Exam Prep · CNPA · Mock Exam · Set 4

CNPA Mock Exam · Set 4

Sixty more multiple-choice questions, weighted question-for-question to the six domains of the official CNPA curriculum — twenty-two on Core Fundamentals, twelve on observability, security and conformance, ten on continuous delivery, seven on platform APIs and provisioning, five on IDPs and developer experience, four on measuring. About half of this paper is material you will not have met on Set 1, Set 2, Set 3 or the CNPA practice banks; the rest deliberately returns to the same core propositions in new wording. The four papers overlap on purpose, and the overlap sits where the blueprint is heaviest — Core Fundamentals is 36% of the exam, twenty-two questions per paper, eighty-eight across the set, and that topic simply does not hold eighty-eight distinct propositions. Read the four as four sittings rather than four separate question pools. A proposition you recognise from an earlier set is spaced retrieval practice and a measurement of you: answer it instantly and it has stuck; hesitate, and it never really had. This paper has a deliberately different temperament: instead of asking mostly “what is this?”, it puts you in front of a situation and asks what you would do next, or hands you a symptom and asks what is actually going on — plus a run of “which of these is not…” stems, which are the questions candidates most reliably fumble under time pressure. Answer cold, one pass, no notes; every question reveals the answer and the reasoning the moment you commit.

Where Set 4 fits

☺ Like you’re 10: Four practice papers, all built the same way. This is the one you sit last, closest to the real exam.

This site carries four CNPA papers, all weighted identically to the official blueprint and all using the same engine, so a score on one is comparable with a score on another. What differs is the kind of question. Set 1 is the recall paper: definitions, distinctions, the vocabulary you must simply have. Set 4 is the judgement paper: scenarios where several options are defensible and one is clearly better, and negative stems that punish skim-reading. Sit them in that order if you can — recall first, judgement last, as close to your real booking as you can manage.

If you have not yet worked through a domain page properly, this is the wrong paper to start with — you will score badly for the wrong reason and learn very little. Start on the CNPA hub, follow the study plan, and read how a CNPA question is built before you sit anything timed. The technique page in particular pays for itself on this paper, because Set 4 is the one where elimination beats recognition.

Sitting it under exam conditions

☺ Like you’re 10: One timer, no other tabs, no looking things up, and an answer for every single question — even the ones you are guessing.

A mock is only worth the conditions you sit it under. Look something up mid-paper and you have measured your search skills, which the real exam will not let you use: the associate-tier papers are closed-book, with no documentation tab and no second screen. So the protocol is deliberately unforgiving — and the discomfort is the product. If you finish Set 4 feeling that it was harder than Set 1, that is not the paper being unfair; it is you meeting the questions that actually separate candidates.

The protocol

1. One timer, started once — 120 minutes. You do not pause it for a phone call, a delivery or a question you want to think about later. That is the real allowance: the Linux Foundation’s Multiple Choice Exam FAQ gives multiple-choice candidates 90 minutes with the explicit exception of the CNPA, which is allowed 120. It publishes no question count, so the sixty questions here are a study convention of ours; two hours across them is two full minutes each, so drill at that pace — training at 90 minutes teaches you a rhythm a third faster than the one you will actually be given.
2. Leave the domain chips on “All 60”. Filtering by domain is a revision tool for afterwards. Filtering during the sitting turns a mixed paper into six easy little ones, because you stop having to work out which domain a question belongs to — and on the real exam, that switch of context is part of the difficulty.
3. Answer every question. Nothing published indicates that Linux Foundation multiple-choice exams deduct marks for a wrong answer — treat that as an assumption to confirm officially rather than a fact you got here — but the advice holds regardless. Eliminate the two you can argue against, pick the better of what remains, move on.
4. Commit before you read the explanation. The reveal is instant and it is generous; if you skim it before choosing, you have converted a test into a reading exercise. Choose, then read.
5. Write down every question that surprised you — including the ones you got right by luck. Right-for-the-wrong-reason is a gap that will find you again in the exam, where the wording will not match ours.
6. Do not immediately re-sit. A second pass an hour later measures short-term memory. Go and read the two weakest domain pages first, then come back and use Shuffle / reset — question order and option order are reshuffled every time, so you cannot pass by remembering that it was the third one.

The time budget

A hundred and twenty minutes across sixty questions is two minutes each, and the failure mode is always the same: three questions eat six minutes apiece, and the last ten get four minutes between them. Give yourself four checkpoints and hold them. If you are behind at a checkpoint, do not try to make it up by rushing — make it up by abandoning: pick the best of what is left on the hard question, mark it in your notes, and move.

What this paper deliberately is not

It is not a leaked or reconstructed exam — the wording is ours, not the CNCF’s, and the real questions will look and sound different. It is not calibrated to the real exam’s difficulty either, so treat your percentage as a thermometer rather than a verdict. And it is a multiple-choice paper only because the CNPA is a knowledge-based, multiple-choice exam, sitting in the associate tier alongside KCNA, KCSA and CGOA. The performance-based exams — CKA, CKAD, CKS and the CNPE — put you in a live terminal for 120 minutes and grade the resulting cluster state across 15–20 tasks, with a pass mark of 64%. No quantity of multiple choice prepares you for that; for those, the practice that counts is the lab track, the practice-task bank and a timed sitting of CNPE Mock Exam Set 1.

How the sixty questions are weighted

☺ Like you’re 10: The questions are shared out exactly the way the real test shares out its marks. The biggest topic gets the most questions.

The six published weights — 36, 20, 16, 12, 8 and 8 — sum to exactly 100%, and each domain’s share of this paper tracks its weight as closely as sixty whole questions allow. Only rounding differs, and it is worth doing the arithmetic in full: 36% of sixty is 21.6, 20% is 12.0, 16% is 9.6, 12% is 7.2, and each of the two 8% domains is 4.8. Round to the nearest whole question and Core Fundamentals goes up to 22, Continuous Delivery up to 10, Platform APIs down to 7 — but the two 8% domains tie at 4.8 apiece, and no rounding rule can separate them. So the tie is broken by hand: IDPs & DevEx takes 5 and Measuring takes 4, because 22 + 12 + 10 + 7 + 5 + 4 is exactly 60, where giving both of them 5 would be 61 and both of them 4 would be 59. The split is identical to Set 1, which is what makes the two scores comparable — and it means the shape of your result here maps onto the shape of the real exam. Core Fundamentals alone is more than a third of the paper; drop badly there and no amount of tooling detail elsewhere rescues the total.

The character of Set 4

☺ Like you’re 10: Three kinds of tricky question, over and over. Once you can name the kind, it stops being tricky.

Every question on this paper is one of three shapes, and each has a technique that beats it. Learn to spot the shape in the first three seconds and you buy yourself twenty seconds of thinking time on every question — which, across sixty of them, is the entire difference between finishing comfortably and finishing in a panic.

Best-next-action

“Adoption is 20% after a year and teams say it does not do what they need. What should you do first?” Two or three of the four options usually work in some sense; the question is which one you would do first, and why. The technique is to ask what the option actually changes: does it address the cause, or does it manage the symptom more comfortably? On this paper the winning answer is almost always the one that removes the underlying friction, and the most tempting loser is the one that makes the existing painful process faster or more formal — a rota, a review board, a better wiki page, a bigger checklist.

Diagnosis

“Green dashboards, near-zero error rate, one customer whose checkout fails every time.” You are given a symptom and asked what is happening, or where to look. The technique is to ask which of the four explanations is consistent with every detail in the stem — including the detail that seems incidental. If the stem says “nobody has touched Git and nobody ran kubectl,” an answer that requires a human to have acted is already eliminated. Stems on this paper contain no decorative facts.

“Which is NOT”

Negative stems invert the work: three options are true and you are hunting the false one, so the pleasant feeling of recognising a correct statement is now a trap. The technique is mechanical — read the stem twice, write “NOT” at the front of your mind, then test each option with “is this true?” and pick the one that answers no. Under time pressure the classic failure is answering the question you expected rather than the one printed, and it costs marks that you would otherwise have banked.

The paper — sixty questions

☺ Like you’re 10: Pick an answer. It turns green or red straight away and tells you why yours was wrong too.

Click an option to lock it in — the correct answer is marked, your mistake is marked, and the explanation appears underneath. Each explanation covers both the right answer and the most tempting wrong one, because on a judgement paper the near-miss is the thing worth understanding. The counter and bar at the top track progress and score; the chips filter by domain for revision afterwards; Shuffle / reset reshuffles the questions and the options and starts a fresh attempt. Your best score is remembered in this browser only.

Scoring yourself, honestly

☺ Like you’re 10: Write down your score for each of the six topics, not just one big number.

The counter gives you a percentage. Treat it as a thermometer, not a verdict — this paper is not calibrated to the real exam, and its wording is ours. The real bar is 75%: the Linux Foundation’s Multiple Choice Exam FAQ states that a score of 75% or above must be earned to pass a multiple-choice exam. Aim above it here, because our wording is not theirs and a mock sat comfortably is worth more than one scraped — and re-check the figure at the source before you book, since exam terms are revised over time. What travels most reliably, though, is not the number but the pattern.

One extra check that only a fourth paper can give you: compare your domain percentages with your Set 1 domain percentages. A total that has gone up while one domain has gone down is the most useful signal you will get all week, and it is invisible if you only ever record the headline number.

What to do with the wrong answers

☺ Like you’re 10: Keep a list of what you got wrong and why your answer was wrong. That list is your revision plan.

Whatever you scored, the paper has done its job only if it produces a list. Take every question you got wrong and write, in your own words, why the option you chose was wrong — not why the right one was right. That is a different sentence and a much harder one, and it is the sentence that stops you making the same mistake when the wording changes. Do the same for anything you got right but were not sure about; on a four-option paper, a guess has a 25% chance of hiding a gap from you.

The wrong-answer ledger

Keep it in a file rather than in your head. Five columns, one row per mistake, and it takes about ten minutes after a sitting:

mkdir -p ~/cnpa-revision
cat > ~/cnpa-revision/set4-wrong-answers.md <<'EOF'
# CNPA Mock Set 4 — wrong answers

| Q | Domain | What I picked | Why MY answer was wrong | Page to re-read |
|---|--------|---------------|-------------------------|-----------------|
|   |        |               |                         |                 |
EOF
open ~/cnpa-revision/set4-wrong-answers.md

After a week of papers, sort the rows by domain. If four of your nine mistakes are in one domain, you have found your afternoon. If they are spread evenly but all share a shape — every “which is NOT” question, say, or every question where you chose the option that added process — you have found something more valuable: a habit, which is cheaper to fix than a syllabus.

Verify the two or three that surprised you

The CNPA is knowledge-based, so you never touch a cluster in the exam — but a concept you have seen happen is one you will never mis-answer again. If the NetworkPolicy question or the Pending-pod question caught you out, spend twenty minutes on a throwaway kind cluster and watch them behave. This paper asks about NetworkPolicy from the L3/L4-versus-L7 angle, but the fastest way to feel what a NetworkPolicy actually is remains the classic self-inflicted outage — default-deny egress with no DNS exception — and it takes two manifests to reproduce:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-egress
  namespace: demo
spec:
  podSelector: {}
  policyTypes:
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-dns
  namespace: demo
spec:
  podSelector: {}
  policyTypes:
  - Egress
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: kube-system
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53
    - protocol: TCP
      port: 53

Apply the first alone, watch every name lookup in the namespace fail, then apply the second and watch resolution come back. Note that this only demonstrates anything on a CNI that actually enforces NetworkPolicy — the default CNI on kind and minikube historically does not, so start the cluster with Calico or Cilium if nothing happens. And a handful of one-liners cover the other diagnosis questions on this paper:

kubectl describe pod -n demo my-pod
kubectl get events -n demo --sort-by=.lastTimestamp
kubectl auth can-i create deployments --as=system:serviceaccount:ci:builder -n team-a
kubectl get hpa -n demo
kubectl get ingress -n demo -o custom-columns=NAME:.metadata.name,CLASS:.spec.ingressClassName
kubectl get pods -n demo -o jsonpath='{range .items[*]}{.status.containerStatuses[*].imageID}{"\n"}{end}'

That last one is the mutable-tag question made visible: two pods can both say myapp:1.4.2 in their spec and report two different imageID digests, which is exactly how “the same version” behaves differently in two clusters. The wider hands-on kit lives in the lab track, and the command index is on the command reference.

Where each domain is taught

☺ Like you’re 10: Every question here comes from one of six pages. Go back to the page, not to a search engine.

Nothing on this paper is examined that is not taught in the sub-course. The six domain pages are the answer key at exam depth, and the CNPA hub maps each of them to the deeper CNPE lessons on the same ground if you want more than the associate exam asks for.

Around them sits the rest of the CNPA kit: the study plan for pacing, practice questions and technique for the mechanics of a multiple-choice paper, Mock Exam Set 1 for the recall-flavoured sitting, and the shared revision tools — the flashcards, the self-check quiz, the glossary for anything a question assumed you knew, know it cold for the handful of facts that must be automatic, and the exam-prep checklist for the week before the sitting. When you want the wider map of cloud-native credentials, the certifications overview has it.

Check your answers

1. 22 / 12 / 10 / 7 / 5 / 4 — Core Fundamentals, Observability & Security, Continuous Delivery, Platform APIs, IDPs & DevEx, Measuring. Core Fundamentals (36%) and Observability, Security & Conformance (20%) are 56% between them.
2. It makes the existing painful process faster, formalised or better documented — a rota, a review step, a longer runbook — instead of removing the friction that caused it.
3. Readiness decides whether a pod appears in the Service's endpoints; liveness decides whether it is killed and restarted. Ship only a liveness probe and nothing holds traffic back from a pod that is not ready yet — and if the probe targets something slow to warm up, it restarts the pod before it ever gets there.
4. Because a URL path is an HTTP (L7) concept and NetworkPolicy operates at L3/L4 — it can allow or deny the connection, but cannot see which path travels inside it. The mesh’s authorization policy can.
5. DNS. Egress to the cluster DNS service is denied along with everything else, so every name lookup fails; the fix is an egress rule permitting UDP and TCP port 53 to kube-dns.
6. Tags are mutable pointers — the tag was re-pushed, so the two clusters pulled different digests. Pinning by digest makes the artefact identity immutable.
7. 120 minutes and 75%, both published in the Linux Foundation’s Multiple Choice Exam FAQ — which allows 90 minutes for multiple-choice exams generally and names the CNPA as the exception at 120. Price, retake policy, eligibility window and validity are the details to re-check on the official Linux Foundation CNPA page and the CNCF certification page before you register.