CGOA Practice Test 13 — 15 Questions

Question 1

When utilizing Git as the 'Source of Truth' for a cluster, what happens if the cluster state diverges from Git?

Accepted Answer

The controller detects the drift and reports it as out-of-sync.. In GitOps, Git is the single source of truth, and the reconciliation controller continuously compares the live cluster state against the desired state in Git. When they diverge, the controller marks the Application as OutOfSync and, depending on sync policy, may auto-heal or wait for manual sync. It never silently overwrites Git with cluster state, preserving Git's authority.

Answer

The controller alerts the administrator but takes no action.

Answer

The Git repository is updated to reflect the new cluster state.

Answer

The cluster ignores the Git repository until a new commit is pushed.

Question 2

When using SOPS with Age, which THREE of the following are true regarding key management?

Accepted Answer

Multiple public keys can be added to one SOPS file. Option A is correct because SOPS supports encrypting the data key to multiple recipients, so several Age public keys can be listed in the same SOPS file, allowing any corresponding private key holder to decrypt. Option B is correct because the Age private key is the secret that actually decrypts the file, so it must be stored securely (for example, as a Kubernetes Secret with restricted RBAC) to prevent unauthorized decryption. Option E is correct because Age is an asymmetric encryption scheme: the public key is used to encrypt/wrap the data key, while the matching private key is required for decryption. Option C is incorrect because Age is a standalone, file-based key system and does not require an external KMS such as AWS KMS, GCP KMS, or Azure Key Vault. Option D is incorrect because SOPS with Age supports multiple recipients, so more than one person (or workload) can hold a private key and decrypt the files.

Answer

Age keys require an external KMS

Answer

Only one person can decrypt the files

Question 3

Which THREE of the following are core responsibilities of a GitOps operator?

Accepted Answer

Detecting drift between the cluster state and the Git source. Option A is correct because a GitOps operator's fundamental job is to compare the live cluster state against the desired state stored in Git, thereby detecting configuration drift. Option D is correct because once drift is detected, the operator must apply the necessary changes (for example, via server-side apply or kubectl-equivalent reconciliation) to bring the live state back into alignment with the declared state. Option E is correct because the operator must continuously watch or poll the Git repository so that any commit to the desired state is promptly noticed and acted upon, which is the essence of the pull-based GitOps model. Options B and C are not core responsibilities: writing CI/CD build scripts belongs to the CI pipeline and application teams, not the GitOps operator, and executing manual kubectl commands for developers is an ad-hoc human action that contradicts the automated, declarative reconciliation the operator performs.

Answer

Writing CI/CD build scripts

Answer

Executing manual kubectl commands for developers

Question 4

You are using a 'Pull' based GitOps model (e.g., Flux or Argo CD). Why is it considered more secure than a 'Push' based CI/CD model?

Accepted Answer

It eliminates the need for cluster credentials on the CI server.. In a Pull-based GitOps model, the agent (Flux or Argo CD) runs inside the target cluster and pulls the desired state from Git. The CI system never needs kubeconfig credentials or cluster-admin tokens to push manifests, so a compromise of the CI pipeline cannot be used to directly mutate the cluster. This removes the most dangerous credential exposure path in traditional push-based pipelines.

Answer

It allows faster deployment times.

Answer

It does not require a container registry.

Answer

It is easier to configure with SSH keys.

Question 5

Which THREE of the following are benefits of using a GitOps operator for CD?

Accepted Answer

Continuous synchronization of desired state. Option B is correct because a GitOps operator such as Argo CD or Flux continuously reconciles the live cluster state against the desired state declared in Git, automatically applying changes when the repository is updated. Option C is correct because the operator continuously compares actual versus desired state and surfaces any drift through its status, health, and diff views, giving teams clear visibility into configuration divergence. Option D is correct because the operator runs inside the cluster and pulls manifests directly from Git, so the external CI system no longer needs long-lived cluster credentials to push deployments, reducing the credential attack surface. Option A is not a core benefit of a GitOps operator, since environment creation is typically handled by IaC tooling or platform templates rather than the CD reconciler itself. Option E is incorrect because GitOps operators do not require manual approval on every sync; they are designed for automated reconciliation, with manual gates being optional and configurable.

Answer

Automatic creation of development environments

Answer

Requirement for manual approvals on every sync

Question 6

Which THREE items should be included in your Git repository for a standard GitOps setup?

Accepted Answer

Policy-as-Code files (e.g., OPA policies).. In a standard GitOps setup, the Git repository serves as the single source of truth for the desired state of the system, so it must contain the declarative artifacts that define that state. Option A is correct because Policy-as-Code files such as OPA (Open Policy Agent) policies are declarative guardrails that should be version-controlled and reconciled alongside the rest of the desired state. Option B is correct because templating definitions like Helm charts and Kustomize bases are the reusable, declarative building blocks used to render Kubernetes manifests, and they belong in Git so changes are auditable and reproducible. Option D is correct because Kubernetes manifest files (YAML) are the declarative descriptions of the workloads and resources that GitOps tools such as Argo CD or Flux continuously reconcile against the cluster. Option C is not required for the GitOps repository itself, since application source code is typically built into container images by a CI pipeline and stored in a separate code repository, with only the resulting image reference placed in the GitOps repo. Option E is never included, because committing private keys for the production cluster into Git would expose credentials and violate security best practices; secrets should be managed with a secrets manager or sealed-secrets mechanism instead.

Answer

Application source code files.

Answer

The private keys for the production cluster.

Question 7

Which THREE mechanisms can be used to notify a GitOps controller of a change in Git?

Accepted Answer

Git repository webhooks.. Option B (Git repository webhooks) is correct because a Git host such as GitHub, GitLab, or Bitbucket can send an HTTP POST webhook to the GitOps controller's receiver endpoint whenever a push or merge occurs, triggering immediate reconciliation. Option C (Manual refresh request via CLI/UI) is correct because tools like Argo CD and Flux expose commands such as `argocd app get --refresh` or a UI refresh button that force the controller to re-check Git on demand. Option D (Periodic polling of the Git repository) is correct because GitOps controllers run a reconciliation loop that polls the Git repository at a configured interval (e.g., Argo CD's default 3 minutes or Flux's `--poll-interval`) to detect new commits. Option A is not a notification mechanism to the controller; an SSH push only updates the remote repository and does not itself inform the GitOps controller. Option E is incorrect because a container crash is an unrelated runtime failure and does not signal a Git change to the controller.

Answer

SSH-based push from the local machine.

Answer

Waiting for a container crash.

Question 8

You are implementing GitOps for a legacy application. Why might this be challenging?

Accepted Answer

Legacy applications often lack declarative configuration files.. GitOps depends on declarative, version-controlled manifests that describe the desired state of every resource. Legacy applications are often deployed via imperative scripts, manual console steps, or undocumented procedures, so there is no declarative artifact to put in Git. This forces teams to reverse-engineer and codify the deployment before GitOps can manage it.

Answer

GitOps doesn't support Java applications.

Answer

The cluster API is too slow for legacy apps.

Answer

Git servers cannot store old code.

Question 9

When migrating to GitOps, why is 'Pull' preferred over 'Push' for CD?

Accepted Answer

It removes the need for exposed API server credentials in the CI tool.. In a pull-based GitOps model, an in-cluster agent (e.g., Argo CD or Flux) continuously reconciles the desired state from Git with the live cluster, so the CI system never needs direct, credentialed access to the Kubernetes API server. This removes the need to store high-privilege cluster credentials in the CI tool, shrinking the attack surface and eliminating a common source of credential leakage. The cluster itself initiates the connection, so the API server does not need to be exposed to external CI runners.

Answer

It makes the deployment process faster.

Answer

It eliminates the need for Git.

Answer

It allows developers to push code directly to production.

Question 10

Which THREE principles are foundational to the GitOps model as defined by the CNCF GitOps Working Group?

Accepted Answer

Changes must be automatically pulled and applied. Option C is correct because GitOps requires an automated agent (such as Argo CD or Flux) that continuously pulls the desired state from Git and reconciles it into the cluster, rather than relying on external push-based deployments. Option D is correct because the CNCF GitOps Working Group defines the desired state as versioned and immutable, with Git serving as the single source of truth whose history is preserved. Option E is correct because the entire system must be described declaratively (for example, Kubernetes YAML manifests) so the agent can compare desired versus actual state and converge them. Option A is incorrect because GitOps favors automated reconciliation, not mandatory manual approval for every production deployment. Option B is incorrect because GitOps is fundamentally pull-based, not push-based, so push-based CI/CD pipelines contradict the model.

Answer

Manual approval is required for all production deployments

Answer

Software must be delivered using push-based CI/CD pipelines

Question 11

If a GitOps controller detects that an image tag has been changed in the cluster but not in Git, what does the controller do?

Accepted Answer

Reverts the cluster state to match the Git repository.. In GitOps, the Git repository is the single source of truth. If the GitOps controller detects that the live cluster state differs from the desired state in Git (e.g., an image tag changed in the cluster but not in Git), it will revert the cluster to match Git. This enforces the declarative model and prevents configuration drift.

Answer

Leaves the cluster in the new state.

Answer

Updates the Git repository with the new image tag.

Answer

Prompts the user for approval.

Question 12

What is the purpose of a 'Kustomization' resource in a GitOps workflow?

Accepted Answer

To dynamically customize and patch manifests for different environments. A Kustomization resource (from Kustomize) defines how to customize and patch a set of base Kubernetes manifests for different environments — for example, overlaying a production replica count, image tag, or ConfigMap without duplicating YAML. It specifies resources, patches, name prefixes, and common labels, and is consumed natively by kubectl -k and by Argo CD/Flux. This makes it a core tool for environment-specific configuration in GitOps.

Answer

To perform load testing on the API server

Answer

To provide a secure shell into pods

Answer

To manage database migrations

Question 13

What is the primary benefit of using a 'Git Branch' promotion pattern over a 'Directory-based' promotion pattern?

Accepted Answer

It allows teams to use PRs to review configuration changes for specific environments.. The Git branch promotion pattern maps each environment to its own branch, so promoting a change means opening a pull request from, say, staging to production. This enables peer review, approval workflows, and a clear audit trail of what was promoted and by whom, which is a major governance advantage over directory-based patterns.

Answer

It eliminates the need for CI pipelines.

Answer

It requires less storage space in the Git repository.

Answer

It automatically synchronizes all branches to the cluster simultaneously.

Question 14

When promoting an application from staging to production using the 'GitOps directory' pattern, what is the most robust way to ensure environment-specific configurations are applied correctly?

Accepted Answer

Using Kustomize overlays for each environment. Kustomize overlays are the most robust way to apply environment-specific configurations because they let you define a common base and then layer per-environment patches for staging and production without duplicating the entire manifest. This keeps the GitOps source of truth declarative, reviewable, and free of environment-specific drift, which is exactly what the GitOps directory pattern requires.

Answer

Hardcoding environment names inside the main deployment file

Answer

Dynamic shell scripting in the CI pipeline

Answer

multiple_choice

Answer

Copy-pasting YAML files across folders

Question 15

What is the purpose of a 'Sync Window' in Argo CD?

Accepted Answer

To limit when automated syncs occur. A Sync Window in Argo CD restricts automated syncs to defined time ranges, preventing deployments during sensitive periods such as business hours, change freezes, or peak traffic. It is configured with a schedule (cron-like), duration, and optional time zone, and applies to Applications via selectors.

Answer

To increase the size of the Git repo

Answer

To prevent users from logging in

Answer

To optimize network speed