Free Preparation Discussions
MENU
Linux Foundation CNPA Exam Questions
- Topic 1: Platform Engineering Core Fundamentals: This section of the exam measures the skills of Supplier Management Consultants and covers essential foundations such as declarative resource management, DevOps practices, application environments, platform architecture, and the core goals of platform engineering. It also includes continuous integration fundamentals, delivery approaches, and GitOps principles.
- Topic 2: Platform Observability, Security, and Conformance: This part of the exam evaluates Procurement Specialists on key aspects of observability and security. It includes working with traces, metrics, logs, and events while ensuring secure service communication. Policy engines, Kubernetes security essentials, and protection in CI/CD pipelines are also assessed here.
- Topic 3: Continuous Delivery & Platform Engineering: This section measures the skills of Supplier Management Consultants and focuses on continuous integration pipelines, the fundamentals of the CI/CD relationship, and GitOps basics. It also includes knowledge of workflows, incident response in platform engineering, and applying GitOps for application environments.
- Topic 4: Platform APIs and Provisioning Infrastructure: This part of the exam evaluates Procurement Specialists on the use of Kubernetes reconciliation loops, APIs for self-service platforms, and infrastructure provisioning with Kubernetes. It also assesses knowledge of the Kubernetes operator pattern for integration and platform scalability.
- Topic 5: IDPs and Developer Experience: This section of the exam measures the skills of Supplier Management Consultants and focuses on improving developer experience. It covers simplified access to platform capabilities, API-driven service catalogs, developer portals for platform adoption, and the role of AI/ML in platform automation.
- Topic 6: Measuring your Platform: This part of the exam assesses Procurement Specialists on how to measure platform efficiency and team productivity. It includes knowledge of applying DORA metrics for platform initiatives and monitoring outcomes to align with organizational goals.
Free Linux Foundation CNPA Exam Actual Questions
Note: Premium Questions for CNPA were last updated On Jun. 14, 2026 (see below)
For a cloud native platform handling sensitive customer data, which approach ensures compliance with data privacy regulations like GDPR and PCI DSS within a Kubernetes environment?
Compliance with regulations like GDPR and PCI DSS requires fine-grained control, auditing, and data protection. Option C is correct because deploying a policy engine like Open Policy Agent (OPA) enables dynamic enforcement of policies, real-time data masking, and comprehensive audit logging. This ensures sensitive data is protected while providing traceability and compliance reporting.
Option A is insufficient, as default IAM policies without Kubernetes-level governance do not provide the granularity required for compliance. Option B (Kubernetes Secrets) adds encryption but lacks auditability and runtime enforcement. Option D (RBAC and network policies) improves security posture but does not provide comprehensive compliance coverage or data privacy features like masking and logging.
OPA and similar tools integrate with Kubernetes admission control to enforce compliance policies consistently, providing the flexibility and auditability needed in regulated industries.
--- CNCF Security TAG Best Practices
--- CNCF Platforms Whitepaper
--- Cloud Native Platform Engineering Study Guide
In the context of OpenTelemetry, which of the following is considered one of the supported signals of observability?
OpenTelemetry is a CNCF project providing standardized APIs and SDKs for collecting observability data. Among its supported telemetry signals are metrics, logs, and traces. Option C is correct because traces are a core OpenTelemetry signal type that captures the journey of requests across distributed systems, making them vital for detecting latency, dependencies, and bottlenecks.
Option A (user interface), Option B (networking), and Option D (databases) represent system components or domains, not observability signals. While OpenTelemetry can instrument applications in these areas, it expresses data through its standard telemetry signals.
By supporting consistent collection of logs, metrics, and traces, OpenTelemetry enables observability pipelines to integrate seamlessly with different backends while avoiding vendor lock-in. Traces specifically provide visibility into distributed microservices, which is critical in cloud native environments.
--- CNCF Observability Whitepaper
--- OpenTelemetry CNCF Project Documentation
--- Cloud Native Platform Engineering Study Guide
For a cloud native platform handling sensitive customer data, which approach ensures compliance with data privacy regulations like GDPR and PCI DSS within a Kubernetes environment?
Compliance with regulations like GDPR and PCI DSS requires fine-grained control, auditing, and data protection. Option C is correct because deploying a policy engine like Open Policy Agent (OPA) enables dynamic enforcement of policies, real-time data masking, and comprehensive audit logging. This ensures sensitive data is protected while providing traceability and compliance reporting.
Option A is insufficient, as default IAM policies without Kubernetes-level governance do not provide the granularity required for compliance. Option B (Kubernetes Secrets) adds encryption but lacks auditability and runtime enforcement. Option D (RBAC and network policies) improves security posture but does not provide comprehensive compliance coverage or data privacy features like masking and logging.
OPA and similar tools integrate with Kubernetes admission control to enforce compliance policies consistently, providing the flexibility and auditability needed in regulated industries.
--- CNCF Security TAG Best Practices
--- CNCF Platforms Whitepaper
--- Cloud Native Platform Engineering Study Guide
In the context of OpenTelemetry, which of the following is considered one of the supported signals of observability?
OpenTelemetry is a CNCF project providing standardized APIs and SDKs for collecting observability data. Among its supported telemetry signals are metrics, logs, and traces. Option C is correct because traces are a core OpenTelemetry signal type that captures the journey of requests across distributed systems, making them vital for detecting latency, dependencies, and bottlenecks.
Option A (user interface), Option B (networking), and Option D (databases) represent system components or domains, not observability signals. While OpenTelemetry can instrument applications in these areas, it expresses data through its standard telemetry signals.
By supporting consistent collection of logs, metrics, and traces, OpenTelemetry enables observability pipelines to integrate seamlessly with different backends while avoiding vendor lock-in. Traces specifically provide visibility into distributed microservices, which is critical in cloud native environments.
--- CNCF Observability Whitepaper
--- OpenTelemetry CNCF Project Documentation
--- Cloud Native Platform Engineering Study Guide
In a scenario where an Internal Developer Platform (IDP) is being used to enable developers to self-service provision products and capabilities such as Namespace-as-a-Service, which answer best describes who is responsible for resolving application-related incidents?
Platform engineering clearly separates responsibilities between platform teams and application teams. Option C is correct because platform teams manage the platform and infrastructure layer, ensuring stability, compliance, and availability, while application teams own their applications, including troubleshooting application-specific issues.
Option A (creating a single merged team) introduces inefficiency and removes specialization. Option B incorrectly suggests application teams should also solve infrastructure issues, which conflicts with platform-as-a-product principles. Option D places all responsibilities on platform teams, which creates bottlenecks and undermines application team ownership.
By splitting responsibilities, IDPs empower developers with self-service provisioning while maintaining clear boundaries. This ensures both agility and accountability: platform teams focus on enabling and securing the platform, while application teams take ownership of their code and services.
--- CNCF Platforms Whitepaper
--- Team Topologies (Platform as a Product Model)
--- Cloud Native Platform Engineering Study Guide
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Donna Jones
16 days agoMichelle King
25 days agoJeffrey Smith
1 month agoEmma Rodriguez
2 months agoAmanda Young
2 months agoChristopher Adams
2 months agoAdam Turner
2 months agoEmma Miller
1 month agoAmanda Clark
1 month agoGearldine
3 months agoMeghan
3 months agoAntione
3 months agoAdolph
3 months agoRana
3 months agoKristel
4 months agoOmer
4 months agoMarsha
4 months agoMargurite
5 months agoHeike
5 months agoKimbery
5 months agoChu
5 months agoGaynell
6 months agoElli
6 months agoCiara
6 months agoDean
6 months agoJulio
7 months agoStefany
7 months agoCarli
7 months agoLevi
7 months agoLashaunda
8 months agoIluminada
8 months agoAntione
8 months agoLucina
8 months agoFranklyn
9 months agoHoward
9 months agoLashon
9 months agoReynalda
9 months agoAmie
9 months agoBernadine
9 months agoMarla
9 months ago