Certified Associate Programmer (CPA) Exam — Questions and Answers

Question 1: Which profiling approach samples the call stack at regular intervals to estimate where time is spent?

Memory profiling
Code coverage profiling
Instrumentation profiling
Statistical (sampling) profiling (Correct answer)

Correct answer: Statistical (sampling) profiling

Statistical profiling periodically samples the program's call stack, estimating hot spots without requiring code instrumentation, resulting in lower overhead.

Question 2: Which type of firewall inspects traffic all the way up to the application layer?

Packet-filtering firewall
Stateless firewall
Circuit-level gateway
Next-generation firewall (NGFW) (Correct answer)

Correct answer: Next-generation firewall (NGFW)

An NGFW performs deep packet inspection at the application layer, identifying and controlling applications regardless of port or protocol.

Question 3: In a truth table for a two-input AND operation, how many rows produce a TRUE output?

4
2
0
1 (Correct answer)

Correct answer: 1

Only the row where both inputs are TRUE (TRUE AND TRUE) produces a TRUE output; all other combinations yield FALSE.

Question 4: Which autoscaling policy adds or removes instances based on a scheduled time rather than real-time metrics?

Manual scaling
Scheduled scaling (Correct answer)
Dynamic scaling
Predictive scaling

Correct answer: Scheduled scaling

Scheduled scaling adjusts capacity at predetermined times, useful for known traffic patterns like business-hours spikes.

Question 5: In Kubernetes, what resource acts as a stable network endpoint that load-balances traffic to a dynamic set of pods?

Ingress
PersistentVolumeClaim
Deployment
Service (Correct answer)

Correct answer: Service

A Kubernetes Service provides a stable virtual IP and DNS name that proxies traffic to matching pods, abstracting away individual pod IPs.

Question 6: A function calls itself recursively without a base case. What type of error results?

Null pointer exception
Syntax error
Off-by-one error
Stack overflow (infinite recursion) (Correct answer)

Correct answer: Stack overflow (infinite recursion)

Without a base case, each recursive call adds a frame to the call stack until the stack's memory limit is exceeded, causing a stack overflow.

Question 7: Which SQL statement is used to grant a user permission to SELECT data from a table?

PERMIT SELECT ON table FOR user
ASSIGN SELECT ON table TO user
ALLOW SELECT ON table TO user
GRANT SELECT ON table TO user (Correct answer)

Correct answer: GRANT SELECT ON table TO user

The GRANT statement assigns specific privileges such as SELECT, INSERT, or UPDATE to a user or role for a specific database object.

Question 8: What does residual risk mean in CPA practice?

Risk remaining after all controls are implemented (Correct answer)
Budget overrun risk
Risk affecting waste materials
Initial risk before assessment

Correct answer: Risk remaining after all controls are implemented

Residual risk is the level remaining after practical controls are applied. Some is usually accepted as eliminating all risk is rarely feasible.

Question 9: Which data format is most commonly used in modern REST APIs for data interchange?

JSON (Correct answer)
CSV
YAML
XML

Correct answer: JSON

JSON (JavaScript Object Notation) is the most widely used format in REST APIs due to its lightweight structure, human readability, and native support in JavaScript.

Question 10: What is the key difference between Black-Box and White-Box testing?

Black-Box is manual; White-Box is automated
Black-Box is done by developers; White-Box by end users
Black-Box tests without knowledge of internal code; White-Box tests with full internal knowledge (Correct answer)
Black-Box tests only security; White-Box tests performance

Correct answer: Black-Box tests without knowledge of internal code; White-Box tests with full internal knowledge

Black-Box testing evaluates functionality from the user's perspective without knowing internal code, while White-Box testing uses knowledge of the internal structure to design test cases.

Question 11: What is 'tail-call optimization' (TCO)?

Reusing the current stack frame for a recursive call that is the last action in a function (Correct answer)
Removing the last function in a call chain
Converting loops into recursive functions
Caching the return value of tail-recursive functions

Correct answer: Reusing the current stack frame for a recursive call that is the last action in a function

TCO allows a compiler to reuse the current stack frame when a recursive call is the very last operation, preventing stack overflow in deeply recursive functions.

Question 12: What is continuous integration in software development?

Using the same code for every update
Automatic code integration and testing (Correct answer)
Manual testing after every update
Rewriting the code frequently

Correct answer: Automatic code integration and testing

Continuous Integration (CI) is a software development practice where developers frequently merge their code changes into a central repository, often multiple times a day. Each integration is then verified by an automated build and automated tests. This practice aims to detect integration errors early and quickly, leading to faster development cycles and more reliable software.

Question 13: What does a `.gitignore` file do?

Lists collaborators who cannot push to the repository
Specifies intentionally untracked files that Git should not track or stage (Correct answer)
Defines the default merge strategy for the repository
Stores encrypted credentials for remote repository access

Correct answer: Specifies intentionally untracked files that Git should not track or stage

A .gitignore file contains patterns for files and directories that Git should exclude from tracking, such as build artifacts, logs, and secrets.

Question 14: In risk management, which term describes the potential damage or loss resulting from a threat exploiting a vulnerability?

Exposure
Likelihood
Threat Vector
Impact (Correct answer)

Correct answer: Impact

Impact refers to the magnitude of harm — financial, operational, or reputational — that would result if a threat successfully exploits a vulnerability.

Question 15: What is a 'honeypot' used for in network security?

Decoy systems designed to attract and detect attackers (Correct answer)
Filtering malicious traffic at the network perimeter
Storing encrypted backup copies of sensitive files
Hashing passwords before storing them

Correct answer: Decoy systems designed to attract and detect attackers

A honeypot is a decoy system intentionally made to look attractive to attackers, allowing defenders to observe and study attack techniques.

Question 16: What is a deadlock in a database context?

Two or more transactions each waiting for the other to release a lock (Correct answer)
A query that returns no results
A table that has exceeded its maximum row count
An index that can no longer be updated

Correct answer: Two or more transactions each waiting for the other to release a lock

A deadlock occurs when two or more transactions are mutually blocking each other, each waiting for a lock held by the other to be released.

Question 17: What is an array in programming?

A function
A type of loop
A single value
A collection of values (Correct answer)

Correct answer: A collection of values

An array in programming is a data structure used to store a fixed-size, sequential collection of elements, typically of the same data type. It allows programmers to group multiple related values under a single variable name, making it easier to manage and access them using an index. Arrays are fundamental for organizing data and performing operations on multiple items efficiently.

Question 18: In data analytics, what is 'feature engineering'?

Creating or transforming input variables to improve model performance (Correct answer)
Removing irrelevant columns from a DataFrame
Selecting which database engine to use
Normalizing the target variable

Correct answer: Creating or transforming input variables to improve model performance

Feature engineering involves creating new variables or transforming existing ones (e.g., extracting month from a date) to provide more useful information to a model.

Question 19: In Agile methodology, what is the primary purpose of a 'Definition of Done' (DoD)?

To document bugs found during testing
To assign tasks to team members
To establish a shared understanding of when a work item is complete (Correct answer)
To list features planned for the next sprint

Correct answer: To establish a shared understanding of when a work item is complete

The Definition of Done is a shared checklist that specifies the criteria every work item must meet before it can be considered complete.

Question 20: What does a 'linter' primarily do?

Analyzes code for stylistic issues, potential bugs, and standards violations (Correct answer)
Measures test execution time
Compiles source code to machine code
Manages software dependencies

Correct answer: Analyzes code for stylistic issues, potential bugs, and standards violations

A linter statically analyzes source code to flag errors, style violations, and suspicious patterns without executing the program.

Question 21: What is technical debt in a software project?

The implied future rework caused by choosing a quick solution over a better long-term approach (Correct answer)
Money owed to technology vendors
The cost of hardware purchased for the project
Unspent budget allocated for technical resources

Correct answer: The implied future rework caused by choosing a quick solution over a better long-term approach

Technical debt accumulates when shortcuts are taken in code or design, creating future maintenance burdens that must eventually be addressed.

Question 22: A cloud application experiences intermittent 503 errors when traffic spikes suddenly. Which architectural change BEST addresses this?

Increase the database connection timeout
Use a larger single instance instead of multiple smaller ones
Add autoscaling policies tied to CPU or request metrics (Correct answer)
Switch from HTTPS to HTTP to reduce overhead

Correct answer: Add autoscaling policies tied to CPU or request metrics

Autoscaling automatically adds capacity during traffic spikes, preventing resource exhaustion and 503 Service Unavailable errors.

Question 23: What is a variable in programming?

A function
A data type
A container for storing data (Correct answer)
A memory address

Correct answer: A container for storing data

In programming, a variable is essentially a named storage location in memory that holds a value. It acts as a container where data can be stored, retrieved, and manipulated throughout the execution of a program. Variables are fundamental because they allow programs to work with dynamic data, making code flexible and capable of processing different inputs.

Question 24: What is multi-factor authentication in CPA security?

A data encryption method
Same password for multiple accounts
A firewall type
Requiring two or more verification factors for access (Correct answer)

Correct answer: Requiring two or more verification factors for access

MFA requires multiple verification factors (knowledge, possession, biometrics), significantly reducing unauthorized access.

Question 25: What is scope creep in CPA project management?

Uncontrolled scope expansion without adjusting time, cost, or resources (Correct answer)
Reducing deliverables
Natural planned growth
Incremental feature addition technique

Correct answer: Uncontrolled scope expansion without adjusting time, cost, or resources

Scope creep adds requirements without formal evaluation, causing schedule delays and budget overruns.

Question 26: In a CI/CD pipeline, what is the purpose of the 'CD' (Continuous Delivery) stage?

To write test cases for new features
To back up the source code repository
To assign code reviews to team members
To automatically prepare every successful build for potential release to production (Correct answer)

Correct answer: To automatically prepare every successful build for potential release to production

Continuous Delivery ensures every passing build is automatically packaged and released to a staging environment, making it ready for deployment to production at any time.

Question 27: In cloud cost optimization, what is the trade-off when using Spot/Preemptible instances instead of On-Demand instances?

No SLA but guaranteed 99.9% uptime
Higher cost but faster boot times
Significant cost savings but instances can be reclaimed by the provider with short notice (Correct answer)
Lower performance but higher availability

Correct answer: Significant cost savings but instances can be reclaimed by the provider with short notice

Spot/Preemptible instances offer up to 90% cost savings over on-demand pricing but can be interrupted by the cloud provider when capacity is needed.

Question 28: What is 'deadlock' in operating systems?

A file-system corruption state
A program that loops forever without using CPU
Memory that cannot be freed by garbage collection
A condition where two or more processes wait indefinitely for resources held by each other (Correct answer)

Correct answer: A condition where two or more processes wait indefinitely for resources held by each other

Deadlock is a state where a set of processes are permanently blocked because each is waiting for a resource held by another process in the set.

Question 29: Which protocol is responsible for automatically assigning IP addresses to devices on a network?

DNS
DHCP (Correct answer)
SNMP
OSPF

Correct answer: DHCP

DHCP (Dynamic Host Configuration Protocol) dynamically assigns IP addresses, subnet masks, gateways, and DNS servers to network clients.

Question 30: Which normal form eliminates transitive dependencies?

First Normal Form (1NF)
Third Normal Form (3NF) (Correct answer)
Second Normal Form (2NF)
Boyce-Codd Normal Form (BCNF)

Correct answer: Third Normal Form (3NF)

3NF requires that every non-key attribute depend only on the primary key, eliminating transitive dependencies between non-key columns.

Question 31: What is a database schema?

The logical structure defining tables, columns, relationships, and constraints (Correct answer)
A backup copy of the database
The physical storage format of database files on disk
The set of user accounts and permissions in a database

Correct answer: The logical structure defining tables, columns, relationships, and constraints

A schema is the logical blueprint of a database, describing the structure of tables, data types, relationships, and constraints without containing actual data.

Question 32: Which SOLID principle states that a class should have only one reason to change?

Liskov Substitution Principle
Single Responsibility Principle (Correct answer)
Interface Segregation Principle
Open/Closed Principle

Correct answer: Single Responsibility Principle

The Single Responsibility Principle (SRP) states that a class should have only one responsibility and therefore only one reason to change.

Question 33: In Git, what does the `git pull` command do?

Creates a new branch from the remote
Reverts the last local commit
Fetches remote changes and merges them into the current local branch (Correct answer)
Pushes local commits to the remote

Correct answer: Fetches remote changes and merges them into the current local branch

git pull is a combination of git fetch (downloading remote changes) and git merge (integrating them into the local branch).

Question 34: In big-O notation, which complexity grows most slowly as input size increases?

O(n)
O(n log n)
O(n²)
O(log n) (Correct answer)

Correct answer: O(log n)

O(log n) grows much more slowly than linear O(n) time, making logarithmic algorithms highly efficient for large inputs.

Question 35: Which HTTP status code indicates a successful request?

404
301
200 (Correct answer)
500

Correct answer: 200

HTTP status code 200 (OK) indicates that the request was successful and the server returned the requested resource.

Question 36: What is the purpose of debugging in programming?

To deploy the code
To identify and fix errors in the code (Correct answer)
To test code
To improve performance

Correct answer: To identify and fix errors in the code

The purpose of debugging in programming is to systematically identify, analyze, and fix errors or 'bugs' within a computer program. When code doesn't behave as intended, developers use debugging tools and techniques to trace execution, inspect variables, and pinpoint the exact cause of the problem. This process ensures the software functions correctly and reliably.

Question 37: In software architecture, what is a 'facade'?

A performance profiling tool
A simplified interface over a complex subsystem (Correct answer)
A type of database index
An authentication mechanism

Correct answer: A simplified interface over a complex subsystem

The Facade design pattern provides a simplified, unified interface to a complex set of interfaces or subsystems, reducing client complexity.

Question 38: What does 'regression testing' primarily verify?

New features work correctly
Security vulnerabilities are absent
Previously working functionality has not been broken by recent changes (Correct answer)
Code meets performance benchmarks

Correct answer: Previously working functionality has not been broken by recent changes

Regression testing re-runs existing tests after code changes to confirm that previously working behavior has not been inadvertently broken.

Question 39: What is 'social engineering' in the context of cybersecurity?

Automating patch deployment across systems
Writing secure code using engineering best practices
Manipulating people psychologically to divulge confidential information (Correct answer)
Using software tools to scan for open ports

Correct answer: Manipulating people psychologically to divulge confidential information

Social engineering exploits human psychology rather than technical vulnerabilities to gain unauthorized access or information.

Question 40: What does an INNER JOIN return?

All rows from the left table with NULLs for non-matches
All rows from the right table with NULLs for non-matches
All rows from both tables regardless of match
Only rows where there is a match in both tables (Correct answer)

Correct answer: Only rows where there is a match in both tables

INNER JOIN returns only the rows where the join condition is satisfied in both tables, excluding non-matching rows from either side.

Certified Associate Programmer (CPA) Exam

The Certified Associate Programmer (CPA) certification validates foundational knowledge in programming concepts, data structures, and algorithms, typically focusing on a specific language like Python or C++.

Questions

65 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds