CNPA Exam: I Scored 88, and Some of My Prep Was Wasted

I wrote the longer version, with my full study order and notes on the white paper sections, on my blog.

The CNPA exam barely cares how well you can configure any single platform tool. Most people prepare as if it did, and I did a softer version of that myself. I passed the Certified Cloud Native Platform Engineering Associate with 88 on the first attempt (passing is 75), but a few of my 15 prep hours went into things the exam never asked about.

What CNPA covers

KCNA is broad Kubernetes ecosystem theory. CNPA covers the discipline of platform engineering on top of Kubernetes: organizational patterns, the developer experience layer, and how you measure a platform.

Multiple choice, online proctored, 120 minutes, around 85 questions.

Core Fundamentals is more than a third of the exam, and it's conceptual. No YAML. The two smallest domains are the easiest 16% you'll get, and Measuring your Platform is almost entirely DORA metrics.

Read the white paper, not a summary of it

The CNCF Platforms White Paper is where the exam draws from: "platform as a product", stream-aligned vs platform teams, developers as customers. I read it twice with notes, and I think it covered roughly 30% of my questions.

Golden paths kept coming up: opinionated, optional routes to production. So did Kubernetes extension points as the way platforms get built: custom resources, operators and admission controllers. And the four OpenGitOps principles, declarative, versioned, pulled, reconciled, which apply whether you run Argo CD or Flux.

Observability and security

Vocabulary depth is enough here: the three OpenTelemetry signal types and where the Collector fits, the conceptual difference between Kyverno and OPA Gatekeeper, and supply chain terms like image signing, SBOMs and policy gates in CI.

Crossplane: I over-prepared

I spent more time on Crossplane than I needed to. The questions were about the concept, not writing YAML from scratch, and most of them come down to who owns which layer:

• The XRD is the API definition the platform team publishes.
• The Composition is the implementation the platform team maintains.
• The Claim is what the developer requests.

GitOps: pull, not push

GitOps means pull-based sync, and a CI pipeline pushes. Scenario questions ask whether a setup is GitOps compliant, and that distinction decides it.

For Argo CD, know what selfHeal and prune do (revert manual cluster changes, and remove resources no longer in Git) and what drift detection means. RBAC and SSO setup weren't tested.

DORA metrics

The four DORA metrics:

• Deployment frequency: how often you ship.
• Lead time for changes: commit to production.
• Change failure rate: percentage of deployments causing incidents.
• Mean time to restore: how long recovery takes.

Watch for Mean Time to Detect. It is not a DORA metric, and it can show up next to Mean Time to Restore as options on the same question. I think that distinction alone is worth about two exam points.

Platform vs portal

An Internal Developer Platform is the set of self-service capabilities that reduce cognitive load and hide infrastructure behind golden paths. An Internal Developer Portal, like Backstage, is the UI on top. The exam tests whether you can tell them apart. None of my questions were about Backstage plugin configuration.

What I'd study, in order

About 15 hours over two weeks of evenings:

1. DORA metrics. 20 minutes, and I got every DORA question right.
2. The white paper, twice, with notes. It maps almost directly to Core Fundamentals.
3. Around 3 hours running Argo CD and Crossplane in my home cluster (not a production setup) to watch the sync loop and see what a Claim creates. Worth more than 10 hours of reading.
4. OTel signals, Kyverno vs Gatekeeper and supply chain terms, at vocabulary depth.
5. Practice questions to find weak domains before exam day.

For step 5 I built a free CNPA practice test from the scenarios I calibrated with, DORA traps and GitOps pull vs push included. There are practice tests for the other CNCF exams too.

I wasted time on Backstage, since the exam barely touches implementation, and on Tekton, while the CD domain tested GitOps principles instead.

For a book, Platform Engineering on Kubernetes by Mauricio Salatino covers the same ground from the practitioner side. My full resource list, including the white paper sections that matter most, is in awesome-kubestronaut.

The framing that helped most

CNPA keeps asking whose problem something solves, the platform team's or the developer's. Compositions belong to the platform team, Claims are the developer's interface. GitOps automation is a platform team tool, DORA metrics measure the outcome for developers. Ask that question and the right answer usually becomes obvious.

Usually. CNPA was one of the 15 certs on my Golden Kubestronaut path, and I'm not sure this framing holds for every question. I didn't get 100.

Originally published on yetmike.com.