CNPA Exam Questions & Answers

The defining capability of an IDP is enabling self-service so developers can independently access infrastructure and platform resources. Option D is correct because self-service resource provisioning APIs allow developers to provision resources such as namespaces, databases, or environments without relying on manual intervention from the platform team. These APIs embed governance, compliance, and organizational guardrails while giving autonomy to development teams.

Option A (manual deployment services) defeats the purpose of self-service. Option B (knowledge centers) improve documentation but do not provide automation. Option C (logging/monitoring interfaces) are observability tools, not resource provisioning mechanisms.

Self-service APIs empower developers, reduce cognitive load, and minimize bottlenecks. They also align with the platform engineering principle of ''treating the platform as a product,'' where developers are customers, and the platform offers curated golden paths to simplify consumption of infrastructure and services.

--- CNCF Platforms Whitepaper

--- CNCF Platform Engineering Maturity Model

--- Cloud Native Platform Engineering Study Guide

Lead Time for Changes is the DORA metric that best measures the efficiency and impact of platform initiatives. Option A is correct because it tracks the time from code commit to successful production deployment, directly reflecting how effectively a platform enables developers to deliver software.

Option B (MTTR) measures resilience and recovery speed, not efficiency. Option C (Change Failure Rate) measures deployment stability, while Option D (SLAs) are contractual agreements, not engineering performance metrics.

By reducing lead time, platform engineering demonstrates its ability to provide self-service, automation, and streamlined CI/CD workflows. This makes Lead Time for Changes a critical measurement of platform efficiency and developer experience improvements.

--- CNCF Platforms Whitepaper

--- Accelerate (DORA Report)

--- Cloud Native Platform Engineering Study Guide

Compliance with regulations like GDPR and PCI DSS requires fine-grained control, auditing, and data protection. Option C is correct because deploying a policy engine like Open Policy Agent (OPA) enables dynamic enforcement of policies, real-time data masking, and comprehensive audit logging. This ensures sensitive data is protected while providing traceability and compliance reporting.

Option A is insufficient, as default IAM policies without Kubernetes-level governance do not provide the granularity required for compliance. Option B (Kubernetes Secrets) adds encryption but lacks auditability and runtime enforcement. Option D (RBAC and network policies) improves security posture but does not provide comprehensive compliance coverage or data privacy features like masking and logging.

OPA and similar tools integrate with Kubernetes admission control to enforce compliance policies consistently, providing the flexibility and auditability needed in regulated industries.

--- CNCF Security TAG Best Practices

--- CNCF Platforms Whitepaper

--- Cloud Native Platform Engineering Study Guide

The fundamental difference between a traditional CI/CD model and a GitOps model lies in how changes are applied to the Kubernetes cluster---whether they are 'pushed' to the cluster by an external system or 'pulled' by an agent running inside the cluster.

CI/CD (Push Model)

In a typical CI/CD pipeline for Kubernetes, the CI/CD server (like Jenkins, GitLab CI, or GitHub Actions) is granted credentials to access the cluster. When a pipeline runs, it executes commands like kubectl apply or helm upgrade to push the new application configuration and image versions directly to the Kubernetes API server.

Actor: The CI/CD pipeline is the active agent initiating the change.

Direction: Changes flow from the CI/CD system to the cluster.

Security: Requires giving cluster credentials to an external system.

In a GitOps model, a Git repository is the single source of truth for the desired state of the application. An agent or controller (like Argo CD or Flux) runs inside the Kubernetes cluster. This controller continuously monitors the Git repository.

When it detects a difference between the desired state defined in Git and the actual state of the cluster, it pulls the changes from the repository and applies them to the cluster to bring it into the desired state. This process is called reconciliation.

Actor: The in-cluster controller is the active agent initiating the change.

Direction: The cluster pulls its desired state from the Git repository.

Security: The cluster's credentials never leave its boundary. The controller only needs read-access to the Git repository.

The best way for platform teams to support data scientists is by enabling easy access to specialized AI/ML workflows, tools, and compute resources. Option C is correct because it empowers data scientists to experiment, train, and deploy models without worrying about the complexities of infrastructure setup. This aligns with platform engineering's principle of self-service with guardrails.

Option A (integrating into standard CI/CD) may help, but AI/ML workflows often require specialized tools like MLflow, Kubeflow, or TensorFlow pipelines. Option B (strict quotas) ensures stability but does not improve usability or productivity. Option D (UI-driven execution only) restricts flexibility and reduces the ability of data scientists to adapt workflows to evolving needs.

By offering AI/ML-specific workflows as golden paths within an Internal Developer Platform (IDP), platform teams improve developer experience for data scientists, accelerate innovation, and ensure compliance and governance.

--- CNCF Platforms Whitepaper

--- CNCF Platform Engineering Maturity Model

--- Cloud Native Platform Engineering Study Guide