CGOA Practice Test 16 — 15 Questions

Question 1

Which THREE of the following are effective ways to handle 'Configuration Drift' in a GitOps environment? (Select three)

Accepted Answer

Use Admission Controllers to block manual modifications.. Option A is correct because Admission Controllers (e.g., Kubernetes ValidatingAdmissionWebhooks or OPA Gatekeeper) can reject or mutate any manual kubectl apply/patch that diverges from the desired state declared in Git, preventing drift at the API-server level before it is persisted. Option B is correct because GitOps operators such as Argo CD or Flux expose an OutOfSync status (Argo CD's Application.status.sync.status or Flux's Ready/Reconciling conditions) that can be surfaced via dashboards (Grafana) or alerts (Prometheus Alertmanager), giving operators early detection of drift. Option E is correct because enabling automated sync with self-healing (Argo CD's syncPolicy.automated.selfHeal: true or Flux's reconciliation interval) makes the operator continuously reconcile the live cluster back to the Git-declared state, automatically reverting drift. Option C is not appropriate because deleting and recreating the cluster daily is a disruptive, heavyweight operation that does not address the root cause of drift and is not a GitOps reconciliation mechanism. Option D is not appropriate because manual hourly syncing is a reactive, error-prone human process that contradicts GitOps principles of continuous automated reconciliation and does not prevent drift between syncs.

Answer

Deleting the cluster and recreating it daily.

Answer

Manual syncing every hour to fix issues.

Question 2

Which TWO of the following are essential when using Helm in a GitOps workflow? (Select two)

Accepted Answer

Defining environment-specific overrides in values files.. Option B is correct because a GitOps workflow requires declarative, environment-specific configuration to be version-controlled; defining environment-specific overrides in values files (e.g., values-dev.yaml, values-prod.yaml) lets the same chart be deployed consistently across environments while keeping differences explicit and reviewable in Git. Option E is correct because GitOps fundamentally relies on Git as the single source of truth, so the Helm chart and its values must be stored in a Git repository to enable declarative, auditable, and automated reconciliation by tools like Argo CD or Flux. Option A is wrong because ignoring chart dependencies would break deployments that rely on subcharts or dependency resolution via Chart.yaml and requirements, which Helm needs to render manifests correctly. Option C is wrong because Helm is a client-side CLI (or handled by the GitOps controller), not something that must be installed on every cluster node. Option D is wrong because always using the 'latest' chart version undermines reproducibility and pinning, which are essential for reliable GitOps deployments.

Answer

Ignoring the chart dependencies.

Answer

Installing Helm manually on every node in the cluster.

Answer

Always using the 'latest' version of the chart.

Question 3

An application is configured with 'Automated Sync'. What happens when a developer merges a change to the main branch?

Accepted Answer

The operator pulls the new state and updates the cluster. With Automated Sync enabled, the GitOps operator continuously reconciles the desired state in Git with the live cluster state. When a developer merges a change to the main branch, the operator detects the new commit during its next reconciliation cycle, pulls the updated manifests, and applies them to the cluster automatically. This is the core value proposition of GitOps: merge to deploy, with no manual intervention required.

Answer

The operator waits for a manual override

Answer

The operator deletes the application

Answer

The cluster crashes

Question 4

A platform team runs a GitOps operator that continuously reconciles cluster state from a Git repository. A compliance auditor asks how the team can prove which commit produced the configuration currently running in production six weeks ago, after many merges and rollbacks. Which practice best satisfies this requirement?

Accepted Answer

Tag every commit that reaches production and require the operator to record the reconciled commit SHA as an annotation on each managed resource.. Provenance in GitOps comes from making the link between live state and the Git revision explicit and durable. Annotating each reconciled resource with the commit SHA it was rendered from, together with immutable tags, lets anyone inspect a running object and trace it to the exact commit, author, and review. Monitoring alerts, manual application, and log retention support operations but do not answer which commit produced the current configuration.

Answer

Store the operator's reconciliation logs in a central log platform with a twelve-month retention policy.

Answer

Require all changes to production to be applied manually with kubectl after a four-eyes review in the change advisory board.

Answer

Enable drift detection alerts so any divergence between Git and the cluster is reported to the team's chat channel.

Question 5

Which GitOps tool relies primarily on a pull-based model utilizing the 'Source Controller' and 'Kustomization' custom resources?

Accepted Answer

Flux. Flux is a GitOps tool that uses a pull-based model where the Source Controller and Kustomization custom resources are core components. The Source Controller fetches manifests from Git repositories, and Kustomization resources define how to apply those manifests to the cluster. This architecture enables continuous reconciliation of the desired state from Git.

Answer

ArgoCD

Answer

Terraform

Answer

Helm

Question 6

When configuring an App-of-Apps pattern, which field in the 'Application' manifest controls the order in which child applications are deployed?

Accepted Answer

argocd.argoproj.io/sync-wave. In the App-of-Apps pattern, the argocd.argoproj.io/sync-wave annotation on each child Application controls the order in which Argo CD applies them. Argo CD processes resources in ascending wave order (negative waves first, then zero, then positive), waiting for each wave to become healthy before proceeding to the next, which lets you sequence dependencies such as CRDs before the operators that use them.

Answer

spec.project

Answer

spec.syncPolicy.automated.prune

Answer

spec.source.targetRevision

Question 7

Which TWO of the following are primary benefits of adopting a GitOps 'Pull' model compared to a 'Push' model? (Choose two)

Accepted Answer

It improves security by removing the need for long-lived cluster credentials in external CI systems.. Option B is correct because in a GitOps Pull model an in-cluster agent (e.g., Argo CD or Flux) reconciles the desired state from Git, so external CI systems no longer need long-lived cluster credentials such as kubeconfig files or service account tokens to push changes into the cluster. Option D is correct because the same in-cluster agent initiates outbound connections to Git and the cluster API stays internal, so the Kubernetes API server does not need to be exposed to external CI/CD tools, shrinking the attack surface. The unmarked options do not belong: A is false because Pull-based GitOps typically adds components (the reconciler/agent) and can make initial setup more involved, not simpler; C is false because GitOps does not inherently reduce the number of containers running in the cluster and usually adds the agent's own pods; and E is false because GitOps reconciles Git to the cluster, not the reverse, so manual cluster changes are reverted rather than automatically committed back to Git.

Answer

It simplifies the initial setup of CI/CD pipelines.

Answer

It reduces the total number of containers running in the cluster.

Answer

It ensures that manual cluster changes are automatically committed to the Git repository.

Question 8

How does an operator manage 'Secrets' in a GitOps repository?

Accepted Answer

By using specialized tools or controllers to decrypt secrets at runtime. Because Git repositories are not designed to store plaintext secrets securely, GitOps practitioners use specialized tools — such as Sealed Secrets, SOPS, External Secrets Operator, or Vault integrations — to encrypt secrets at rest in Git and decrypt them at runtime inside the cluster. The encrypted blob is committed to the repo, and a controller decrypts it into a native Kubernetes Secret when syncing. This preserves Git as the source of truth without exposing credentials.

Answer

By disabling secrets entirely

Answer

By storing them as plain text in the repo

Answer

By hardcoding them in the application code

Question 9

Your organization requires an audit trail of all changes to infrastructure. Why is GitOps superior to imperative 'kubectl' commands for this?

Accepted Answer

Git provides a permanent, immutable, and auditable history of who made what change and when.. GitOps uses Git as the single source of truth, so every change is a commit with author, timestamp, and diff. This creates a permanent, immutable, and auditable history of who changed what and when, which imperative kubectl commands do not provide.

Answer

Kubectl allows editing the live state without record.

Answer

Git is faster than kubectl for large clusters.

Answer

The cluster automatically emails admins when kubectl is used.

Question 10

Which TWO of the following help ensure successful multi-cluster GitOps rollouts? (Select two)

Accepted Answer

Using canary deployment phases per cluster group.. Option C is correct because canary deployment phases per cluster group let you roll out changes to a small subset of clusters first, validate health and metrics, and only then promote the change to the remaining groups, which limits blast radius and enables safe progressive delivery. Option D is correct because grouping clusters by geography or environment (for example, dev → staging → prod, or region-by-region) supports staggered rollouts so that failures are detected in lower-risk groups before reaching production or other regions. Option A is wrong because deploying to all clusters simultaneously maximizes blast radius and removes any opportunity to catch a bad change before it affects everything. Option B is wrong because a single Git repository for all cluster configurations is not a requirement for successful multi-cluster GitOps and can create coupling and coordination problems; separate repos or directory structures are common and valid. Option E is wrong because hardcoding cluster IPs in manifests makes configurations brittle and non-portable, breaking the declarative, environment-agnostic nature of GitOps.

Answer

Deploying to all clusters at the same time.

Answer

Using only one Git repository for all cluster configurations.

Answer

Hardcoding cluster IPs in the manifest files.

Question 11

Your team is integrating a CI pipeline with a GitOps delivery model. Which of the following tasks should remain in the CI pipeline, and which should be moved to the CD/GitOps reconciliation process?

Accepted Answer

Container image building and unit testing remain in CI, while manifest deployment to the cluster moves to GitOps.. In a GitOps model, the CI pipeline is responsible for building and testing artifacts (e.g., container images, unit tests), while the CD/GitOps reconciliation process handles deploying those artifacts to the cluster by syncing the desired state from Git. Option C correctly separates these concerns: CI produces immutable artifacts and updates manifests, and GitOps controllers (like Argo CD or Flux) continuously reconcile the cluster to match the Git repository. This division ensures that deployment is declarative, auditable, and automated without direct CI access to the cluster.

Answer

Everything, including image building and deployment, must be handled by the GitOps controller.

Answer

The CI pipeline should perform the final deployment to ensure the pipeline status is correctly reported.

Answer

Container image building moves to GitOps, while manifest deployment remains in the CI pipeline.

Question 12

Which TWO practices are recommended when managing Git repositories for GitOps?

Accepted Answer

Using directory structures to separate environmental configurations.. Option A is correct because using directory structures to separate environmental configurations (e.g., overlays/dev, overlays/prod or clusters/<env>) keeps each environment's desired state isolated and reviewable, which is a core GitOps practice for promoting changes safely across environments. Option B is correct because structuring manifests logically (grouping by app, namespace, or Kustomize base/overlay) improves readability, maintainability, and code review, making the Git repository a reliable source of truth for GitOps reconciliation. Option C is wrong because hardcoding credentials in manifests exposes secrets in Git history and violates GitOps security practices; secrets should be managed via Sealed Secrets, SOPS, or an external secret store. Option D is wrong because committing direct changes to 'main' bypasses pull-request review and CI validation, undermining the auditable, declarative workflow GitOps depends on. Option E is wrong because storing all environments in a single file couples dev and prod, making it impossible to promote or roll back one environment independently and increasing the blast radius of any change.

Answer

Hardcoding all credentials in the manifest.

Answer

Committing direct changes to the 'main' branch.

Answer

Storing all environments (dev/prod) in a single file.

Question 13

Which TWO of the following are common reasons for a deployment to be marked as 'Degraded' by Argo CD? (Select two)

Accepted Answer

The health checks defined for the application are failing.. Option B is correct because Argo CD's health assessment for an Application relies on the resource health checks (built-in Lua checks or custom health checks) defined for the resource kinds; when those checks fail, the Application's health status is reported as Degraded. Option E is correct because a pod stuck in CrashLoopBackOff is evaluated by Argo CD's built-in health check for Pods/Deployments as unhealthy, which propagates to the Application as Degraded. Option A is not a health condition Argo CD evaluates — a manual label change typically shows up as OutOfSync (a sync status), not Degraded. Option C is wrong because controller overload affects reconciliation performance and may delay status updates, but it is not itself a health state reported as Degraded. Option D is wrong because Git repository unavailability causes sync/refresh errors (e.g., ComparisonError or Unknown sync status), not a Degraded health assessment.

Answer

The user manually changed a label.

Answer

The Argo CD controller is overloaded.

Answer

The Git repository is temporarily offline.

Question 14

In a large enterprise, why is GitOps preferred for multi-cluster environments?

Accepted Answer

It allows a single source of truth to manage configuration consistency across all clusters.. GitOps uses a single Git repository as the source of truth for all cluster configurations, enabling consistent, version-controlled management across many clusters. This ensures configuration consistency and simplifies multi-cluster operations.

Answer

It enables developers to bypass security controls in dev clusters.

Answer

It automatically scales the nodes in all clusters.

Answer

It eliminates the need for any monitoring tools.

Question 15

What is the primary function of a 'GitOps Pipeline' versus a 'GitOps Controller'?

Accepted Answer

The pipeline prepares the artifacts, while the controller reconciles the state.. The primary function of a GitOps Pipeline is to prepare and update artifacts (e.g., build images, update manifests) and commit them to Git, while a GitOps Controller continuously reconciles the desired state from Git with the actual state in the cluster. Thus, the pipeline handles artifact preparation, and the controller ensures the cluster matches Git.

Answer

The pipeline manages the Git state directly.

Answer

They are the same thing.

Answer

The controller builds the images.