CGOA Practice Test 14 — 15 Questions

Question 1

When should you use Kustomize in a GitOps workflow?

Accepted Answer

To manage environment-specific overrides in a declarative way.. Kustomize is a declarative configuration customization tool that overlays environment-specific patches (replicas, image tags, resource limits, namespace) on top of a shared base without templating. In GitOps it is the standard way to keep one base and produce dev/staging/prod variants.

Answer

To build container images.

Answer

To delete all namespaces.

Answer

To perform load testing on the cluster.

Question 2

Which of the following actions best aligns with the GitOps principle of 'Automated Pull-Based Reconciliation'?

Accepted Answer

A cluster-resident controller actively pulling manifests from a Git repository. Automated pull-based reconciliation means a controller running inside the cluster continuously pulls the desired state from Git and reconciles the live state to match, without external push. A cluster-resident controller pulling manifests from Git is the textbook definition of this principle.

Answer

A developer manually running Helm upgrade in the production environment

Answer

Using a Git hook to trigger an SSH deployment script on a remote server

Answer

Jenkins triggers a 'kubectl apply' command to push changes from the CI server

Question 3

When setting up a multi-cluster GitOps pattern, what is the benefit of using 'Cluster Labels' in ApplicationSets?

Accepted Answer

It allows dynamic targeting of clusters based on attributes.. Cluster Labels in ApplicationSets allow you to select target clusters based on label selectors. This enables dynamic generation of Applications for clusters that match specific attributes, such as environment, region, or team, without hardcoding cluster names.

Answer

It increases the speed of the Git clone.

Answer

It reduces the number of namespaces required.

Answer

It encrypts the communication between clusters.

Question 4

You are debugging a flux-system reconciliation loop. You notice the Kustomization is stuck in 'Retrying'. What command shows the current status and reason for the failure?

Accepted Answer

flux get kustomizations. `flux get kustomizations` is the canonical Flux CLI command that lists every Kustomization with its READY state, STATUS message, and last-applied revision, and when a Kustomization is stuck in 'Retrying' the STATUS column shows the exact error (e.g., a failed apply, a missing dependency, or a source-not-ready condition). It queries the Flux CRDs directly and is the fastest way to see the reconciliation reason without digging into controller logs.

Answer

flux logs

Answer

kubectl describe kustomization

Answer

flux wait

Question 5

When implementing a GitOps workflow with Argo CD, what is the role of the 'AppProject' custom resource?

Accepted Answer

It enforces security boundaries and scope for a set of applications. The AppProject custom resource in Argo CD is a logical grouping of applications that defines security boundaries and scope. It restricts which Git repositories, Kubernetes clusters, and namespaces an application can deploy to, and can enforce RBAC and sync policies. This makes it the primary multi-tenancy and governance mechanism in Argo CD.

Answer

It automatically triggers infrastructure rollbacks upon failure

Answer

It defines the build pipeline for container images

Answer

It stores the Git credentials for the entire cluster

Question 6

Which TWO benefits does GitOps provide for team collaboration?

Accepted Answer

Providing a transparent, versioned history of infrastructure changes.. Option C is correct because GitOps stores the desired state of infrastructure as declarative configuration in a Git repository, so every change is committed with an author, timestamp, and diff, giving the whole team a transparent, versioned audit trail that can be inspected, reverted, or compared across branches and tags. Option E is correct because GitOps workflows route all changes through Git, so modifications are proposed as branches and merged via Merge Requests (or Pull Requests), enabling peer review, comments, approvals, and CI checks before anything reaches the cluster. The unmarked options do not belong: A is wrong because GitOps still requires communication for design and incident response, B is wrong because GitOps is tool-agnostic and does not mandate any IDE, and D is wrong because GitOps actually increases oversight by requiring reviewed, approved merges rather than unmonitored deployments.

Answer

Removing the need for communication.

Answer

Forcing everyone to use the same IDE.

Answer

Allowing developers to deploy without oversight.

Question 7

In a multi-cluster environment, how does the GitOps principle of 'Declarative Desired State' simplify cluster management?

Accepted Answer

By enabling template-based configuration across identical environments.. Declarative desired state means the entire cluster configuration is expressed as versioned manifests in Git, which can be templated (Helm, Kustomize) and applied consistently across many clusters. This enables identical environments — dev, staging, production, or multiple regions — to be provisioned from the same parameterized source, eliminating configuration drift and manual per-cluster setup. The result is repeatable, auditable, and scalable multi-cluster management.

Answer

By allowing each cluster to define its own unique state manually.

Answer

By requiring a human operator to verify each cluster's state daily.

Answer

By eliminating the need for Git altogether.

Question 8

When using Argo CD, how do you handle applications that require resources to be created in a specific order (e.g., CRDs before Operators)?

Accepted Answer

Use syncWaves annotations.. Argo CD supports sync waves via the argocd.argoproj.io/sync-wave annotation, which lets you assign an integer wave number to each resource. Argo CD applies resources in ascending wave order, waiting for each wave to become healthy before proceeding to the next. This is the canonical way to ensure CRDs are applied before the Operators or custom resources that depend on them.

Answer

Use multiple Git repositories.

Answer

Disable automated sync and run it twice.

Answer

Use a single massive YAML file.

Question 9

What is the primary function of an 'Admission Controller' in a GitOps-based DevSecOps workflow?

Accepted Answer

To validate and enforce policies on cluster resources before they are persisted.. Admission Controllers are Kubernetes API server plugins that intercept requests to create, modify, or delete resources after authentication/authorization but before the object is persisted to etcd. In a GitOps DevSecOps workflow, they enforce policy-as-code (e.g., OPA Gatekeeper, Kyverno) so that only compliant manifests—matching what Git declares—ever reach the cluster. This makes them the enforcement point for security guardrails, not a build or monitoring tool.

Answer

To build container images.

Answer

To monitor application logs for errors.

Answer

To trigger the CI/CD pipeline.

Question 10

In a GitOps workflow, how does an operator handle a situation where a user manually deletes a resource that is defined in Git?

Accepted Answer

It automatically recreates the resource. A GitOps operator continuously reconciles live cluster state against the desired state declared in Git. If a resource defined in Git is manually deleted, the operator detects the drift during its next reconciliation cycle and recreates the resource to match Git. Git remains the authoritative source, so the deletion is treated as unauthorized drift to be corrected.

Answer

It creates an alert and waits for manual intervention

Answer

It updates the Git repository to reflect the deletion

Answer

It blocks all future deployments until a reset occurs

Question 11

A cluster is flagged as 'OutOfSync' in Argo CD. What does this status specifically indicate?

Accepted Answer

The live state in the Kubernetes cluster deviates from the version-controlled manifest.. In Argo CD, 'OutOfSync' specifically means the live resources in the Kubernetes cluster do not match the manifests stored in the Git repository. Argo CD continuously compares the desired state (from Git) against the live state (from the cluster API) and flags any divergence. It says nothing about the health of Git itself or the cluster's resource capacity — those are separate status dimensions.

Answer

The Git repository contains a syntax error in the YAML files.

Answer

The Kubernetes API server is unreachable.

Answer

The cluster has run out of memory or CPU resources.

Question 12

You are comparing GitOps deployment models. Which scenario best describes a 'Pull' deployment model?

Accepted Answer

A Flux controller monitors the Git repository and updates the cluster state internally.. A Pull-based GitOps model is characterised by an in-cluster agent (such as Flux or Argo CD) that continuously monitors the Git repository and pulls the desired state into the cluster, reconciling any differences itself. The Flux controller watching Git and updating cluster state internally is the textbook example of this pattern. The cluster initiates the connection, which improves security because no external system needs cluster credentials.

Answer

A webhook triggers a Jenkins job to build and deploy an application.

Answer

A developer runs a helm upgrade command from their local machine to the cluster.

Answer

A Jenkins CI pipeline executes kubectl apply commands against the production cluster.

Question 13

How do you handle 'Environment-specific' configurations in a GitOps repository?

Accepted Answer

By using overlays or templating tools. Environment-specific configurations in GitOps are best handled with overlays or templating tools such as Kustomize overlays or Helm values files. These allow a single base configuration to be customized per environment (dev, staging, prod) without duplicating manifests, keeping the repository DRY and maintainable while preserving a single source of truth.

Answer

By creating separate branches for each environment

Answer

By having multiple Git repositories per cluster

Answer

By hardcoding the environment in the application

Question 14

In GitOps, what should happen if a configuration file is deleted from the Git repository?

Accepted Answer

The operator deletes the resource from the cluster. In GitOps, Git is the single source of truth for desired state. If a manifest is deleted from Git, the desired state no longer includes that resource, so the operator's reconciliation loop will delete the corresponding resource from the cluster to converge live state with Git. This is the declarative, self-healing behaviour that makes GitOps predictable.

Answer

The operator alerts the admin and stops

Answer

The cluster keeps the resource forever

Answer

The operator ignores the change

Question 15

What does the status 'Healthy' mean in an Argo CD application?

Accepted Answer

The application is running as expected in the cluster. In Argo CD, the 'Healthy' status is a health assessment of the live Kubernetes resources that make up an application. It means that all resources are in a healthy state according to their health checks—for example, Deployments have all replicas available, Pods are Running and Ready, and Services have endpoints. This indicates the application is running as expected in the cluster, not merely that Git is synced or that infrastructure components like network or database backups are in place.

Answer

The network is secure

Answer

The database is fully backed up

Answer

The Git repository is updated