Practice Tasks — the drill bank
The CNPE has no multiple choice. Nobody asks you to describe a canary — they drop you on a Linux desktop with a terminal, a browser and roughly two hours, and they ask you to make one work. So the highest-value thing you can do before exam day is sit in front of a real cluster, under a clock, with only the official docs open. This page is the front door to that practice bank. The tasks live on five per-domain pages, one per slice of the blueprint, so each sitting stays bite-sized — pick a domain, work its tasks, score them, close the laptop. Everything here is the method: how to drill, how to score, and how to string the five banks into a full timed mock.
Imagine the cooking test isn’t “write down the recipe for soup.” It’s “here is a kitchen, here are some vegetables, you have two hours, make six dishes.” Reading recipe books won’t save you — you have to stand at the stove and burn a few onions first. This page is the menu: each of the five links below is a pile of cooking challenges about one kind of dish, and this page tells you how to practise them — one pile at a time, with a timer, and no peeking until you’ve really tried.
How to drill this bank
☺ Like you’re 10: Try each puzzle yourself first, with a timer running. Only lift the flap when you’re stuck or finished — otherwise your brain learns “I can read solutions,” not “I can do this.”
Reading a worked solution feels like learning and is almost useless: the exam doesn’t ask you to recognise correct YAML, it asks you to produce it, in a terminal, under time pressure. Four rules make the bank behave like the real thing.
One — do every task cold. Empty terminal, no leftover manifests, no tab still open on the answer. That is how the exam starts you; starting warm inflates every score you record.
Two — time-box each task to five to seven minutes. Roughly the real per-task budget. Set an actual timer; when it rings, stop, note what happened, and move on — learning to abandon a task is itself a scored skill.
Three — never open the solution before you have attempted it. Wrong-then-corrected sticks; read-and-nodded evaporates by the weekend. Verify with the task’s “done when” command, not with your eyes — only proving it worked earns points.
Four — re-do every failure the next day. A task you got wrong is worth ten you got right. Keep a list; strike items off only when they run clean without help.
Practise doc navigation, not memorisation. The official documentation is open during the exam, so getting to the page that holds the example you need in twenty seconds beats half-remembering the manifest. While you drill, bookmark the exact URL you landed on — the docs map is a head start, and the command reference covers the CLI speed that turns a stalled task into a finished one.
The five banks
The domain weights tell you where your practice hours belong. Half the exam lives in GitOps and Platform APIs, so half your practice should too. Work them in blueprint order the first time through, then let your scores decide what to repeat.
| Domain | Exam weight | Bank |
|---|---|---|
| GitOps & Continuous Delivery | 25% | Practice — GitOps & Continuous Delivery |
| Platform APIs & Self-Service | 25% | Practice — Platform APIs & Self-Service |
| Observability & Operations | 20% | Practice — Observability & Operations |
| Platform Architecture & Infrastructure | 15% | Practice — Platform Architecture & Infrastructure |
| Security & Policy Enforcement | 15% | Practice — Security & Policy Enforcement |
GitOps & Continuous Delivery
Argo CD Applications, sync policies, drift and self-heal, ApplicationSets, Kustomize overlays, Tekton pipelines and Argo Rollouts canaries.
D3 · 25%Platform APIs & Self-Service
Writing CRDs with validation and printer columns, controller behaviour, Crossplane compositions and Backstage templates as golden paths.
D4 · 20%Observability & Operations
ServiceMonitors and the selector chain, PromQL and recording rules, alerting, SLOs and error budgets, OpenTelemetry traces and structured logs.
D1 · 15%Platform Architecture & Infrastructure
Multi-tenancy boundaries, quotas and LimitRanges, scheduling and affinity, autoscaling, ingress and Gateway API, storage classes.
D5 · 15%Security & Policy Enforcement
Kyverno and Gatekeeper policies, RBAC least privilege, Pod Security admission, NetworkPolicy default-deny and secret handling.
Sit a full mock exam
☺ Like you’re 10: Once you’ve practised each pile on its own, do one big session where you mix them all up and race the clock — that’s the closest thing to the real day.
Drilling one domain at a time builds skill; a mock builds stamina and triage judgement, which are what actually fail people. Once you have worked all five banks, book a two-hour block.
You don’t have to build the sitting yourself — all six papers exist, each 18 tasks weighted to the blueprint and worth 100 points with a scoring sheet.
- Mock Exam · Set 1 — assembled from the banks below, interleaved into exam order. You may recognise tasks, and that’s the point: this sitting tests pacing and triage, not novelty.
- Mock Exam · Set 2 — eighteen all-new tasks that appear nowhere in these banks, with worked solutions.
- Sets 3, 4, 5 and 6 — four more all-new papers, each drawing from a different pool so they never repeat. Set 6 is the hardest: multi-step tasks that chain two capabilities together, plus deliberately broken scenarios you must diagnose first.
The order that works: drill the five banks → sit Set 1 → re-drill whatever you lost points in → work through Sets 3–5 as you improve → keep Set 2 and Set 6 sealed as genuine dress rehearsals in the final week.
Pick tasks weighted like the real exam. Draw roughly five GitOps, five Platform APIs, four Observability, three Architecture and three Security, shuffled so you never know which domain is next. Officially the exam is 15–20 performance-based tasks with a 64% pass mark, so a mock in that shape is realistic in length and mix.
Set a 120-minute timer and don’t pause it — not for coffee, not to fix your cluster. A mock you keep pausing teaches you nothing about pacing.
Allow only the resources the real exam allows — and that list is narrower than most people assume. Officially you get kubernetes.io/docs, kubernetes.io/blog, whatever the exam’s own Quick Reference box links for a given task, and locally installed docs (man, /usr/share). The project sites for Argo CD, Flux, Tekton, Crossplane, Backstage, Prometheus, OpenTelemetry, Kyverno, Gatekeeper, Istio and Helm are not available. No blogs, no notes, no this site, no assistant. Practise under exactly those conditions — see the docs map and what you must know cold.
Read every task first, then bank the easy ones. Sequential order is a trap — harvest cheap points early, return to expensive ones with whatever is left.
Score yourself, then study the gaps. Total your marks with the rubric below and compare against 64%. The output is a list of domains to re-drill, not a number to feel good or bad about.
Book the block at the time of day your real exam is scheduled, and build a throwaway kind cluster the night before so you aren’t burning mock time on installation. Phone in another room, one browser window on the official docs, timer running, no stopping until it rings. Then break before you score — marking your own work while still adrenalised produces generous nonsense.
Score yourself honestly
Partial credit is real: people pass without finishing every task, and a half-built resource that satisfies part of the check still earns something. So score in bands, write the number down, and read the pattern across twenty tasks rather than agonising over one result.
| Band | What it looks like | Credit | What to do about it |
|---|---|---|---|
| 4 — Clean | Done inside 5 minutes, “done when” check passed first time, docs used only to confirm. | Full | Nothing. Spend the time elsewhere. |
| 3 — Solid | Done inside 7 minutes, check passed, but you needed the docs for field names. | Full | Bookmark the doc page. This is the healthy state. |
| 2 — Partial | Out of time, or the check half-passed — resource created but a flag missing, alert defined but never fired. | Partial | Re-do cold tomorrow. Your points leak here. |
| 1 — Stalled | You knew the shape but burned the budget hunting syntax or chasing a typo. | Little | Drill the CLI, not the concept — command reference. |
| 0 — Blank | You didn’t recognise the tool or the resource kind at all. | None | Top priority. Read the lesson, then the tools page. |
Read the pattern, not the total. A whole domain dragging is a knowledge gap — go read the lesson. Good scores with repeated overruns is a speed problem, fixed by imperative kubectl (--dry-run=client -o yaml, kubectl explain) and aliases. Tasks that broke in ways you couldn’t diagnose send you to the troubleshooting playbook. Finished early and scored well? Work the final checklist, read the field notes, and book it.
Exam specifics change. Task counts, the pass mark, domain weights, permitted resources, the Kubernetes version on the desktop and the projects in scope have all moved before and will move again. Everything here is a study aid written at a point in time — before you book, confirm current details on the official CNCF certification pages and the Linux Foundation training site, which are the only authority. The same applies to your practice cluster: its versions and defaults differ from the exam’s, so check with kubectl api-resources and kubectl explain <kind> --recursive rather than assuming an apiVersion.
Dot: I read all thirty-one solutions last night. Front to back. I feel great about this exam.
Timmy: How many did you type into a cluster?
Dot: …zero? But I understood every one of them!
Benny: That’s recognition, not recall. The exam doesn’t show you YAML and ask if it looks right — it hands you an empty terminal and a stopwatch.
Gizmo: Do all five banks tonight then. One giant session. Maximum efficiency. 🤑
Timmy: That’s how you learn to be tired, Gizmo. One bank per sitting, cold and timed — then a single full mock once all five are done.
Foxy: And re-do the failures tomorrow. Nobody likes that rule; it’s also the only one that reliably moves the score.
1. What is the time cap on a first attempt at any task, and what do you do when you hit it? 2. Which two domains deserve half your practice time? 3. In a weighted mock, how many tasks come from each bank? 4. What may you have open during a mock, and why? 5. Officially, how many tasks and what pass mark? 6. You score a 2 — what happens next, and when?
Check your answers
- Five to seven minutes. Then flag it, jot one line on where you stalled, and move on. Partial work earns partial credit; an unattempted task earns nothing.
- GitOps & Continuous Delivery and Platform APIs & Self-Service — 25% each, so half the paper between them.
- Roughly 5 GitOps, 5 Platform APIs, 4 Observability, 3 Architecture, 3 Security, shuffled.
- Only the official project documentation. Anything else hides the doc-navigation weakness the mock exists to expose.
- 15–20 performance-based tasks, 64% pass mark — both worth re-checking on the official CNCF pages, because they change.
- It goes on the re-do list and you work it cold the next day. Band 2 is where points leak.
That’s the method. Pick a bank, work it cold and timed, score it honestly, re-do what scored below a 3 — then sit the full mock. For context rather than drills: the exam guide covers logistics, the lab track builds the cluster skills these tasks assume, and the glossary, flashcards and quiz test the concepts underneath the muscle memory.