Certifications · CNPA

CNPA — Cloud Native Platform Engineering Associate

The Certified Cloud Native Platform Engineering Associate (CNPA) is the CNCF and Linux Foundation’s associate-level, knowledge-based credential for platform engineering. Where the CNPE drops you onto a live cluster and says “build it,” the CNPA asks whether you understand the shape of the thing you’d be building: what a platform is, why golden paths beat ticket queues, how GitOps reconciles, what a CRD buys you, and how you’d know the platform is actually working. This page is the hub for the whole CNPA sub-course on this site — the six official domains and their weights, what the exam is like, a study plan that maps every domain to a page here and to the deeper CNPE lessons that cover the same ground, the practice banks and four full mock papers you drill with, and where to go once you pass.

What the CNPA is — and who it is for

☺ Like you’re 10: It’s a multiple-choice test that checks you understand what an internal platform is and how the pieces fit — not whether your fingers can type kubectl fast.

The CNPA is a knowledge-based certification: you answer multiple-choice questions in an online, remote-proctored session. There is no cluster, no terminal, no “fix the broken Deployment.” What it certifies is that you can hold the whole platform-engineering picture in your head — the goals, the architecture, the delivery model, the guardrails, and the measurements — well enough to be a useful member of a platform team or a fluent customer of one.

That framing matters because it changes how you study. For a performance exam you drill muscle memory; for CNPA you build a mental map. The most valuable thing you can do is be able to explain each concept in a sentence — which is precisely how every lesson on this site is written.

Who should sit it

The associate tier is deliberately broad. It suits:

• Engineers moving into platform work — backend, DevOps or SRE folk who’ve used a platform and now want to help build one. CNPA gives you the vocabulary the rest of the team already shares.
• Application developers — Dot the Duck’s people. Understanding golden paths, GitOps and self-service makes you a far better platform customer, and the cert is a clean signal on a CV.
• SREs, architects and infrastructure engineers who know Kubernetes but haven’t formalised the platform-as-a-product half of the discipline.
• Managers, product owners and consultants who need to reason credibly about platform investment, cognitive load and cost without pretending to write controllers.
• Anyone warming up for the CNPE — see the next section.

What it deliberately does not test

Two things are out of scope, and knowing that saves you weeks. First, deep tool trivia: the CNPA is about concepts and patterns, not about which flag Argo CD’s CLI takes. Second, hands-on execution: you will not be graded on cluster state. If you find yourself memorising CLI flags for the CNPA, you have drifted into CNPE preparation — which is fine, but bank it as a bonus rather than a requirement.

CNPA vs CNPE — the associate and the professional

☺ Like you’re 10: One test asks “do you understand it?”, the other asks “can you do it?” You’re allowed to take the hard one first — but the easy one makes the hard one easier.

The CNCF publishes these two as a pair. The CNPA is the associate, knowledge-based entry point. The CNPE — Certified Cloud Native Platform Engineer — is the professional, performance-based credential where you solve real tasks on live clusters against a strict, proctored clock. They cover overlapping ground at very different depths.

Why CNPA is the sensible first step anyway

Be clear on the formal position: the CNPE has no prerequisite. You may register for it today without holding CNPA, CKA, or anything else. As published, the Linux Foundation lists no prior certification, course or experience requirement for either exam — but prerequisites are exactly the sort of thing that gets revised, so confirm on the official page before you plan around it.

And yet the CNPA is still the right first move for most people, for three practical reasons. One: the concepts are shared. Reconciliation, golden paths, admission control, DORA — the CNPE assumes you already understand all of it and simply tests whether you can wire it up. Studying CNPA is studying the conceptual half of CNPE. Two: it is a much cheaper, lower-stakes way to find out where your gaps are; a wrong answer costs you nothing but a revision note, whereas discovering the gap part-way through a timed, hands-on exam costs you the exam. Three: it produces a credential early. Platform careers are long; a badge you can earn in a few weeks while you build the reps for CNPE keeps momentum up.

The six domains & their weights

☺ Like you’re 10: The test doesn’t spread itself evenly. More than a third of it is the basics — so the basics are where you spend your time.

The official CNPA Exam Curriculum, published by the CNCF, splits the exam into six weighted domains covering 27 competencies in total. The bars below are that blueprint, drawn to scale. Each links to its dedicated page in this sub-course:

Where the weight really sits

Read those bars carefully, because the shape of this exam is unusual. Core Fundamentals alone is 36% — more than a third of your score comes from one domain, and it is the conceptual one: goals and approaches, platform architecture and capabilities, declarative resource management, DevOps practices, application environments, and the fundamentals of CI and of continuous delivery/GitOps. Add the 20% observability-and-security domain and you are at 56% from two domains.

Meanwhile the three smallest domains — APIs and provisioning (12%), IDPs and developer experience (8%), and measuring (8%) — total 28%, better than a quarter, and they are the ones candidates most often under-read because they feel “soft.” They aren’t: service catalogs, developer portals, platform efficiency and DORA metrics are all crisply testable. A tidy afternoon on each is the highest return-per-hour on the whole blueprint.

Every competency, domain by domain

Here is the full curriculum — all six domains and all 27 competencies, exactly as the CNCF publishes them, with the page in this sub-course that covers each domain:

Two observations worth carrying into your revision. First, GitOps appears in two domains — as “Continuous Delivery and GitOps” inside Core Fundamentals, and again as “GitOps Basics and Workflows” plus “GitOps for Application Environments” in the delivery domain. It is, by some distance, the single most-repeated idea in the blueprint. Second, the curriculum explicitly names AI/ML in Platform Automation — a topic older cloud-native syllabi skip entirely, so don’t let it ambush you.

Exam logistics — and how to verify them

☺ Like you’re 10: It’s an online multiple-choice test you take from home with someone watching through your webcam. The exact price and length can change, so always check the official page before paying.

Some things about the CNPA are structural and safe to state; others are the sort of detail the Linux Foundation revises without ceremony. This page separates the two on purpose.

What we can state with confidence

The blueprint row below is taken verbatim from the official CNPA Exam Curriculum PDF published by the CNCF. The rest reflects how the CNCF positions the credential and how the Linux Foundation runs its associate-level exams generally — structural facts rather than numbers, and still worth confirming at source:

What you must check on the official page

Two of these numbers are published, and you should plan against them. The Linux Foundation’s Multiple Choice Exam FAQ allows multiple-choice candidates 90 minutes with the CNPA as its one named exception — CNPA candidates get 120 minutes — and states that a score of 75% or above must be earned to pass. Those are the figures to drill against. Note the trap in the general pattern: if you assume the associate-tier 90 minutes, you train yourself at ninety seconds a question when the real rhythm is a full two minutes.

The rest genuinely does move and is not published for the CNPA: question count, price, retake policy, eligibility window and certification validity. Sibling associate exams cluster around US$250 with one free retake, a 12-month window and two-year validity — but that is a pattern, not a promise, and none of it is quoted here from an official CNPA page. Re-check duration and pass mark before you book too; these terms do change. Do not budget or schedule against numbers from any third-party site, including this one.

One structural point is safe to plan around, and it is a difference in kind rather than degree: the associate-tier exams are closed-book, with no documentation allowed. The performance-based exams — CKA, CKAD, CKS and the CNPE — let you consult the official Kubernetes documentation while you work, because they grade what you build. A multiple-choice associate paper does not, because it grades what you know. Revise accordingly: there is no tab to fall back on.

↗ Official CNPA page — Linux Foundation ◆ CNCF certification page ◆ Official CNCF curriculum repository

A study plan — every domain mapped twice

☺ Like you’re 10: For each part of the test there’s a short page here that covers exactly what’s examined, and a longer page that explains it properly. Read the short one to pass; read the long one to actually be good.

This site was built for the CNPE, which means the CNPA is unusually well served by it: every CNPA domain has a matching CNPA page and a set of deeper CNPE lessons that go well past what the associate exam asks. Use the middle column to pass and the right column to understand. If you’re short on time, the middle column alone is a complete plan. The summary below is the shape of it; the dedicated CNPA study plan turns the same weights into an hours budget, a day-by-day final week, and readiness gates that tell you whether to book the exam.

A four-week pace

Four weeks is comfortable for someone with working Kubernetes exposure; stretch it to six if platform engineering is new to you. The weights decide the pacing — Core Fundamentals gets a whole week to itself because it is more than a third of the exam.

How this sub-course is laid out

☺ Like you’re 10: One page per part of the test, then a plan telling you when to read what, then small piles of practice questions, then four full practice tests. Work through it in that order and you’ve covered the whole syllabus.

The sub-course has four layers. Six teaching pages, one per official domain — same names, same weights, same competency lists as the curriculum, so nothing gets lost in translation. A study plan that turns the weights into a four-week schedule with readiness gates. Four practice banks, sized roughly in proportion to the blueprint, for retrieval drilling one domain at a time. And four full mock papers of sixty questions each — Set 1 leans on recall, Set 2 on scenarios, Set 3 on the pairs candidates confuse, Set 4 on “what would you do next?”. Read, plan, drill, then sit. In that order.

Plan it, then drill it

The six domain pages tell you what to know. These tell you when to read them, and whether it stuck.

The four mock papers

Sixty questions each, all four on the same 22 · 12 · 10 · 7 · 5 · 4 domain split, so the scores are directly comparable. Sit Set 1 cold once you have read the domain pages, then space the rest a week or more apart — and keep the ones you have not sat genuinely sealed, because a paper you have skimmed can no longer measure you.

The closed-book reference kit

Four more pages built specifically for a knowledge-based, closed-book paper — there is no cluster, no terminal, and, unlike CNPE, no documentation tab to fall back on at all:

Around them, the site’s shared revision kit still applies: the how-to-study guide, the Kubernetes baseline, the exam-day and proctoring page, the searchable glossary, flashcards, the self-check quiz, the exam-prep checklist, and — when you want the wider map of cloud-native credentials — the certifications overview.

After you pass

☺ Like you’re 10: The badge is a checkpoint, not a finish line. Next you either prove you can build it, or you go wide.

A pass means you can hold the platform picture in your head. Three sensible next moves, roughly in order of how most people take them.

Go deep — the CNPE

The obvious sequel. You already own the conceptual half of the CNPE blueprint; what remains is speed and hands. Move straight into the hands-on lab track, then the practice task bank and a timed mock exam. The mapping is direct: CNPA’s Core Fundamentals and delivery domains become CNPE’s GitOps and CI/CD domains; CNPA’s APIs domain becomes CRDs & operators and self-service; CNPA’s observability-and-security domain splits into CNPE’s observability and security & policy. Same territory, higher gear.

Go wide — the rest of the shelf

If you’d rather broaden than deepen, the certifications overview maps the full cloud-native ladder — the Kubernetes line (KCNA → CKA/CKAD → CKS), the security and GitOps associates (KCSA, CGOA), and the project-specific credentials. The natural companions to CNPA are the Kubernetes administrator track, because platform engineering sits on top of it, and the GitOps associate, because GitOps is the single most-repeated idea in the CNPA blueprint.

Go build — the part that actually compounds

Certifications are a signal; a platform is a skill. The fastest way to make CNPA knowledge permanent is to build a small, real thing: a config repo reconciled by Argo CD or Flux, one custom resource that provisions something a teammate wants, a dashboard with an SLO on it, and a policy that stops one bad habit. That’s a golden path in miniature — and it will teach you more in a fortnight than any answer key. The lab track walks you through exactly that, and the case studies show what it looks like at scale.

Whichever you choose, don’t let the map go stale: re-read the reference architecture every few months, and keep an eye on the official curriculum, which the CNCF updates as the discipline moves.

Check your answers

1. CNPA is knowledge-based — online, remote-proctored, multiple-choice. The CNPE is performance-based: you solve real tasks on live clusters and are graded on the resulting state.
2. No. The CNPE has no formal prerequisite — CNPA is a sensible precursor, not a gate.
3. Platform Engineering Core Fundamentals 36%; Platform Observability, Security, and Conformance 20%; Continuous Delivery & Platform Engineering 16%; Platform APIs and Provisioning Infrastructure 12%; IDPs and Developer Experience 8%; Measuring your Platform 8%.
4. Core Fundamentals (36%) and Observability, Security & Conformance (20%) — 56% between them.
5. GitOps / reconciliation. It appears as “Continuous Delivery and GitOps” in Core Fundamentals, as “GitOps Basics and Workflows” and “GitOps for Application Environments” in the delivery domain, and as the “Kubernetes Reconciliation Loop” in the APIs domain — so one idea, understood properly, pays out across three weighted domains.
6. Duration, question count, pass mark, price, retake policy, eligibility window and validity. Confirm all of them on the official Linux Foundation CNPA page and the CNCF certification page before you register — they change, and they are the only authority.