Practice — Observability, Security & Conformance

Sixteen single-best-answer questions on the CNPA’s second-largest domain — Platform Observability, Security, and Conformance, worth 20% of the blueprint, one mark in five. This is a retrieval drill, not a lesson: read the domain page first, then come here and answer cold. The questions are grouped into four sub-topic chips — signals and telemetry, SLOs and alerting, policy and conformance, access and supply chain — so that when you drop marks you can see which half of the domain leaked them, because this domain really behaves like two subjects wearing one name. Every question tells you why the key is right and why the tempting wrong option is wrong, the moment you commit. The technique that makes a bank pay — elimination, bucketing your misses, spacing the re-sit — lives on the practice-questions hub.

What this domain rewards

☺ Like you’re 10: This part of the test is not about remembering tool names. It is about knowing which tool answers which question, and where a rule has to sit to actually work.

Twenty percent is a lot of marks to leave on the table, and the way candidates lose them here is remarkably consistent. It is almost never because they had not heard of Prometheus or of admission webhooks. It is because the question asked them to choose — between two signals that both sound relevant, between a check in the pipeline and a check at the API server, between an indicator and the objective set on it — and choosing is a different skill from recognising.

One domain, two subjects

Read the official competency list and you can see the seam. Observability Fundamentals: Traces, Metrics, Logs, and Events is a question about evidence: what happened, where, and how do you know. Policy Engines for Platform Governance, Kubernetes Security Essentials and Security in CI/CD Pipelines are questions about control: what is allowed in, who may do it, and what proves the artefact is what it claims to be. They share a page in the curriculum because a platform needs both, but they fail differently and they reward different instincts. Observability questions punish people who cannot rank signals by usefulness. Security questions punish people who confuse an intention with an enforcement point.

The question shapes you will meet

The bank below deliberately varies its stems, because the real paper does. You will get a scenario (“a team reports X — what does that indicate?”), a comparison (“which of these two constructions is cleaner?”), a cause-and-effect (“this symptom appeared after that change”), a negative (“which of these is NOT…”), and a best-next-action (“what should they do first?”). Each shape has its own failure mode, and the negative one catches more competent people than any other item type on any exam, because it asks you to reverse polarity for a single question after twenty minutes of hunting for true statements.

How to sit this bank

☺ Like you’re 10: Set a timer, close your notes, answer every single one, and only then read the explanations.

A bank you look things up in measures your search skills. Sit this the way you will sit the paper: one uninterrupted block, no documentation, no other tabs, and a recorded decision on every question — including the ones you are guessing. Nothing published indicates that Linux Foundation multiple-choice exams deduct marks for a wrong answer, and that is an assumption to confirm in the official candidate handbook rather than a fact you got here; either way the advice is identical, because a blank scores zero with certainty and a considered guess between two survivors does not.

The protocol

1. Read the domain page first. A question bank is a retrieval tool. Used as a first exposure it teaches you the shape of these sixteen questions rather than the domain behind them.
2. Two minutes a question — so about 32 minutes on the clock for these sixteen. The CNPA’s 120 minutes is published; its question count is not, so two minutes each is what those published minutes work out to across the 60-question paper this site uses as a study convention. It is the pace to drill at either way — fast enough to finish, slow enough to eliminate properly rather than rush.
3. Leave the chips on “All 16” for the first sitting. Filtering by sub-topic is a revision tool, not an exam tool.
4. Answer, then read the explanation. If it merely confirms what you thought, move on. If it surprises you, write the topic down — that list is your revision plan, not your score.
5. Bucket every miss using the four buckets on the practice-questions hub: didn’t know, knew-but-misread, confused two neighbours, careless. The fix for each is completely different.
6. Re-sit 48 hours later, cold, with Shuffle / reset — both the question order and the options are reshuffled, so “it was the third one” will not save you.

What this bank deliberately is not

It is not a leaked or reconstructed exam, and the wording is ours. It is not a substitute for the full mock paper either: a mock reproduces the shape of the whole blueprint in one weighted sitting and is only informative while it is still unfamiliar, so spend it once, late, when you are ready to be measured. And it is not preparation for a hands-on exam. The CNPA is knowledge-based multiple choice throughout — 120 minutes with a 75% pass mark, both published, over a question count that is not; the CNPE is performance-based — 2 hours, 15–20 tasks, graded on the cluster state you leave behind, with a 64% cut score — and no quantity of multiple choice prepares you for a live terminal. For that, the lab track and the CNPE observability practice tasks are the drills that count.

The four chips, and what each one is testing

☺ Like you’re 10: The sixteen questions come in four little piles, and each pile checks a different habit.

The official competency list for this domain has five entries; the chips below regroup them into the four habits the questions actually test, because that is the grouping that tells you what to do about a bad score. Missing three in one chip is a finding. Missing one in each is noise.

Which chip to open first

All of them, in one pass, on the first sitting. On the re-sit, open whichever chip you scored worst on — and if that is a tie, open Signals & Telemetry, because it is the largest group here and because signal-selection mistakes propagate: someone who reaches for logs when they needed traces will also reach for CPU when they needed an SLI, and will build the alerting to match.

The bank — sixteen questions

☺ Like you’re 10: Click an answer. It turns green or red straight away and tells you why.

Click an option to lock it in — the correct answer is marked, your mistake is marked, and the explanation appears underneath. The counter and bar track how far through you are and how many you have right. The chips filter by sub-topic; Shuffle / reset reshuffles the questions and the options and starts a fresh attempt.

What the examiners are really testing here

☺ Like you’re 10: Almost every question is secretly one of three questions. Learn the three and the sixteen get much easier.

Nothing in this domain is examined for its own sake. Behind the sixteen items sit three recurring judgements, and if you can make those three reliably you will answer questions you have never seen before — which is the entire point, because the real paper’s wording will not match ours.

One: signal selection is a judgement, not a definition

You will rarely be asked what a trace is. You will be asked which signal answers a stated question, which is a ranking problem. Metrics are cheap, aggregatable numbers over time — they tell you that something is wrong and how it is trending, and they are the only signal you can afford to keep at high resolution for a year. Logs are discrete records with full detail — they tell you exactly what happened to one request, at a storage cost that punishes carelessness. Traces are the causal structure across process boundaries — they tell you where in a chain of services the time or the error went. Kubernetes Events are short-lived records of state changes the control plane cares about — they tell you why the platform did or did not do something, and they expire within about an hour.

Notice the bottom row of that diagram: each signal has a silent prerequisite, and a startling share of exam questions are really about the prerequisite. A trace with a missing hop is not a slow service, it is an uninstrumented one. A metric with a user ID in a label is not a monitoring problem, it is a modelling error. A log line with no structure is not a log, it is a string.

Two: enforcement point beats enforcement intent

The security half of this domain turns on one distinction: where the rule runs. A check in the pipeline is fast, kind and skippable. A check at admission is unskippable, because every write to the cluster — from a person with kubectl, from another team’s pipeline, from a controller, from a Helm install — passes through the API server. A check at runtime catches what both of those missed, but only after the thing is already running. The mature answer is nearly always “all three, at different points, for different reasons,” but when a question asks what guarantees something, it is asking for the gate that cannot be walked around.

That is also why the kind of admission policy matters. Validating policy answers yes or no. Mutating policy rewrites the object before it is stored, which is what you want when the goal is “make the right thing happen automatically” rather than “punish the team that forgot.” Here is the same platform rule expressed both ways in Kyverno — first as a validating rule that rejects, then as a mutating rule that quietly fixes:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-cost-centre
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-cost-centre
      match:
        any:
          - resources:
              kinds:
                - Deployment
                - StatefulSet
      validate:
        message: "Every workload must carry a cost-centre label."
        pattern:
          metadata:
            labels:
              cost-centre: "?*"
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: default-cost-centre
spec:
  rules:
    - name: add-cost-centre-if-missing
      match:
        any:
          - resources:
              kinds:
                - Deployment
                - StatefulSet
      mutate:
        patchStrategicMerge:
          metadata:
            labels:
              # the +() anchor adds the key only when it is absent
              +(cost-centre): unassigned

Switch validationFailureAction to Audit and the first policy stops blocking anything and merely reports — which is exactly why “a validating webhook always blocks non-compliant resources” is a distractor rather than a fact. Roll out in Audit, read the policy reports, then flip to Enforce: that sequencing is the answer to a whole family of “how would you introduce this safely?” questions. The wider treatment is in security & policy, with the governance framing in governance & compliance and the OPA Gatekeeper comparison next door.

Three: the words that decide the question

Read the lead-in twice, because in this domain a single word routinely moves the answer. Guarantees sends you to admission control rather than to CI. First sends you to mitigation rather than to root cause. Most directly sends you to the option whose repair removes the symptom. NOT reverses everything. And an option containing always, never, only or eliminates deserves two seconds of suspicion — not automatic elimination, because absolutes are sometimes simply true, but a deliberate check of the claim.

The distinctions this domain lives on

☺ Like you’re 10: Most wrong answers here are the thing standing right next to the right answer. Learn the one line that tells each pair apart.

The CNPA’s signature move is the neighbouring-concept question, and this domain is unusually rich in neighbours. Keep a table like the one below in your own notes and add a row every time a bank catches you out; by exam day it is a denser revision sheet than any list of definitions, because a discriminator encodes two ideas and the boundary between them.

Three things worth being able to write from memory

The CNPA will not ask you to type any of these — it is a closed-book multiple-choice paper, not a terminal. But being able to produce them makes the corresponding questions trivial, because you stop reasoning about the concept and start reading the answer off a picture in your head. First, the quantile query that only works because histogram buckets are counters:

histogram_quantile(
  0.99,
  sum by (le, service) (rate(http_request_duration_seconds_bucket[5m]))
)

Sum the buckets first, then take the quantile. Try that with a summary’s pre-computed quantiles and the arithmetic is meaningless — averaging two p99s does not produce a p99. Second, the two commands that answer “what can this identity actually do?”, which is the only honest way to check a least-privilege claim:

# everything the CI service account can do in its own namespace
kubectl auth can-i --list \
  --as=system:serviceaccount:payments:ci \
  -n payments

# and the question that matters: can it reach somebody else's namespace?
kubectl auth can-i delete deployments \
  --as=system:serviceaccount:payments:ci \
  -n checkout

That second command is the whole ClusterRoleBinding question in executable form: bind the rules with a RoleBinding and the answer is no; bind the identical ClusterRole with a ClusterRoleBinding and it is yes, everywhere, forever. Third, the supply-chain trio — build an inventory, attach it, and verify provenance at the point it matters:

syft registry.example.com/checkout:1.4.3 -o spdx-json > checkout.sbom.json

cosign attest \
  --predicate checkout.sbom.json \
  --type spdxjson \
  registry.example.com/checkout:1.4.3

cosign verify \
  --certificate-identity-regexp '^https://github.com/acme/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  registry.example.com/checkout:1.4.3

Signing proves origin; the SBOM answers “what is inside”; and neither enforces anything until an admission policy runs the equivalent of that verify before the pod is allowed to start. In production you would reference the image by digest rather than by tag, because a tag can be moved and a digest cannot — which is itself a favourite exam distinction. More in Sigstore & cosign, Trivy and security & policy.

Marking yourself

☺ Like you’re 10: The number at the end is a thermometer, not a verdict. What matters is which pile the wrong ones came from.

Sixteen questions is a small sample, so read the shape rather than the percentage — one unlucky miss moves this score by six points, which is noise. What is not noise is a cluster: three misses inside one chip is a real gap, and it points at a specific page rather than at “revise more.” The bands below are calibrated to this bank, not to the real exam: the CNPA’s published cut score is 75%, but its item difficulty is not something a practice bank can reproduce, so treat a band here as a revision signal rather than a prediction.

Whatever you scored, do one more thing before you close the tab: for every question you got wrong, write in your own words why the option you chose was wrong. Not why the key was right — why yours was wrong. That is the sentence that stops you making the same mistake in the exam, and it is the sentence almost nobody writes.

If you missed these, read this

☺ Like you’re 10: Every question here comes from a page on this site. Go back to the page, not to the internet.

Nothing in this bank is examined that is not taught here. Find the row that matches what you dropped, read the associate page first for exam depth, then the CNPE lesson if you want to actually be good at it rather than merely pass.

When you have closed those gaps, keep going in blueprint order: the other banks are on the practice-questions hub, the week-by-week sequencing is in the CNPA study plan, and the whole-paper rehearsal is the CNPA mock exam. The CNPA hub maps every domain to both its associate page and the deeper CNPE lessons behind it. And the shared revision kit still applies: flashcards for the vocabulary, the self-check quiz for a mixed warm-up, the glossary for any term an explanation assumed, and know it cold for the short list that has to be automatic.

Two chips of noticing, two of guarding, sixteen questions, and one standard: you have finished a question when you can say why the key is right and why all three distractors were built. Then go and open the next bank on the practice-questions hub.