CNPA Exam Preparation Material | Certified Cloud Native Platform Engineering Associate

Explanation:
Resource allocation varies between environments to balance cost, performance, and reliability.
Option D is correct because development environments usually require fewer resources and are optimized for speed and cost efficiency, while production environments require stricter limits to ensure stability, scalability, and resilience under real user traffic.
Option A (identical settings) may simplify management but wastes resources and fails to account for different needs.
Option B (maximizing usage in all environments) increases costs unnecessarily.
Option C (strict parity) may be used in testing scenarios but is impractical as a universal rule.
By tailoring resource limits per environment, platforms ensure cost efficiency in dev/staging and robust performance in production. This practice is central to cloud native engineering, as it allows teams to innovate quickly while maintaining governance and operational excellence in production.
Reference:
― CNCF Platforms Whitepaper
― Kubernetes Resource Management Guidance
― Cloud Native Platform Engineering Study Guide

Explanation:
The main advantage of a platform engineering approach is balancing self-service for developers with organizational governance and standardization.
Option A is correct because platforms enable developers to provision infrastructure and application environments independently while embedding security, compliance, and operational guardrails. This ensures that applications with diverse needs (e.g., different scaling patterns, compliance requirements, or environments) can still operate within a unified governance framework.
Option B (isolation only) is sometimes required for compliance but does not address the broader benefit of balancing flexibility and standardization.
Option C forces uniformity, which reduces adaptability for varied workloads.
Option D (centralized deployments) reduces developer autonomy and scalability.
The platform approach enables golden paths, curated abstractions, and reusable services, allowing diverse applications to thrive while maintaining control. This balance is central to platform engineering’s goal of reducing cognitive load and improving developer productivity.
Reference:
― CNCF Platforms Whitepaper
― CNCF Platform Engineering Maturity Model
― Cloud Native Platform Engineering Study Guide

Explanation:
Mutual TLS (mTLS) is a core feature of service meshes, such as Istio or Linkerd, that enhances security in cloud native environments by ensuring that both communicating services authenticate each other
and that the communication channel is encrypted.
Option A is correct because mTLS delivers two critical benefits: authentication (verifying the identity of both client and server services) and encryption (protecting data in transit from interception or tampering).
Option B is incorrect because mTLS does not bypass security―it enforces it.
Option C is partly true in that service meshes often support observability and logging, but that is not the primary purpose of mTLS.
Option D relates to scaling, which is outside the scope of mTLS.
In platform engineering, mTLS is a fundamental security mechanism that provides zero-trust networking between microservices, ensuring secure communication without requiring application-level changes. It strengthens compliance with security and data protection requirements, which are crucial in regulated industries.
Reference:
― CNCF Service Mesh Whitepaper
― CNCF Platforms Whitepaper
― Cloud Native Platform Engineering Study Guide

Explanation:
Compliance with regulations like GDPR and PCI DSS requires fine-grained control, auditing, and data protection.
Option C is correct because deploying a policy engine like Open Policy Agent (OPA) enables dynamic enforcement of policies, real-time data masking, and comprehensive audit logging. This ensures sensitive data is protected while providing traceability and compliance reporting.
Option A is insufficient, as default IAM policies without Kubernetes-level governance do not provide the granularity required for compliance.
Option B (Kubernetes Secrets) adds encryption but lacks auditability and runtime enforcement.
Option D (RBAC and network policies) improves security posture but does not provide comprehensive compliance coverage or data privacy features like masking and logging.
OPA and similar tools integrate with Kubernetes admission control to enforce compliance policies consistently, providing the flexibility and auditability needed in regulated industries.
Reference:
― CNCF Security TAG Best Practices
― CNCF Platforms Whitepaper
― Cloud Native Platform Engineering Study Guide

Explanation:
The most effective approach for scalable Kubernetes infrastructure provisioning is Crossplane compositions.
Option D is correct because compositions let platform teams define custom CRDs (Composite Resources) that abstract infrastructure details while embedding organizational policies and guardrails. Developers then consume these abstractions through simple Kubernetes-native APIs, enabling self-service at scale.
Option A (Helm with values.yaml) is useful for application deployment but not for scalable infrastructure provisioning across multiple clouds.
Option B (imperative scripts) lacks scalability, repeatability, and governance.
Option C (static YAML with kubectl apply) is manual and not suited for dynamic, multi-team environments.
Crossplane compositions allow platform teams to curate golden paths while giving developers autonomy. This reduces complexity, ensures compliance, and supports multi-cloud provisioning―all key aspects of platform engineering.
Reference:
― CNCF Crossplane Project Documentation
― CNCF Platforms Whitepaper
― Cloud Native Platform Engineering Study Guide