The Certified Cloud Native Platform Engineering Associate (CNPA) exam, offered by the Linux Foundation as part of the Cloud & Containers Certifications program, validates your ability to design, build, and operate cloud native platforms. This credential is intended for platform engineers, DevOps professionals, and infrastructure specialists who work with containerized environments and modern deployment practices. This page provides a clear roadmap of exam topics, question formats, and practical preparation strategies to help you study effectively and build confidence before test day.
Use this topic map to guide your study for Linux Foundation CNPA (Certified Cloud Native Platform Engineering Associate) within the Cloud & Containers Certifications path.
The CNPA exam combines multiple choice and scenario-based questions to assess both foundational knowledge and practical decision-making in real world platform engineering contexts.
Questions progress in difficulty and emphasize practical application; you will need to connect concepts across observability, security, delivery, and developer experience to answer correctly.
Structure your study around the six core topics, allocating time proportionally to your experience level and weak areas. A typical preparation timeline spans 4-8 weeks, combining focused reading, hands-on labs, and practice questions.
Explore other Linux Foundation certifications: view all Linux Foundation exams.
Strengthen your preparation with up-to-date resources from validexamdumps.com. These materials align to CNPA and cover practical scenarios with clear explanations.
Visit the exam page to download the PDF, Online Practice Test, or get a bundle discount for both formats: Certified Cloud Native Platform Engineering Associate.
Platform Engineering Core Fundamentals and Continuous Delivery & Platform Engineering typically account for a larger share of questions because they form the foundation of platform design and operations. However, all six topics are tested, and scenario questions often blend multiple domains, so balanced preparation across all areas is essential.
In practice, these topics form an integrated cycle: Core Fundamentals define your platform architecture; APIs and Provisioning enable self-service; IDPs and Developer Experience make the platform accessible; Observability, Security, and Conformance ensure reliability and compliance; Continuous Delivery automates deployments; and Measuring your Platform drives continuous improvement. Understanding these connections helps you answer scenario questions that span multiple domains.
While the exam tests conceptual knowledge, hands-on experience with container orchestration, infrastructure automation, and CI/CD tools strengthens your ability to reason through scenarios. Prioritize labs that let you build a simple platform, implement observability, configure security policies, and design developer self-service workflows; these map directly to exam content.
Candidates often miss questions by overlooking trade-offs in scenario questions, confusing similar architectural patterns, or forgetting that developer experience and platform metrics are as important as technical infrastructure. Read scenario questions carefully, consider all constraints, and remember that the best answer balances functionality, security, observability, and usability.
In the final week, take a full-length timed practice test to identify remaining weak spots; spend 2-3 days drilling those topics with focused Q&A sets; then do a lighter review of all six domains to refresh key terminology and concepts. Avoid cramming new material; instead, consolidate what you already know and build confidence in your reasoning.
In the context of platform engineering and the effective delivery of platform software, which of the following statements describes the role of CI/CD pipelines in relation to Software Bill of Materials (SBOM) and security scanning?
Modern platform engineering requires security and compliance to be integral parts of the delivery process, not afterthoughts. CI/CD pipelines are the foundation for delivering platform software rapidly and reliably, and integrating SBOM generation and automated vulnerability scanning directly within pipelines ensures that risks are identified early in the lifecycle.
Option B is correct because it reflects recommended practices from cloud native platform engineering standards: SBOMs provide a transparent inventory of all software components, including dependencies, which is crucial for vulnerability management, license compliance, and supply chain security. By automating these steps in CI/CD, teams can maintain both velocity and security without manual overhead.
Option A downplays the relevance of SBOMs for platform software, which is inaccurate because platform components (like Kubernetes operators, ingress controllers, or logging agents) are equally susceptible to vulnerabilities. Option C dismisses automation in favor of periodic audits, which contradicts the shift-left security principle. Option D misunderstands CI/CD's purpose: security must be integrated, not separated.
--- CNCF Supply Chain Security Whitepaper
--- CNCF Platforms Whitepaper
--- Cloud Native Platform Engineering Study Guide
A platform team wants to let developers provision cloud services like S3 buckets and databases using Kubernetes-native APIs, without exposing cloud-specific details. Which tool is best suited for this?
Crossplane is the CNCF project designed to extend Kubernetes with the ability to provision and manage cloud resources via Kubernetes-native APIs. Option B is correct because Crossplane lets developers use familiar Kubernetes manifests to request resources like S3 buckets, databases, or VPCs while abstracting provider-specific implementation details. Platform teams can define compositions and abstractions, providing developers with golden paths that include organizational guardrails.
Option A (Cluster API) is focused on provisioning Kubernetes clusters themselves, not cloud services. Option C (Helm) manages Kubernetes application deployments but does not provision external infrastructure. Option D (OpenTofu) is a Terraform fork that provides IaC but is not Kubernetes-native.
By leveraging Crossplane, platform teams achieve infrastructure as data and full GitOps integration, empowering developers to provision services declaratively while ensuring governance and compliance.
--- CNCF Crossplane Project Documentation
--- CNCF Platforms Whitepaper
--- Cloud Native Platform Engineering Study Guide
As a Cloud Native Platform Associate, you need to implement an observability strategy for your Kubernetes clusters. Which of the following tools is most commonly used for collecting and monitoring metrics in cloud native environments?
Prometheus is the de facto standard for collecting and monitoring metrics in Kubernetes and other cloud native environments. Option D is correct because Prometheus is a CNCF graduated project designed for multi-dimensional data collection, time-series storage, and powerful querying using PromQL. It integrates seamlessly with Kubernetes, automatically discovering targets such as Pods and Services through service discovery.
Option A (Grafana) is widely used for visualization but relies on Prometheus or other data sources to collect metrics. Option B (ELK Stack) is better suited for log aggregation rather than real-time metrics. Option C (OpenTelemetry) provides standardized instrumentation but is focused on generating and exporting metrics, logs, and traces rather than storage, querying, and alerting.
Prometheus plays a central role in platform observability strategies, often paired with Alertmanager for notifications and Grafana for dashboards. Together, they enable proactive monitoring, SLO/SLI measurement, and incident detection, making Prometheus indispensable in cloud native platform engineering.
--- CNCF Observability Whitepaper
--- Prometheus CNCF Project Documentation
--- Cloud Native Platform Engineering Study Guide
What is the main benefit of using minimal base container images and SBOM attestation practices in CI/CD pipelines?
The use of minimal base container images and Software Bill of Materials (SBOM) attestation is a best practice for strengthening software supply chain security. Option B is correct because smaller base images contain fewer components, which inherently reduces the attack surface and the number of potential vulnerabilities. SBOMs, meanwhile, provide a detailed inventory of included libraries and dependencies, enabling vulnerability scanning, license compliance, and traceability.
Option A is only a partial benefit, not the primary goal. Option C (maximum flexibility) contradicts the principle of minimal images, which deliberately restrict included software. Option D (reducing storage costs) may be a side effect but is not the core benefit in a security-focused context.
By combining minimal images with SBOM practices, platform teams ensure stronger compliance with supply chain security frameworks, enable early detection of vulnerabilities in CI/CD pipelines, and support fast remediation. This is emphasized in CNCF security and platform engineering guidance as a way to align with zero-trust principles.
--- CNCF Supply Chain Security Whitepaper
--- CNCF Platforms Whitepaper
--- Cloud Native Platform Engineering Study Guide
A platform team is implementing an API-driven approach to enable development teams to consume platform capabilities more effectively. Which of the following examples best illustrates this approach?
An API-driven approach in platform engineering enables developers to interact with the platform programmatically through self-service capabilities. Option C is correct because giving developers the ability to request and manage environments on demand via APIs or internal tooling exemplifies the API-first model. This approach abstracts infrastructure complexity, reduces manual intervention, and ensures automation and repeatability---all key goals of platform engineering.
Option A is a traditional request/response workflow but does not empower developers with real-time, self-service capabilities. Option B provides visibility but does not expose APIs for consumption or management. Option D focuses on automating platform updates rather than enabling developer interaction with platform services.
By exposing APIs for services such as provisioning environments, databases, or networking, the platform team empowers developers to operate independently while maintaining governance and consistency. This improves developer experience and accelerates delivery, aligning with internal developer platform (IDP) practices.
--- CNCF Platforms Whitepaper
--- CNCF Platform Engineering Maturity Model
--- Cloud Native Platform Engineering Study Guide
