects without affecting each other. Namespaces do not offer cluster-level API access, and a cluster each is the expensive option this pattern exists to avoid.Question 14¶
Scenario: Why is the Kubernetes API a common foundation for platform APIs, even for capabilities unrelated to containers?
A. It requires no schema B. It is the fastest API server available, since it serves reads from memory and handles higher request rates than any database-backed API C. Custom resources inherit RBAC, admission control, audit logging, kubectl, GitOps, and reconciliation D. It is the only API that supports YAML, so every tool that reads YAML configuration can only talk to Kubernetes
Answer
**Correct: C** **Why:** Extending an existing, well-understood API server means every surrounding capability already works against your new type. That reuse, rather than raw performance, is why platform capabilities are typically exposed as custom resources.Question 15¶
Scenario: Which best describes how a platform should produce compliance evidence?
A. Teams submit screenshots of their dashboards and settings during an audit, collected by the platform team B. The platform generates it as a by-product: policy decisions, admission denials, and provenance C. Auditors are given read access to the clusters so that they can look at the configuration themselves D. The platform team compiles a report each quarter manually from tickets, pipeline logs, and interviews with each team
Answer
**Correct: B** **Why:** Uniform enforcement at the platform layer means evidence is produced automatically for every workload. Auditors query the platform rather than asking teams for artifacts, which is a recurring argument for platform investment and a repeated exam theme.Scoring guide¶
- 13-15 correct (85%+): Ready. 75% is the pass mark.
- 10-12 correct (65-80%): Re-read the CNCF Platforms White Paper and the Maturity Model; the exam follows their vocabulary closely.
- Below 10: Work the scenarios, watching for the product-framing pattern in each.