After adopting a shared delivery platform, a service moves from weekly deployments to daily deployments. Over the same period, a larger proportion of deployments require rollback or a hotfix, and recovery from failed deployments takes longer.
Which interpretation best aligns with DORA's software delivery performance measures?
Deployment frequency improved, while change fail rate and failed deployment recovery time worsened.
Change lead time improved, while deployment frequency and failed deployment recovery time worsened.
Deployment frequency improved, while change lead time and deployment rework rate remained unchanged.
Overall delivery performance improved because deployment frequency increased more than failure counts.
A
Deployments occur more frequently, but a higher proportion requiring intervention indicates a worse change fail rate, and longer recovery indicates worse failed deployment recovery time. The scenario does not establish change lead time, unchanged deployment rework, or an overall performance improvement.
Measuring Your Platform
25
Select One
A platform team introduces automated test-environment provisioning. Portal visits and the number of environments created both increase.
The team wants to determine whether developers can complete their work faster and with less platform-team assistance.
Which TWO measures provide the most direct evidence?
Total number of environment templates published during the measurement period.
Median elapsed time from an environment request to a usable environment.
Total number of provisioning API calls processed during the measurement period.
Percentage of environment requests completed without platform-team intervention.
B
Median time from request to a usable environment measures how quickly developers obtain what they need, and the share of requests completed without platform-team intervention measures independence from platform-team assistance. Template counts and API call volumes measure available capability or activity; their values can increase without improving either outcome.
Measuring Your Platform
24
Select Two
D
A platform assistant generates service configuration that passes schema validation. After the platform team changes its supported deployment profiles, the assistant continues producing configurations based on the previous profiles.
The profiles change several times a month. The team wants to keep suggestions current without updating the model for every change.
Which approach best meets this requirement?
Fine-tune the model on accepted configuration examples during the platform's quarterly release cycle.
Include several approved configurations in a fixed prompt and use deterministic generation settings.
Retrieve the current profile definitions during generation and check results against their constraints.
Generate several configuration candidates and select the one receiving the highest model confidence score.
C
Retrieval supplies current profile definitions without repeated model updates, and validation checks generated configurations against their constraints. Quarterly fine-tuning and a fixed prompt can become outdated between updates, and a model confidence score does not establish whether a candidate satisfies current platform requirements.
IDPs and Developer Experience
23
Select One
A developer portal already lists the company's services. However, its ownership records and documentation links frequently become outdated. Teams maintain accurate information in their service repositories, while the portal uses a separate manually maintained inventory.
Which change would best reduce these inconsistencies without introducing another routine update task for developers?
Refresh catalog entries from deployed Kubernetes labels and retain documentation links in the portal database.
Assign portal editors to review service ownership and documentation links at the end of each release.
Populate catalog entries when repositories are created and validate required fields during onboarding.
Ingest repository-maintained service descriptors and refresh the catalog from those sources.
D
Refreshing the catalog from repository-maintained descriptors uses the source teams already maintain. Refreshing from Kubernetes labels leaves documentation links in a separate inventory, editor reviews retain duplicate maintenance, and populating entries only at creation improves initial records but does not address later changes.
IDPs and Developer Experience
22
Select One
A database runs on Kubernetes using a StatefulSet. Its Pods restart successfully after failures, but database replication sometimes requires a recovery procedure before the service can accept writes. A supported operator exists for this database and implements that procedure.
The platform team wants recovery to respond to database state without requiring an engineer to start it.
Which approach best meets this requirement?
Add the recovery procedure to a Helm post-upgrade hook and execute it during database releases.
Adopt the operator and configure its database resource to manage the existing operational requirements.
Extend the StatefulSet's readiness probe to keep recovering instances out of client traffic.
Schedule the recovery script as a CronJob and execute it at a fixed interval.
B
The operator contains the database-specific recovery knowledge and can react to observed state. A Helm hook runs only during releases, a readiness probe controls traffic but does not perform recovery, and a CronJob executes periodically rather than implementing database-aware lifecycle reconciliation.
Platform APIs and Provisioning Infrastructure
21
Select One
A Kubernetes controller requests an external resource. The provider creates it, but the controller crashes before recording the result in the custom resource's status.
After restarting, the controller receives another reconciliation request. The provider supports an idempotency token and resource lookup.
Which implementation best prevents duplicate provisioning?
Derive a stable token from the resource identity and check or reuse the existing provider resource.
Generate a new token for each reconciliation attempt and record the latest returned resource identifier.
Write a completed status before calling the provider and treat that status as the provisioning result.
Wait for a fixed interval after restart and then repeat the original provisioning call with a new token.
A
A stable identifier, together with the provider's stated idempotency and lookup capabilities, lets reconciliation recognize a completed operation. Generating new tokens can create duplicates, as can waiting and repeating the call with a new token. Writing completed status first records success before it is known and can leave provisioning incomplete after a failure. This applies reconciliation principles to the provider behavior specified in the question.
Platform APIs and Provisioning Infrastructure
20
Select One
A platform team installs a Database CustomResourceDefinition in Kubernetes. Developers can create Database objects, and the API server accepts them, but no databases appear in the external database service.
What is the missing component?
A ConfigMap that maps the custom resource's fields to the external service's settings.
A validating admission policy that checks the database's size and engine version.
A controller that watches the custom resources and reconciles external database instances.
An RBAC binding that allows developers to create additional custom resource instances.
C
A CRD makes the resource type available through the Kubernetes API. A controller supplies the behavior that provisions and manages the external database. A ConfigMap stores configuration, an admission policy validates input, and an RBAC binding grants permissions; none performs provisioning.
Platform APIs and Provisioning Infrastructure
19
Select One
A shared platform update causes deployments from several application teams to fail. Multiple engineers begin changing platform components, while application teams receive conflicting status reports.
Which TWO actions should the team prioritize to coordinate the incident response?
Establish an incident lead and assign explicit operational and communication responsibilities.
Ask each application team to apply a local workaround and reconcile the differences afterward.
Complete a root-cause investigation before selecting a service-restoration action.
Maintain a shared incident record of impact, decisions, recovery actions, and stakeholder updates.
A
Defined roles coordinate restoration and communication, and a shared incident record preserves decisions and prevents conflicting assumptions. Asking each team to apply local workarounds encourages fragmented changes, and requiring a complete root-cause investigation first unnecessarily delays service restoration.
Continuous Delivery & Platform Engineering
18
Select Two
D
A pipeline builds an application, runs automated checks, and deploys it to a production-like environment. Any successful version can be released to production through an automated deployment, but a person decides when to initiate that release.
Which description best fits this process?
Continuous delivery, with a manual decision controlling production release.
Continuous deployment, with production timing controlled by a release decision.
Continuous integration, with production deployment treated as a separate manual procedure.
GitOps, with the release decision acting as the reconciliation mechanism.
A
Continuous delivery keeps successful versions releasable through an automated process while allowing a manual release decision. Continuous deployment automatically releases qualifying changes. Describing this as continuous integration understates the automated deployment capability, and the scenario gives no evidence of GitOps retrieval and reconciliation.
Continuous Delivery & Platform Engineering
17
Select One
A delivery workflow stores deployment manifests in Git. After approval, a CI job runs kubectl apply against the production cluster. Cluster changes made outside the pipeline remain until the next deployment.
The team wants to adopt the pull and continuous-reconciliation principles of GitOps.
Which change is needed?
Add a pipeline stage that compares the live cluster with Git immediately after deployment.
Trigger the deployment job for every manifest commit instead of waiting for approval.
Give the CI job access to read cluster state before applying the approved manifests.
Run an in-cluster agent that retrieves desired state and repeatedly reconciles the cluster.
D
The agent supplies automatic retrieval and ongoing reconciliation. A post-deployment comparison is a one-time check, triggering on every commit changes the deployment trigger, and reading cluster state adds an observation before deployment. None of those three establishes continuous reconciliation. An agent need not universally run inside the target cluster for GitOps, but the in-cluster design meets the requirement.
Continuous Delivery & Platform Engineering
16
Select One
An Argo CD application tracks a single Git repository. Automated synchronization and self-healing are enabled. Git specifies two replicas for a Deployment.
An engineer changes the live Deployment to four replicas. No autoscaler manages the replica count, and no differences are ignored. Argo CD later restores two replicas.
What is the best way to make four replicas the lasting desired state?
Repeat the live update after Argo CD completes its next synchronization.
Change the tracked manifest to four replicas and commit it through the normal review process.
Increase Argo CD's reconciliation interval before applying the live update again.
Disable automated pruning and then update the live Deployment to four replicas.
B
Updating Git makes four replicas the desired state. With self-healing enabled, Argo CD corrects tracked live-state differences. Repeating the live update repeats the conflicting change, a longer reconciliation interval only delays correction, and disabling pruning concerns removal of resources rather than preserving a replica-count change.
Continuous Delivery & Platform Engineering
15
Select One
A company uses GitHub Actions to deploy several applications. Its cloud provider supports workflow identity federation. For one application, production deployment must require approval through the GitHub production environment, and workflows from other repositories must not obtain its production role.
Which configuration best meets both requirements?
Trust the application repository's default-branch identity and configure approval on the GitHub production environment.
Trust identities containing the production environment name across the organization and configure environment approval.
Trust the application repository's production environment identity and configure approval on that environment.
Trust all workflow identities from the application repository and require review of changes to its deployment workflow.
C
Trusting the repository's production environment identity ties role assumption to the specific repository and protected environment. Trusting a branch identity does not require the production environment identity, trusting the environment name across the organization permits other repositories, and trusting all repository workflows permits other workflow contexts and replaces deployment approval with workflow-change review. The provider must evaluate the repository-and-environment identity claims in its trust configuration.
Platform Observability, Security, and Conformance
14
Select One
A support group needs to list Pods and read Pod logs in the payments namespace. It must not read Secrets or access workloads in other namespaces.
A reusable ClusterRole already grants only get, list, and watch on Pods and get on pods/log.
Which configuration meets the requirement?
Bind the built-in view ClusterRole to the group with a RoleBinding in payments.
Bind the reusable ClusterRole to the group with a ClusterRoleBinding.
Bind the built-in edit ClusterRole to the group with a RoleBinding in payments.
Bind the reusable ClusterRole to the group with a RoleBinding in payments.
D
A RoleBinding can reference a ClusterRole while granting its namespaced permissions only in the binding's namespace. The built-in view role grants broader read access than requested, a ClusterRoleBinding grants permissions across namespaces, and the built-in edit role includes modification privileges and access beyond the stated requirement.
Platform Observability, Security, and Conformance
13
Select One
A platform requires every newly created workload to include an ownership label. Workloads can be submitted through the developer portal, CI pipelines, or direct Kubernetes API access.
Which approach most effectively enforces the requirement across these entry points?
Apply an admission validation policy in enforcement mode to the relevant workload resources.
Add an ownership-label validation step to the organization's reusable CI workflow.
Run a scheduled controller that reports unlabeled workloads to their namespace administrators.
Require the ownership field in every portal template that generates workload manifests.
A
Admission validation evaluates matching requests at the Kubernetes API, regardless of the client submitting them. CI validation and portal templates cover only particular submission paths, and a scheduled report detects violations after creation rather than preventing noncompliant resources from being admitted.
Platform Observability, Security, and Conformance
12
Select One
A platform uses a service mesh. All relevant application traffic passes through mesh proxies. The security team requires encrypted service-to-service traffic and access to a payment endpoint restricted to the checkout workload's identity.
Which TWO controls together meet these requirements?
Apply namespace-based network rules permitting traffic from the application namespace.
Require mutual TLS for traffic between the participating workloads.
Apply a mesh authorization policy permitting the checkout identity to reach the endpoint.
Configure server-authenticated TLS from each caller to the payment endpoint.
B
Mutual TLS encrypts traffic and authenticates the participating workloads, and a mesh authorization policy controls which authenticated identity may reach the endpoint. Namespace-based network rules use network boundaries rather than the required workload identity, and server-authenticated TLS authenticates the server but not the calling workload.
Platform Observability, Security, and Conformance
11
Select Two
C
A request passes through an API service, an inventory service, and a payment service. Dashboards show increased request latency, but engineers cannot determine which downstream operation caused an individual slow request.
Which TWO changes most directly improve this investigation?
Propagate trace context across service calls and record spans for downstream operations.
Increase the scrape frequency of CPU and memory metrics across the three services.
Include trace and span identifiers in application logs generated during request processing.
Extend infrastructure-log retention and consolidate node logs into a shared index.
A
Trace propagation connects operations across services, and trace and span identifiers associate logs with those operations. More frequent resource metrics and longer infrastructure-log retention provide useful aggregate or infrastructure information, but do not establish the timing and path of an individual request.
Platform Observability, Security, and Conformance
10
Select Two
C
An internal application calls a backend running as a Kubernetes Deployment. Backend Pods are replaced during updates, and their IP addresses change. Both applications run in the same cluster.
Which approach provides a stable access point with the least custom discovery logic?
Publish Pod IP addresses in a ConfigMap and reload the client when the ConfigMap changes.
Query EndpointSlices from the client and maintain a local pool of backend connections.
Place an external load balancer in front of the backend and configure its address in the client.
Create a ClusterIP Service that selects the backend Pods and use its DNS name.
D
A Service provides stable access to a changing set of selected Pods. Publishing Pod IPs in a ConfigMap and querying EndpointSlices both introduce client-side discovery or update logic. An external load balancer can provide connectivity but adds unnecessary external infrastructure for this internal communication requirement.
Platform Engineering Core Fundamentals
9
Select One
A company introduces a shared delivery platform. Platform engineers understand the deployment system, while application developers understand service behavior. Releases are delayed because each group expects the other to investigate failed application checks.
Which TWO practices best support a DevOps approach to this problem?
Assign application acceptance-test maintenance to the platform team alongside pipeline maintenance.
Agree on ownership and escalation paths for platform failures and application-specific failures.
Measure each group against separate completion targets for its stage of the release process.
Make delivery failures visible to both groups and use joint feedback to improve the workflow.
B
Explicit ownership and escalation paths prevent responsibility gaps, while making failures visible to both groups and using joint feedback improves the complete delivery process. Moving application acceptance tests to the platform team separates them from their domain owners, and separate stage-level targets encourage optimizing individual stages rather than the overall workflow.
Platform Engineering Core Fundamentals
8
Select Two
D
An application passes staging tests but occasionally behaves differently after production deployment. Staging and production images are built separately from the same source commit, and dependency versions can change between builds.
Which change best reduces this source of inconsistency?
Build both images on identically configured runners and retain the separate build processes.
Promote the tested image by digest and supply environment-specific configuration at deployment.
Tag both images with the source commit identifier and compare their application version strings.
Run the production build immediately after staging tests and use the same dependency cache.
B
Promoting the same image digest preserves the tested artifact's identity, and environment-specific configuration can be supplied separately. Identical runners and a shared dependency cache still rebuild the image and can introduce dependency differences. Matching commit tags give the builds matching labels without ensuring identical contents.
Platform Engineering Core Fundamentals
7
Select One
Developers run automated tests on feature branches, but merge their changes into the main branch only at the end of each two-week sprint. Integration failures frequently delay releases.
Which change most directly addresses the cause of these failures?
Add a longer integration-test phase after the sprint's feature branches have been merged.
Run the existing feature-branch tests more frequently while retaining the sprint merge schedule.
Integrate small changes into the main branch frequently and run fast checks on each integration.
Create a release branch earlier in the sprint and stabilize it while feature development continues.
C
Frequent integration exposes incompatibilities while changes remain small. A longer integration phase detects problems late. Running branch tests more often improves branch feedback but retains delayed integration. An earlier release branch introduces another stabilization branch without addressing infrequent integration into main.
Platform Engineering Core Fundamentals
6
Select One
Several internal teams share a Kubernetes cluster. Each team already has a namespace and namespace-scoped access. One team creates many workloads, leaving little schedulable capacity for others.
The platform needs to cap each team's aggregate requested CPU and memory with minimal additional infrastructure.
Which approach best meets this requirement?
Apply a ResourceQuota for CPU and memory requests to each team's namespace.
Apply a LimitRange that caps CPU and memory requests for each individual container.
Configure a HorizontalPodAutoscaler with a maximum replica count for each Deployment.
Assign a PriorityClass to each team and configure workload priorities by business importance.
A
ResourceQuota can cap aggregate CPU and memory requests within a namespace. LimitRange constrains individual objects. An HPA's maximum applies to a particular workload, while PriorityClass influences scheduling priority rather than establishing a namespace resource budget.
Platform Engineering Core Fundamentals
5
Select One
A team deploys three interchangeable instances of a stateless HTTP application. Application data is stored in an external database. Releases should replace instances gradually, and a failed instance should be replaced automatically. Individual instances do not need persistent identities.
Which Kubernetes workload resource best fits these requirements?
A StatefulSet with three replicas and an ordered rolling-update strategy.
A DaemonSet deployed across three application nodes with a rolling-update strategy.
A Job with parallelism set to three and a restart policy for failed containers.
A Deployment with three replicas and a rolling-update strategy.
D
A Deployment fits interchangeable, continuously running application replicas and supports rolling updates. A StatefulSet adds persistent identities and ordering that are unnecessary here. A DaemonSet ties placement to eligible nodes. A Job manages work intended to run to completion.
Platform Engineering Core Fundamentals
4
Select One
A developer portal provisions test environments through an automated workflow. During a pilot, developers repeatedly submit requests because they cannot tell whether provisioning has started. Some retries create duplicate environments. Developers also contact the platform team to obtain connection details after provisioning finishes.
Which TWO changes most directly address these problems?
Associate each request with an operation identifier and reuse the operation when the same request is retried.
Increase the provisioning-worker pool and raise the number of requests that can run concurrently.
Show infrastructure health and worker utilization alongside the environment request form.
Expose each operation's progress, result, and connection details through the portal.
A
An operation identifier lets the system recognize retries of the same request and avoid duplicate provisioning, and exposing progress, result, and connection details supplies what developers currently obtain through retries and support requests. More workers can reduce waiting but do not resolve these issues, and showing infrastructure health reports system status rather than a request's outcome.
Platform Engineering Core Fundamentals
3
Select Two
D
Most teams deploy HTTP services through a platform-provided template. A new application needs a long-running background worker with different scaling behavior. The application team wants to retain the platform's deployment automation and monitoring.
Which approach best balances standardization with the new requirement?
Provide a separate copy of the platform stack for the application team to maintain.
Extend the supported deployment path with a worker profile and shared operational controls.
Adapt the worker to the HTTP service profile and retain the existing scaling configuration.
Transfer worker deployments to the platform team through a dedicated service-request queue.
B
A worker profile accommodates the workload while retaining shared capabilities. A separate copy duplicates maintenance, forcing the worker into the HTTP profile preserves unsuitable scaling behavior, and a request queue introduces a recurring handoff. Standardization should support common needs without forcing every workload into the same configuration.
Platform Engineering Core Fundamentals
2
Select One
A platform team has funding for one improvement this quarter. Application teams report delays when launching services, but disagree about whether the main problem is infrastructure provisioning, access approvals, or deployment configuration.
Which action should the platform team take first to select the improvement most likely to reduce these delays?
Benchmark the provisioning system and prioritize the component with the highest execution time.
Collect feature requests from engineering managers and prioritize the most frequently requested capability.
Observe representative service launches and identify where developers spend time waiting or repeating work.
Compare the platform with an industry reference architecture and prioritize the largest capability gap.
C
Observing real launches identifies the bottleneck before selecting a solution. Benchmarking only provisioning considers one possible cause, collecting feature requests establishes what people ask for rather than the underlying problem, and comparing against a reference architecture prioritizes architectural completeness rather than demonstrated developer needs.
Platform Engineering Core Fundamentals
1
Select One
.png)
.svg)
