Certifications guide

CNPA: The Cloud Native Platform Engineering Associate Exam, Domain by Domain

CNPA is a 120-minute, multiple-choice exam on platform engineering — the practices, not one product. Its weighting surprises most candidates: the portal everyone associates with the discipline is the smallest domain on the paper.

read: 8 min read; read
last updated: September 2026; last updated

Overview

What CNPA actually certifies

The Cloud Native Platform Engineering Associate is the CNCF and Linux Foundation credential for engineers who build internal platforms for other teams. It is an online, proctored, multiple-choice exam, priced at $250 for the exam alone, with no prerequisites, one free retake, a 12-month eligibility window and a certification valid for two years. One detail sets it apart from its siblings: it runs 120 minutes rather than the 90 that KCNA, KCSA, PCA, OTCA, CGOA, CAPA and CCA all get.

Six domains, weighted like this: Platform Engineering Core Fundamentals 36 %, Platform Observability, Security and Conformance 20 %, Continuous Delivery and Platform Engineering 16 %, Platform APIs and Provisioning Infrastructure 12 %, IDPs and Developer Experience 8 %, and Measuring your Platform 8 %. Read that list again if you came expecting a Backstage exam. Developer portals are the smallest domain, tied for last, while nearly three quarters of the paper is fundamentals, security and delivery — practices most platform engineers already perform without having names for them.

Gnoseed is not affiliated with CNCF or the Linux Foundation and neither sells nor proctors this exam; it offers free spaced-repetition practice on the published curriculum. Verify the figures above against the official exam page before you book — the domain list here was read off it in September 2026.

Breakdown

The exam at a glance

One exam, six domains, and a distribution that should decide your revision order before you open a single page.

CNPA

Cloud Native Platform Engineering Associate

AssociateMultiple choice · online proctored · 120 min · $250Prereq: None

Core Fundamentals (36 %) is declarative resource management, DevOps practices, application environments, platform architecture and capabilities, the goals and approaches of the discipline, and CI and GitOps foundations. Observability, Security and Conformance (20 %) covers the four telemetry types, secure service communication, policy engines for governance, Kubernetes security essentials and pipeline security. Continuous Delivery (16 %) revisits CI/CD and GitOps workflows plus incident response. Platform APIs and Provisioning (12 %) is the reconciliation loop, CRDs as self-service APIs, provisioning through Kubernetes and the operator pattern. The last two, at 8 % each, are IDPs and Developer Experience — service catalogues, portals, and AI/ML in platform automation — and Measuring your Platform, which is platform efficiency, team productivity and DORA metrics.

Choose this if…

You already run infrastructure and are being asked to productise it for other teams
You want the vocabulary — golden paths, guardrails, cognitive load — to make platform arguments shorter
You are collecting the CNCF associate set, where CNPA is one of the required exams

Study with Gnoseed

Platform Engineering · 104 cards GitOps with Argo CD & Flux · 140 cards Kubernetes Ops: Scheduling & Resources · 116 cards

Where the marks are

Over a third of the paper is one domain — and it is the conceptual one

Rank the six domains and the shape is clear: Core Fundamentals at 36 % is larger than the bottom three combined. Its competencies are the ones that sound softest and are hardest to bluff — what declarative resource management actually guarantees, what a platform capability is as opposed to the tool implementing it, how application environments differ beyond their size, and what the goals of the discipline are. If you revise by tool, this domain is where you will lose marks.

The next two, Observability, Security and Conformance at 20 % and Continuous Delivery at 16 %, are more familiar ground, but the framing is platform-side rather than practitioner-side. The exam is less interested in whether you can write a NetworkPolicy than in why a platform ships a default-deny baseline; less in how Argo CD syncs than in why a fleet operator prefers a controller pulling from Git over a pipeline holding credentials for every cluster.

Platform APIs and Provisioning at 12 % is the most mechanical domain and the one worth drilling if your background is not Kubernetes-heavy: the reconciliation loop and why level-triggered convergence survives failures, CRDs as the API surface you hand to developers, and the operator pattern as encoded operational knowledge.

The expectation gap

It is not a Backstage exam

Search for platform engineering and you will find Backstage on the first page, so it is reasonable to arrive expecting the exam to follow. It does not. IDPs and Developer Experience is 8 % — roughly one question in twelve — and even that domain is framed around concepts such as simplified access, API-driven service catalogues and portals as an adoption mechanism, rather than any product's implementation.

If Backstage specifically is what you want certified, the Linux Foundation runs a separate exam for it, the Certified Backstage Associate, and that one is a developer exam — TypeScript, npm, React and plugin architecture. The two credentials barely overlap: CNPA asks whether you can design a platform, CBA asks whether you can build and extend one particular portal.

The other under-anticipated domain is Measuring your Platform. It is only 8 %, but it is the part candidates most often get wrong, because the DORA metrics have moved: what many people memorised as "the four keys" with mean time to restore is now published as five metrics, with failed deployment recovery time in place of MTTR. Learn the current names and the precise definitions — particularly what change fail rate divides by — rather than the version in a three-year-old blog post.

CNPA or CNPE

Associate is recall; the professional tier is hands-on

Above CNPA sits the Certified Cloud Native Platform Engineer (CNPE) at $445, and the difference is format rather than merely depth: CNPE is performance-based, so it asks you to build rather than to recognise. Neither is a prerequisite for the other, and the associate exam is the reasonable place to start if you want the concepts straight before spending twice as much on a practical.

Both sit inside the Golden Kubestronaut programme, which requires the full set of CNCF associate certifications, so anyone working through that collection will meet CNPA regardless of whether platform engineering is their day job. That is also why prep material for it is unusually thin right now — the exam is young and the audience has been assembling faster than the content.

Logistics

Cost, retakes and whether it is worth it

CNPA is $250 for the exam alone at the time of writing, with one retake included, a 12-month eligibility window and two years of validity; a bundle with an annual subscription is sold at a higher price. Confirm the current figure on the Linux Foundation page before booking, because bundles and terms change.

Is it worth it? The honest case is that platform engineering is a discipline whose vocabulary is still settling, and a published blueprint is a decent forcing function for learning that vocabulary properly — you leave knowing why a golden path is not a mandate and what a platform team owes its tenants. The weaker case is recognition: this is a young credential and few job posts name it. Take it to structure your own learning, or because you are completing the associate set, rather than because a recruiter is filtering on it.

FAQ

Common questions

What are the CNPA exam domains and their weights? +

Six domains: Platform Engineering Core Fundamentals 36 %, Platform Observability, Security and Conformance 20 %, Continuous Delivery and Platform Engineering 16 %, Platform APIs and Provisioning Infrastructure 12 %, IDPs and Developer Experience 8 %, and Measuring your Platform 8 %. The Linux Foundation publishes the competencies under each.

How long is the CNPA exam? +

120 minutes, which makes it longer than the other CNCF associate exams — KCNA, KCSA, PCA, OTCA, CGOA, CAPA and CCA all run 90 minutes. It is multiple choice and online proctored, with no terminal.

Does CNPA cover Backstage? +

Only lightly. Developer portals sit inside the IDPs and Developer Experience domain, which is 8 % of the paper, and the competencies are conceptual — service catalogues and portals as an adoption mechanism. For Backstage itself there is a separate Certified Backstage Associate exam, and it is a developer exam rather than a concepts one.

Are there prerequisites for CNPA, and how much does it cost? +

There are no prerequisites. The exam alone is $250, includes one retake and a 12-month eligibility window, and the certification is valid for two years. Bundles with a Linux Foundation subscription cost more.

Should I take CNPA or CKA first? +

Neither gates the other, so pick by your work. CKA proves you can operate a cluster from a terminal and is the more widely recognised credential; CNPA proves you understand how to turn that capability into a product other teams consume. If Kubernetes itself is still new, CKA teaches the substrate CNPA assumes.

What is the difference between CNPA and CNPE? +

CNPA is the associate tier: multiple choice, 120 minutes, $250. CNPE is the professional tier at $445 and is performance-based, so it tests building rather than recognising. Neither is a prerequisite for the other.

Start where the marks are

Plant your first seed today. Over a third of CNPA is platform fundamentals — ten minutes a day on golden paths, capabilities and declarative state is the highest-value revision you can do.

Start learning free