Linux Foundation CNPA Exam Dumps

The primary goal of platform engineering is to create reusable, scalable platforms that improve both developer productivity and developer experience. Option D is correct because platform engineering treats the platform as a product, providing self-service capabilities, abstractions, and golden paths that reduce cognitive load for developers while embedding organizational guardrails.

Option A is too narrow---platform engineering is not limited to infrastructure automation but extends to developer usability, observability, and governance. Option B is incorrect because limiting access contradicts the principle of empowering developers through self-service. Option C is misleading; platform engineering complements DevOps practices but does not replace them.

By enabling developers to consume infrastructure and platform services through self-service APIs and portals, platform teams accelerate delivery cycles while maintaining compliance and security. This approach results in improved efficiency, reduced toil, and better alignment between business and engineering outcomes.

--- CNCF Platforms Whitepaper

--- CNCF Platform Engineering Maturity Model

--- Cloud Native Platform Engineering Study Guide

An extensible architecture with modular components is crucial for modern platform engineering. Option C is correct because modularity allows new capabilities (e.g., self-service delivery, observability, or security features) to be added or replaced without disrupting the whole system. This approach promotes agility, scalability, and maintainability.

Option A (monolithic architecture) restricts flexibility and slows innovation. Option B (centralized API gateways) may help integration but still creates bottlenecks if every addition requires specialist intervention. Option D (static architecture) locks the platform into rigid patterns, preventing adaptation to evolving needs.

Extensible, modular design is a hallmark of cloud native platforms. It enables composability, where services (like service mesh, logging, monitoring, or provisioning APIs) can be plugged in as needed. This architecture supports golden paths and self-service abstractions, reducing developer friction while keeping governance intact.

--- CNCF Platforms Whitepaper

--- CNCF Platform Engineering Maturity Model

--- Cloud Native Platform Engineering Study Guide

Argo CD is a GitOps-native continuous delivery tool specifically designed for Kubernetes. Option B is correct because Argo CD continuously monitors Git repositories for desired application state and reconciles Kubernetes clusters accordingly. It is declarative, Kubernetes-native, and aligned with GitOps principles, making it a key tool in platform engineering.

Option A (TravisCI) and Option C (CircleCI) are CI/CD systems but not Kubernetes-native or GitOps-driven. Option D (Jenkins) is a widely used CI/CD tool but operates primarily in a push-based model unless extended with plugins, and is not purpose-built for GitOps.

Argo CD provides automated deployments, drift detection, rollback, and auditability---features central to GitOps workflows. It simplifies multi-cluster management, enforces compliance, and reduces manual intervention, making it a leading choice in Kubernetes-based platform engineering.

--- CNCF GitOps Principles

--- Argo CD CNCF Project Documentation

--- Cloud Native Platform Engineering Study Guide

The fundamental difference between a traditional CI/CD model and a GitOps model lies in how changes are applied to the Kubernetes cluster---whether they are 'pushed' to the cluster by an external system or 'pulled' by an agent running inside the cluster.

CI/CD (Push Model)

In a typical CI/CD pipeline for Kubernetes, the CI/CD server (like Jenkins, GitLab CI, or GitHub Actions) is granted credentials to access the cluster. When a pipeline runs, it executes commands like kubectl apply or helm upgrade to push the new application configuration and image versions directly to the Kubernetes API server.

Actor: The CI/CD pipeline is the active agent initiating the change.

Direction: Changes flow from the CI/CD system to the cluster.

Security: Requires giving cluster credentials to an external system.

In a GitOps model, a Git repository is the single source of truth for the desired state of the application. An agent or controller (like Argo CD or Flux) runs inside the Kubernetes cluster. This controller continuously monitors the Git repository.

When it detects a difference between the desired state defined in Git and the actual state of the cluster, it pulls the changes from the repository and applies them to the cluster to bring it into the desired state. This process is called reconciliation.

Actor: The in-cluster controller is the active agent initiating the change.

Direction: The cluster pulls its desired state from the Git repository.

Security: The cluster's credentials never leave its boundary. The controller only needs read-access to the Git repository.

The main purpose of Kubernetes runtime security is to protect workloads during execution. Option B is correct because runtime security focuses on monitoring active Pods, containers, and processes to detect and prevent malicious activity such as privilege escalation, anomalous network connections, or unauthorized file access.

Option A (etcd encryption) addresses data at rest, not runtime. Option C (image scanning) occurs pre-deployment, not during execution. Option D (API access control) is enforced through RBAC and IAM, not runtime security.

Runtime security solutions (e.g., Falco, Cilium, or Kyverno) continuously observe system calls, network traffic, and workload behaviors to enforce policies and detect threats in real time. This ensures compliance, strengthens defenses in zero-trust environments, and provides critical protection for cloud native workloads in production.

--- CNCF Security TAG Guidance

--- CNCF Platforms Whitepaper

--- Cloud Native Platform Engineering Study Guide