CNCF / Linux Foundation · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
Which TWO of the following are primary benefits of storing immutable state in Git?
Reduction in manual cluster configuration errors
Declarative files in Git replace manual, error-prone configurations.
Faster deployment of hotfixes directly to production
Automated conversion of Docker images to YAML
Ability to audit all environment changes through commit history
Git provides a permanent, immutable ledger of all changes.
Increased server-side storage capacity
You are implementing a GitOps workflow where the desired state is stored in a private repository. The Argo CD controller requires access to this repository. What is the most secure GitOps-compliant way to provide this access?
Grant the cluster node broad read access to all public repositories.
Use an environment variable in the Argo CD container deployment manifest.
Create a Kubernetes Secret containing the SSH key and reference it in the repository configuration.
This method follows the principle of least privilege and keeps credentials out of source control.
Hardcode the credentials in the Application manifest.
In an Argo CD deployment, a developer notices that manual changes made via kubectl are being reverted automatically. What feature is responsible for this behavior?
Git commit hook triggers
Auto-Sync with Self-Heal enabled
Self-heal continuously monitors drift and applies Git state.
Kubernetes admission controllers
Manual refresh button
Your team is using a pull-based GitOps pattern. Which component is responsible for initiating the communication to the Git repository to check for updates?
The developer's local kubectl client.
The agent running inside the Kubernetes cluster.
The agent pulls the desired state, maintaining security and reducing firewall complexity.
The CI/CD pipeline pushes updates to the cluster.
The Git server pushes changes to the cluster webhook.
An organization is migrating to GitOps using Argo CD. During an audit, you notice that manual changes made directly to the Kubernetes cluster via kubectl are being reverted within minutes. Which component of the GitOps pipeline is performing this action?
The cluster ingress controller
The Argo CD API server
The Git webhook listener
The Application Controller
The Application Controller is responsible for the continuous reconciliation loop that detects and corrects drift.
In a GitOps environment, an engineer manually deletes a Deployment via 'kubectl'. What should happen next to maintain the desired state?
The controller detects the drift and automatically restores the Deployment.
Drift detection and automated correction is a core GitOps principle.
The controller ignores the change until the next git commit.
The system issues an alert but does not modify the cluster.
The manual deletion is permanently synced to the Git repository.
Want more Gitops Principles practice?
Practice this domainWhich THREE of the following are core responsibilities of a GitOps operator?
Detecting drift between the cluster state and the Git source
Drift detection is the primary function of the reconciliation loop.
Writing CI/CD build scripts
Executing manual kubectl commands for developers
Applying necessary changes to reconcile the live state with the desired state
The operator applies the delta to bring the cluster back into compliance.
Continuously monitor the declared state in the repository
Monitoring the source is required to detect changes.
When setting up Argo CD, which TWO components are essential to define a GitOps workflow?
Kubernetes Node
AppProject
AppProject is used to logically group applications and enforce security boundaries.
Application CRD
The Application object defines the Git source and the target namespace.
Docker Registry
Jenkins Pipeline
You are troubleshooting a Flux installation. The operator is failing to pull updates from a private GitHub repository. What component is most likely misconfigured?
The Helm chart version
The cluster service account permissions
The Kustomization path
The GitRepository secret
The GitRepository object refers to a secret containing authentication credentials; if missing or incorrect, the operator cannot fetch the repo.
A company transitions from a push-based CI/CD pipeline (using Jenkins) to a pull-based GitOps model (using Flux). What is the primary security architectural change regarding cluster access?
Git is no longer the source of truth
The cluster no longer requires an API server
The operator is now a push-based agent
The CI server no longer requires cluster credentials
Pull-based models allow the agent within the cluster to reconcile state, eliminating the need to expose cluster API credentials to external build systems.
You are auditing your GitOps deployment strategy. Which TWO of the following statements correctly describe the 'Source of Truth' in a GitOps architecture?
The live cluster state is the ultimate source of truth for all configurations
The declared state in the Git repo must match the observed cluster state
This synchronization is the core goal of the GitOps model.
The Git repository acts as the single source of truth for both infrastructure and applications
GitOps mandates that the repository contains the declared state of the entire system.
Database backups constitute the primary source of truth
Continuous Integration artifacts are the source of truth
What is the primary benefit of a 'pull' deployment model compared to a 'push' model in GitOps?
Support for non-Kubernetes platforms
Elimination of Kubernetes manifests
Reduced need for inbound firewall access to the cluster
The operator initiates outbound connections, making the cluster more secure.
Faster application builds
Want more Gitops Terminology practice?
Practice this domainYou are configuring Flux to manage a multi-tenant cluster. You need to ensure that specific namespaces only allow images from an internal registry. Which tool should you use to enforce this at admission time?
ArgoCD Notifications
Kyverno
Kyverno policies can validate image registry sources during admission.
Sealed Secrets
Flux Image Automation Controller
You are using ArgoCD and need to ensure that secret values stored in Git via Sealed Secrets are decrypted only within the target cluster. What component performs the actual decryption of a SealedSecret resource?
GitOps CLI (kubeseal)
Kubernetes API Server
ArgoCD Application controller
Sealed Secrets controller
The controller uses the private key stored in the cluster to decrypt secrets.
You are using OPA Gatekeeper with GitOps. You want to prevent any deployment that does not have an 'owner' label. Where should this policy be applied to ensure it is enforced for all GitOps-driven changes?
Git pre-receive hook
Flux Source Controller
Validating Admission Webhook
This ensures every request is checked against policies.
ArgoCD AppProject
When migrating from ArgoCD to Flux, you want to replicate the 'Sync Waves' behavior. Which Flux feature provides equivalent control over the order of resource reconciliation?
Post-sync hooks
dependsOn
The dependsOn field allows defining the order of reconciliation for Kustomizations.
Sync waves
Reconciliation intervals
Which GitOps tool relies primarily on a pull-based model utilizing the 'Source Controller' and 'Kustomization' custom resources?
Flux
Flux is defined by these core controllers.
ArgoCD
Terraform
Helm
Your organization requires that all Kubernetes manifest changes be signed and encrypted before being pushed to Git. Which tool is primarily designed for this 'at-rest' encryption approach?
Kyverno
Mozilla SOPS
SOPS supports file-level encryption for various formats including YAML.
Sealed Secrets
HashiCorp Vault
Want more Tooling practice?
Practice this domainYou are implementing progressive delivery using Flagger. After a Canary resource is defined, which metric is most critical for Flagger to automatically rollback a deployment during a blue/green shift?
Pod CPU usage
Number of running replicas
Request success rate and latency metrics
Flagger specifically monitors service mesh or ingress metrics to decide if a traffic shift is safe.
Git commit hash parity
In a multi-cluster GitOps architecture using Argo CD, how do you manage credentials for a remote cluster that is not the cluster where Argo CD resides?
Modify the global ConfigMap in the Argo CD namespace
Add the cluster URL to the Git repository manifest
Use the argocd cluster add command to store credentials as a secret in the Argo CD namespace
This is the standard, secure way to register a remote cluster for GitOps management.
Manually create a Kubernetes secret in the remote cluster
Your organization uses the App-of-Apps pattern in Argo CD to manage hundreds of microservices. You need to ensure that when a developer updates a repository structure, the root application automatically discovers and syncs new child applications without manual intervention. Which feature should be enabled in the Application resource?
Use the 'ignoreDifferences' field for the child application manifests
Enable automated sync policy with self-healing and allow-empty
Self-healing ensures the live state matches the desired state defined in Git, while automatic sync ensures new directories are picked up.
Set the sync policy to 'manual' and use a post-sync hook
Configure a manual webhook trigger on the root application
In a blue-green progressive delivery deployment using Flagger, you notice that the 'primary' service is not receiving traffic even after the analysis successfully completes. What is the most likely cause?
The analysis template lacks the 'weight' parameter
The Flagger controller is in 'paused' mode
The VirtualService or HTTPRoute is not pointing to the primary service
If the traffic router is not updated to point to the primary service, traffic remains on the canary or old version.
The canary resource is missing a 'host' definition
You are deploying applications across multiple clusters using Argo CD. You want to implement a hub-and-spoke model where the central management cluster controls all edge clusters. Which THREE of the following are necessary to correctly configure this pattern?
Install Argo CD control plane components on every edge cluster
Configure the 'server.enable.proxy' flag in the hub cluster
Ensure the service account for Argo CD has cluster-admin permissions on target clusters
The hub cluster must have sufficient RBAC permissions to manipulate resources on the spokes.
Define Application projects to restrict cluster access
Projects are essential to restrict which clusters an application can target.
Create Argo CD cluster secrets in the management cluster namespace
Argo CD identifies target clusters via secrets stored in the namespace where the controller runs.
When promoting an application from staging to production using the 'GitOps directory' pattern, what is the most robust way to ensure environment-specific configurations are applied correctly?
Using Kustomize overlays for each environment
Overlays are the standard GitOps pattern for maintaining environment-specific differences from a common base.
Hardcoding environment names inside the main deployment file
Dynamic shell scripting in the CI pipeline
multiple_choice
Copy-pasting YAML files across folders
Want more Gitops Patterns practice?
Practice this domainWhy is 'Git' considered the 'source of truth' in GitOps?
Because it acts as the single point of record for the desired system state.
Git holds the manifests that define what the system should look like.
Because Git stores all application logs.
Because it is the only tool that supports branching.
Because Git automatically runs the applications.
In a GitOps environment, what is the main purpose of maintaining Infrastructure as Code?
To avoid using cloud provider dashboards.
To generate cost reports for the finance department.
To ensure that infrastructure can be defined, tracked, and automatically reconciled from Git.
IaC provides the declarative foundation necessary for GitOps.
To allow developers to log into servers and make changes.
Your organization wants to implement DevSecOps by integrating security scanning into a GitOps pipeline. Where should the vulnerability scan happen to prevent insecure configurations from ever reaching the cluster?
Only when an auditor requests a security report.
By running an automated script to delete pods that fail a security check.
During the CI phase, scanning the Kubernetes manifests for security misconfigurations before merging.
Scanning manifests in the CI pipeline allows for blocking insecure PRs before they are merged to main.
As a post-deployment check using a Kubernetes admission controller.
A company uses Terraform for IaC and Argo CD for application delivery. How should they manage the dependency between infrastructure provisioning and app deployment to ensure GitOps consistency?
Use Crossplane to represent infrastructure as Kubernetes objects, managing both IaC and apps via GitOps.
Crossplane extends the GitOps pattern to infrastructure, ensuring the state is reconciled by an operator.
Execute Terraform via a CI job that triggers Argo CD after completion.
Manually trigger Terraform runs before pushing new app manifests to Git.
Embed Terraform binary execution within a K8s deployment container.
When mapping a traditional CI/CD pipeline to GitOps, what is the primary role of the CD tool?
Reconciling the running state of the cluster with the declarative state defined in Git.
The GitOps operator continuously monitors Git and applies changes to match the desired state.
Pushing binary artifacts to a server via SSH.
Pushing images to a container registry after a build.
Generating test reports for the QA team.
You are debugging a drift in a GitOps environment. The cluster state differs from the Git repository. What is the most likely cause if you are using Flux?
The container registry is unreachable during a new image rollout.
The Git repository contains syntax errors in the YAML files.
A user performed a manual 'kubectl' command to modify a deployment.
Manual changes bypass Git, causing the cluster state to deviate from the desired state defined in Git.
The CI pipeline failed to run tests.
Want more Related Practices practice?
Practice this domainThe CGOA exam is performance-based — there are no multiple-choice questions. It is a hands-on lab exam completed within 120 minutes. You complete practical tasks in a live or simulated environment. Courseiva practice questions cover the underlying concepts.
Hands-on labs and command-line tasks in a live Kubernetes cluster.
The exam covers 5 domains: Gitops Principles, Gitops Terminology, Tooling, Gitops Patterns, Related Practices. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official CNCF / Linux Foundation CGOA exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.