Exam Prep · Mock Exam · Set 1

Mock Exam · Set 1 — assembled from the banks

This is your first full sitting: eighteen tasks, one unbroken 120-minute block, a hundred points, and a 64% bar. What makes it different from the two hours you have already spent in the practice banks is not the tasks — every one of them is drawn from those banks, and you may well recognise several. It is the shape: the domains are shuffled so consecutive tasks throw you between Argo CD and PromQL and Kyverno, the clock never pauses, and nobody tells you which tasks are cheap. This page holds no task text of its own; it is a sitting sheet that points at the real thing. Recognising a task is not cheating here, because Set 1 is not testing whether you know the answers. It is testing whether you can pace, triage and bank points when eighteen of them arrive at once. Keep Set 2 — which is all-new and sealed — for the dress rehearsal a week before your real exam.

☺ Explain it like I’m 10

You have been practising songs one at a time, over and over, until each one sounds great on its own. Today you play a whole concert: eighteen songs back to back, in an order somebody else chose, with no stopping to retune between them. You already know every song — that is not the hard part. The hard part is that song four goes badly, and you have to leave it half-finished and start song five anyway, because the audience is not going to wait. That is what a concert teaches you that practice never can.

🐢🦫Your hosts for this topic: Timmy the Turtle & Benny the Beaver — Timmy holds the stopwatch and refuses to stop it for anything, and Benny insists that nothing scores until the done-when check in the bank actually passes on a real cluster.

How Set 1 differs from Set 2

☺ Like you’re 10: Set 1 is a concert of songs you already know. Set 2 is a concert of songs you have never played. You want both, but in that order.

Sets 1 and 2 do genuinely different jobs — the first two of six papers — and using them in the wrong order wastes one of them. Set 1 is assembled. Every task below already exists in one of the five practice banks; this page selects eighteen of them, weights them to the blueprint, puts them in an interleaved order, and adds the timing, protocol and scoring that a bank page deliberately leaves out. You may have drilled six of these last week. That is fine — expected, even. The thing being measured is not recall but throughput.

Set 2 is sealed. Its eighteen tasks appear nowhere else on this site, so it is your last genuinely cold measurement — the most tightly protected of the six sets, saved for the dress rehearsal right before the exam. Spend it early and you have no clean read on your readiness left. The sequence that works:

StageWhat you doWhat it tells you
1 · DrillWork the five banks untimed, one domain at a time, until the done-when checks pass.Whether you know the material. Nothing about speed.
2 · Sit Set 1This page. 120 minutes, no pausing, exam conditions.Your pacing and triage, with knowledge deliberately held constant.
3 · Fix gapsRe-drill only the domains where you dropped points, plus what to know cold for anything you had to look up.Converts a diagnosis into practice.
4 · Sit Set 2Mock Exam Set 2, roughly a week before the real thing.Your readiness, cold, on tasks you have never seen.
◆ Key idea

Because you have seen these tasks, a low score on Set 1 is unusually informative: it cannot be a knowledge problem, so it is a pacing problem, and pacing is the cheapest thing on the whole study plan to fix. A high score, conversely, proves less than it feels like it does — that is what Set 2 is for.

Pre-flight — build the cluster the night before

☺ Like you’re 10: Set up all your tools the day before, so that when the clock starts you are already holding the screwdriver.

A throwaway kind or minikube cluster is enough, with one prerequisite worth checking the night before: task #5 is a NetworkPolicy task, and the default CNI on both kind and minikube has historically not enforced NetworkPolicy — verify yours does, or start the cluster with a policy-capable CNI such as Calico or Cilium, otherwise the highest-value task on the paper cannot be verified. Install everything else the paper touches — Argo CD, Argo Rollouts, Flux, Tekton Pipelines, the kube-prometheus-stack, whichever custom-metrics source the A2 task expects (typically prometheus-adapter or KEDA), Crossplane, Istio and Kyverno — and confirm it is all healthy before the timer starts. If something turns out to be missing mid-sitting, skip the task and move on; never stop the clock to install things, because the real exam will not let you either.

# --- the night before -------------------------------------------------
kind create cluster --name cnpe-mock1
kubectl get nodes                       # Ready before you go to bed

# --- ninety seconds before the clock starts ---------------------------
kubectl config use-context kind-cnpe-mock1
kubectl config set-context --current --namespace=default
kubectl config view --minify -o jsonpath='{..namespace}{"\n"}'   # say it out loud

alias k=kubectl
export do="--dry-run=client -o yaml"    # k run x --image=nginx $do > pod.yaml
export now="--grace-period=0 --force"

# sanity sweep: anything not Running here is a task you will skip, not fix
kubectl get pods -A | grep -vE 'Running|Completed'
⚠ The context/namespace ritual is worth real points

A great many self-inflicted zeros in a performance exam are not wrong YAML — they are correct YAML applied to the wrong namespace. Every task on this paper names its namespace; set it with kubectl config set-context --current --namespace=<ns> as the first action of each task, and re-read the echo. Two seconds each, thirty-six seconds total, and it removes an entire class of failure. The same discipline is drilled in the speed reference.

Exam conditions

☺ Like you’re 10: A practice match only helps if you play it by the real rules — same clock, same referee, no help from the bench.

One timer, started once. 120 minutes. You do not pause it for coffee, for a CRD that will not become Established, for a phone call, or for a laptop that decides to update itself. If you lose eight minutes to your own machine, that is data rather than an excuse: the real exam eats time in ways nobody plans for. Sit it at roughly the hour your real exam is booked, because your 9 a.m. brain and your 9 p.m. brain are different candidates.

Nothing open except the allowlist. This is narrower than most candidates believe, and it is the single condition people quietly break. Permitted: kubernetes.io/docs, kubernetes.io/blog, any task-specific documentation the exam links from its own Quick Reference box, and the local documentation on the exam desktopman pages and whatever ships under /usr/share. That is the entire list. Not this site. Not your notes. Not a search engine. Not an AI assistant. Close the bank tabs before you start — the tasks are linked below and you will be tempted.

⚠ These project docs are not available — and specifics change

The documentation for Argo CD, Flux, Tekton, Crossplane, Backstage, Prometheus, OpenTelemetry, Kyverno, Gatekeeper, Istio, Linkerd and Helm is not on the allowlist. For those tools the resource shapes must be in your head, or reachable from the cluster itself: kubectl explain <kind> --recursive, kubectl api-resources and kubectl get <kind> <existing> -o yaml are the live API rather than documentation, and they are your real reference. Work the docs map until finding a page on kubernetes.io is muscle memory. Separately: exam specifics move. Task counts, the 120-minute duration, the 64% pass mark, the domain weights, the permitted-resource list and the Kubernetes version on the desktop have all changed before and will change again. Everything on this page is a study aid written at a point in time — the official CNCF certification pages and Linux Foundation training site are the only authority. Confirm before you book.

No peeking at solutions during the sitting. Each bank task has its worked solution folded behind a summary. Opening one mid-exam converts a diagnostic into a reading exercise: you feel productive, learn nothing about your pacing, and will fail the same task on exam day. Spend the budget, take the zero, read the solution afterwards.

Read the whole paper first. Five minutes spent scanning all eighteen briefs is the highest-return five minutes of the sitting. You will spot the three you can close in four minutes and the one that is going to eat twelve. Bank the cheap points first — sequential order is a trap in a weighted, partial-credit exam.

Your time budget

☺ Like you’re 10: Give every question a small share of the two hours. When a question runs over its share, put a sticky note on it and go to the next one.

Eighteen tasks in 120 minutes averages a little under seven minutes each — six, once you carve out reading and verification — but the tasks are not equal and the budget should not be either. Allocate 5 minutes to read, 108 minutes of task work, and 7 minutes at the end to re-run your done-when checks. That last block earns more points per minute than anything else on the paper, because half-finished work you never verified is where points quietly die.

BlockTasks on the paperBudgetRunning totalNote
Read every brief5 min5Mark each task cheap / medium / expensive before you touch a terminal.
First third#1–#66+6+7+5+7+6 = 37 min42Task #5 is the 8-pointer. Do not let it run long because it is worth the most.
Second third#7–#126+5+6+7+6+6 = 36 min78#8 is the only five-minute task in this block — bank it fast, then give #10 its full seven.
Final third#13–#185+6+6+6+6+6 = 35 min113The tail holds 33 points. Candidates who never reach it are the ones who fail.
Verify & sweep flags7 min120Re-run every done-when. Finish the nearly-done before starting anything new.

The flag-and-move rule. When a task passes roughly six minutes without a passing done-when check, stop. Write one line about where you stalled, leave whatever you applied in place — partial credit is real — and go to the next task. The instinct to finish what you started is the most expensive habit in a timed performance exam: it trades a guaranteed five points elsewhere for a possible five points here. Timmy’s version: you are not paid to finish tasks, you are paid to bank points.

120 minutes · 18 tasks · 100 points GitOps 30 min · 5 tasks · 25 pts Platform APIs 30 min · 5 tasks · 25 pts Observability 20 min · 3 · 20 pts Arch 15 · 3 · 15 Sec 13 · 2 · 15 read 5m verify 7m …but on the paper those blocks are shuffled, not grouped Every neighbour is a different domain — that context switch is the skill Set 1 trains. Flag-and-move rule Any task past ~6 minutes with no passing done-when check: note where you stalled, leave the partial work, move on.

The paper — 18 tasks in exam order

☺ Like you’re 10: Here is the list of eighteen jobs, in the order you should meet them. Each one is a link — click it, read the job, do the job, come back.

Each row links straight to the task in its bank. Read the brief and the done when check there, work it on your cluster, and come back for the next row. Do not open the folded solution until the sitting is over. Points are the blueprint weights divided across the tasks; budgets are the flag-and-move thresholds from the table above.

The order is deliberately mixed. No two neighbouring tasks share a domain. That is not decoration — the real exam gives you no guarantee that neighbouring tasks share a domain, so you may well finish a Crossplane composition and land immediately on a PromQL query. The cost is real: every switch means a new namespace, a new mental model and a new set of field names, and candidates who only ever drilled one domain per sitting lose thirty seconds to disorientation seventeen times over. Training that switch is half the point of this paper.

Tasks 1–9 — the first hour

Tasks 10–18 — the second hour

🦆 Dot’s-eye view

“I sat this and my first reaction was that it felt unfair — I had just got into the rhythm of Argo CD and suddenly I was writing a PromQL histogram quantile. Then I realised that is exactly my Tuesday. Nobody at work lets me do five GitOps tickets in a row either. The paper is not being awkward; my practice was being unrealistically tidy.”

🦫 Benny’s workshop · 12 min

Before you sit the whole thing, do a dry run of the protocol only. Set a 12-minute timer and work tasks #4 and #8 back to back — Architecture, then Architecture again after a forced two-minute detour into an unrelated namespace. Notice how long it takes you to re-orient: to remember which namespace you were in, which file you were editing, what the done-when check was. That re-orientation cost, multiplied by seventeen switches, is the hidden tax this paper is teaching you to pay down. Write your number on a sticky note; try to halve it by the time you sit Set 2.

Score yourself

☺ Like you’re 10: Add up your points, turn it into a percentage, then look at which questions you lost — that second part is the useful part.

Mark after a break. Marking your own work while still adrenalised produces generous nonsense. Award full points only when the done-when check in the bank actually passed on your cluster, half when the resource exists and is broadly right but the check did not pass, and zero when you did not attempt it. There is no credit for “I knew how to do that one” — especially not on Set 1, where you probably did.

#DomainPointsYour score
1 · G1 self-heal against driftGitOps & CD5
2 · P1 CRD with schema and statusPlatform APIs5
3 · O1 scrape and fire an alertObservability7
4 · A1 ResourceQuota and LimitRangeArchitecture5
5 · S1 default-deny, then one pathSecurity8
6 · G2 Kustomize base and overlaysGitOps & CD5
7 · P3 Crossplane XRD and claimPlatform APIs5
8 · A2 autoscale on a custom metricArchitecture5
9 · G5 Tekton Task and PipelineGitOps & CD5
10 · O2 four golden signals in PromQLObservability7
11 · P2 finalizer and status conditionPlatform APIs5
12 · G4 reconcile with FluxGitOps & CD5
13 · A4 strict mTLS, verifiedArchitecture5
14 · P6 CEL validation rulesPlatform APIs5
15 · S3 Kyverno audit to enforceSecurity7
16 · O4 triage three broken podsObservability6
17 · G7 analysed Argo Rollouts canaryGitOps & CD5
18 · P4 Backstage software templatePlatform APIs5
TotalAll five domains100

Computing your result. The points total 100, so your raw score is your percentage, and the bar is 64%. That leaves 36 points spendable — you can drop six of the five-point tasks outright and still clear the bar with six to spare, which is worth internalising, because the candidates who fail are rarely the ones who did not know enough. Then do the more useful arithmetic and total each domain separately. A 70 built from five even domains and a 70 built from four strong domains plus a zero are completely different results, and the second one fails a real exam the day the task draw is unkind.

DomainAvailableYoursIf you scored under two-thirds, go here
GitOps & Continuous Delivery25GitOps workflows and CI/CD & progressive delivery, then re-drill the GitOps bank.
Platform APIs & Self-Service25Platform APIs & operators and self-service & golden paths, then the Platform APIs bank.
Observability & Operations20Observability & operations, then the Observability bank.
Platform Architecture & Infrastructure15Platform architecture, then the Architecture bank.
Security & Policy Enforcement15Security & policy enforcement, then the Security bank.

What each individual miss means. Sort your zeros and halves into three piles, because they need three different treatments — and on Set 1, where you have seen the tasks before, the piles are unusually easy to tell apart.

☺ Like you’re 10: There are three reasons to get a question wrong, and each one has a different cure. Guessing the wrong cure wastes a week.

A task you did not recognise at all is a genuine knowledge gap — surprising on this paper, and worth taking seriously. Read the domain lesson linked in the table above, then re-do the task cold two days later. A task where you knew the shape but burned the clock hunting for a field name is a speed problem, and the cure is the speed reference plus kubectl explain drills and what to know cold, not more reading. A task that broke in a way you could not diagnose is a triage gap: work the triage playbook until the evidence order is automatic. And one pattern that sits outside all three — count how many tasks you left completely unattempted. More than two, and your problem is pacing rather than any of the above.

🎬 At the Platform Guild
🦆

Dot: 58. On tasks I had already done. I want to lie down.

🐢

Timmy: How many did you leave untouched?

🦆

Dot: …five. I spent nineteen minutes on the Crossplane one because I was so close.

🦫

Benny: Nineteen minutes for five points, while twenty-eight points sat unopened at the bottom of the paper. That is the whole diagnosis, Dot. Not one line of it is about Crossplane.

👺

Gizmo: Obvious fix — skip the boring verification sweep at the end. Seven free minutes! 🤑

🐢

Timmy: The sweep is where she finds the two tasks that were one command from passing. What she cuts is the eleventh minute of a six-minute task, not the last seven.

🦉

Professor Owl: Sit it again in a fortnight, Dot, but backwards — task eighteen first. If the number jumps twenty points without you learning a single new thing, you will never argue about pacing again. And leave Set 2 sealed until you do.

After the sitting

☺ Like you’re 10: Practise only the bits you got wrong, and save the second concert for closer to the big day.

Resist the urge to re-drill everything. The whole value of a scored, weighted paper is that it tells you where not to spend your next fortnight. Take your two lowest domain totals, work only those banks and only those lessons, and re-run the specific tasks you flagged rather than the whole set. Everything else you demonstrated you can already do under a clock; grinding it again is comfort, not preparation.

Then leave it alone for a week or two before sitting Set 2, and keep Set 2 genuinely sealed in the meantime — do not skim its tasks “just to see how hard they are,” because that is exactly how you lose your last cold measurement. When the numbers stop moving, the remaining work is logistical rather than technical: the exam guide covers booking, the environment and the rules; the field notes collect what candidates actually reported from the day; the docs map is worth one more pass so the allowlist is reflex; and the final checklist is the last thing you read before you sit down.

🐢 Timmy’s checkpoint

1. What is Set 1 measuring that the practice banks cannot, and why does recognising a task not spoil it? 2. Which documentation may you have open during the real exam, and name three popular projects whose own docs are not permitted? 3. What is the flag-and-move threshold, and what do you do with the work you abandon? 4. Why is the order of this paper deliberately interleaved? 5. You score 62 with four tasks unattempted — what is the diagnosis, and what is the fix? 6. When should Set 2 be sat, and what must you avoid doing before then?

Check your answers
  1. Pacing and triage under a running clock, with knowledge deliberately held constant. Because the tasks are familiar, a low score cannot be blamed on not knowing the material — which makes the diagnosis sharper, not weaker.
  2. kubernetes.io/docs, kubernetes.io/blog, task-specific docs linked from the exam’s Quick Reference box, and local man / /usr/share documentation. Not permitted (any three): Argo CD, Flux, Tekton, Crossplane, Backstage, Prometheus, OpenTelemetry, Kyverno, Gatekeeper, Istio, Linkerd, Helm. Your substitute is the live API — kubectl explain --recursive, kubectl api-resources, and reading an existing object.
  3. Roughly six minutes without a passing done-when check. Write one line about where you stalled, leave whatever you applied in place — partial credit is real — and move to the next task.
  4. Because the real exam is under no obligation to group tasks by topic. Every switch costs a namespace change, a new mental model and a fresh set of field names; training that context switch is half the point of the paper.
  5. A pacing problem, not a knowledge problem — four unattempted tasks is more than the two-task threshold, and on this paper any four are worth 20–26 points you never contested. The fix is the flag-and-move rule plus a re-sit in reverse order, which is the cheapest twenty points available to you.
  6. About a week before the real exam, as the dress rehearsal, after you have fixed the gaps Set 1 exposed. Until then keep it sealed — do not even skim its tasks, or you spend your last cold measurement for nothing.

That is the sitting sheet. Set the timer, close every tab except the allowlist, and let the eighteen rows above take you through two hours that will feel considerably less comfortable than the banks did. Score it honestly, write the domain breakdown somewhere you will see it, and let the two weakest numbers choose your next fortnight — then go back to the drill bank, or on to the course home to pick a lesson.

⏱ The six papers

Set 1 (you are here) · Set 2 · Set 3 · Set 4 · Set 5 · Set 6. Next up: Set 2. All six are weighted to the official blueprint and worth 100 points each; see the practice hub for how to sit them, and the exam guide for the real thing.