CGOA Practice Test 17 — 15 Questions

Question 1

In a GitOps architecture, why is it critical that the entire state of the system is declarative?

Accepted Answer

To enable the reconciliation loop to calculate the necessary deltas for convergence. A declarative model lets the reconciliation loop compare the desired state (from Git) with the observed live state and compute the specific deltas needed to converge. Without full declarative specification, the controller could not deterministically derive what to create, update, or delete, making automated convergence impossible. Declarative state is the foundation that makes Git the single source of truth.

Answer

To allow for faster manual scaling of pods

Answer

To ensure that Docker images are automatically rebuilt

Answer

To replace the need for RBAC in the Kubernetes cluster

Question 2

What is the primary risk of a 'Push-based' deployment model compared to 'Pull-based'?

Accepted Answer

It requires the CI system to have broad permissions on the cluster.. In push-based deployment, the CI system must hold credentials with write access to the cluster (kubeconfig or service account token) to apply manifests. That credential is stored in the CI platform and, if compromised, grants an attacker broad cluster permissions. Pull-based models avoid this by having an in-cluster agent fetch from Git with only read access.

Answer

The Git repository is too big.

Answer

It's too slow.

Answer

It makes it impossible to use Git.

Question 3

You are deploying applications across multiple clusters using Argo CD. You want to implement a hub-and-spoke model where the central management cluster controls all edge clusters. Which THREE of the following are necessary to correctly configure this pattern?

Accepted Answer

Ensure the service account for Argo CD has cluster-admin permissions on target clusters. In a hub-and-spoke Argo CD topology, the hub cluster runs the Argo CD control plane and manages remote edge clusters as external targets, so option C is correct because the Argo CD application-controller's service account (or the credential stored in the cluster secret) must have sufficient RBAC—typically cluster-admin or an equivalent scoped role—on each target cluster to create, update, and delete the deployed resources. Option D is correct because Argo CD AppProjects are the mechanism that restricts which clusters (destinations) and namespaces an Application may target, enforcing multi-tenancy and preventing a project from deploying to unauthorized edge clusters. Option E is correct because remote clusters are registered by creating cluster Secrets (labeled argocd.argoproj.io/secret-type: cluster) in the Argo CD namespace on the hub, containing the target server URL and credentials, which is how the hub knows and authenticates to each spoke. Option A is incorrect because installing the Argo CD control plane on every edge cluster describes a distributed/standalone model, not hub-and-spoke, where only the hub runs the control plane. Option B is incorrect because there is no 'server.enable.proxy' flag required for this pattern; remote access is handled through cluster Secrets and the argocd-server/application-controller, not such a flag.

Answer

Install Argo CD control plane components on every edge cluster

Answer

Configure the 'server.enable.proxy' flag in the hub cluster

Question 4

Why would you choose to use 'Kustomize' over 'Helm' in a GitOps workflow?

Accepted Answer

Because it avoids complex templating logic.. Kustomize uses a declarative overlay model with patches and bases rather than a templating language, which avoids the complex logic, conditionals, and whitespace pitfalls of Helm templates. This makes manifests easier to read, review, and validate in a GitOps workflow where the rendered output should be predictable.

Answer

Because Kustomize is the only tool Argo CD supports.

Answer

Because it supports more advanced logic than Helm.

Answer

Because Kustomize requires a server-side component.

Question 5

You have a large ArgoCD installation and want to limit the blast radius. Which feature allows you to restrict which namespaces an application can deploy to?

Accepted Answer

AppProject. AppProject is the ArgoCD custom resource that defines a logical grouping of applications with explicit boundaries: permitted source repositories, permitted destination clusters, and permitted destination namespaces. By setting spec.destinations with a namespace allow-list (or wildcard restrictions), the AppProject enforces that any Application assigned to it can only deploy into those namespaces, directly limiting blast radius. This is the documented mechanism for multi-tenant isolation in ArgoCD.

Answer

ClusterRoleBinding

Answer

Sync policies

Answer

ApplicationSet

Question 6

In a GitOps environment, what is the 'Reconciliation Loop' primarily responsible for?

Accepted Answer

Continuously ensuring the cluster state matches the Git repository. The Reconciliation Loop is the core control mechanism in GitOps that continuously compares the desired state declared in Git with the actual live state of the Kubernetes cluster. When a difference (drift) is detected, the loop applies the necessary changes to bring the cluster back into alignment with Git, which is the single source of truth. This continuous, automated convergence is what makes GitOps declarative and self-healing rather than a one-time push deployment.

Answer

Running unit tests on application code

Answer

Generating new Kubernetes manifests

Answer

Managing user authentication for the Git provider

Question 7

How does the GitOps pattern simplify the audit process for a regulatory environment?

Accepted Answer

It provides a clear audit trail in Git by linking every state change to a commit and a user.. GitOps simplifies audits because every change to the system is made via a Git commit, which records who made the change, when, and what exactly changed. This creates an immutable, traceable audit trail that can be reviewed and verified, satisfying regulatory requirements for change control and accountability.

Answer

It moves all audit logs to the cluster memory.

Answer

It requires manual documentation of every change.

Answer

It removes the need for logs.

Question 8

When implementing a CI/CD pipeline for GitOps, how should you handle image tag updates?

Accepted Answer

Using an automated agent that detects new images and commits the tag change back to the Git repo.. In GitOps, Git is the single source of truth for declarative infrastructure and application state. An automated agent (such as Argo CD Image Updater or Flux's image-reflector/image-automation controllers) watches the container registry for new image digests/tags, then writes the updated tag back into the Git manifest and commits it. The CD operator then reconciles the cluster to match the newly committed state, preserving the audit trail and rollback capability that GitOps requires.

Answer

Having the CD operator pull the 'latest' tag directly from the registry.

Answer

Manually updating the YAML file with the new image tag and committing to Git.

Answer

Triggering a shell script to update the cluster state directly from the CI pipeline.

Question 9

Your organization uses a 'GitOps Operator' to manage deployments. What happens if a developer manually changes a configuration on the Kubernetes cluster using 'kubectl edit'?

Accepted Answer

The GitOps operator will detect the drift and revert the manual change to match the configuration in Git.. A GitOps operator continuously compares the desired state in Git with the live cluster state and reconciles any drift. When a developer uses 'kubectl edit' to change a resource, the operator detects the divergence on its next sync loop and reverts the resource to match Git, restoring the declared state. This self-healing behaviour is a core GitOps guarantee.

Answer

The GitOps operator will enter a 'halt' state and require manual intervention to synchronize.

Answer

The GitOps operator will trigger an alert, but the manual change will remain in place until the next deployment.

Answer

The GitOps operator will automatically update the Git repository to reflect the manual change.

Question 10

You are using Flux and want to pause reconciliation for a specific application without deleting the resource. Which field should you modify?

Accepted Answer

suspend: true. Flux CRDs such as GitRepository, Kustomization, and HelmRelease expose a 'suspend' boolean field. Setting spec.suspend: true tells the controller to stop reconciling that object without deleting it, so the last-applied state remains in the cluster. Removing the field (or setting it to false) resumes reconciliation.

Answer

interval: 0

Answer

reconcile: false

Answer

pause: true

Question 11

A platform engineer wants to configure an application state declaratively. They write an imperative script containing commands like 'kubectl scale deployment --replicas=5' and push this script into a Git repository for execution by a cron job. Why does this approach fail to satisfy the core GitOps principle of 'Declarative Desired State'?

Accepted Answer

The state is defined as a series of execution steps rather than a static description of the target system configuration.. The core GitOps principle of 'Declarative Desired State' requires that the system's target configuration be described as a static, declarative specification (e.g., YAML manifests) rather than a series of imperative commands. An imperative script like 'kubectl scale deployment --replicas=5' defines actions to execute, not the desired end state, so it fails to satisfy this principle.

Answer

GitOps tools only support JSON files and reject any YAML or shell-based configurations.

Answer

Cron jobs running in Kubernetes cannot execute kubectl commands against the internal API server.

Answer

Imperative scripts cannot be stored in Git repositories due to file permission limitations.

Question 12

Which of the following describes the 'Declarative' aspect of GitOps?

Accepted Answer

Defining the desired state in a YAML file.. Declarative configuration means you describe the desired end state (what the system should look like) rather than the steps to reach it (how to get there). Defining the desired state in a YAML manifest — e.g., a Deployment with replicas: 3 — is the canonical declarative approach in GitOps, and the controller continuously reconciles actual state to match it.

Answer

Manually clicking buttons in a UI to scale a service.

Answer

Creating a list of commands to run in order.

Answer

Writing a shell script to upgrade a deployment.

Question 13

In a GitOps environment, what is the main purpose of maintaining Infrastructure as Code?

Accepted Answer

To ensure that infrastructure can be defined, tracked, and automatically reconciled from Git.. In a GitOps environment, Infrastructure as Code exists so that infrastructure is declared in version-controlled files, tracked through Git history, and automatically reconciled by a controller to match the declared state. This makes infrastructure reproducible, auditable, and self-healing, which is the foundation of the GitOps operating model.

Answer

To avoid using cloud provider dashboards.

Answer

To generate cost reports for the finance department.

Answer

To allow developers to log into servers and make changes.

Question 14

Which THREE of the following are essential tasks when implementing SOPS with GitOps?

Accepted Answer

Configuring the KMS or local key (e.g., Age). Option C is correct because SOPS needs a key source to encrypt/decrypt data: either a cloud KMS (AWS KMS, GCP KMS, Azure Key Vault) or a local key such as an Age keypair, and this must be configured before any SOPS operation works. Option D is correct because in a GitOps flow the cluster-side controller (e.g., Flux's kustomize-controller or Argo CD) must be able to decrypt at apply time, so the private key (Age identity or KMS credentials) has to be mounted into the cluster as a Secret. Option E is correct because the .sops.yaml file defines the creation rules that map file paths to the KMS keys or Age recipients used for encryption, ensuring consistent, reproducible encryption across the repository. Option A is not essential: Git LFS is a storage optimization for large binaries and is unrelated to SOPS, which encrypts values in place within YAML/JSON files. Option B is not essential: SOPS decryption is performed natively by the GitOps controller (or the sops binary), so a custom CI/CD build step to decrypt is unnecessary and would actually break the GitOps principle of the cluster reconciling encrypted manifests directly.

Answer

Enabling Git LFS for encrypted files

Answer

Running a custom CI/CD build to decrypt

Question 15

When migrating from ArgoCD to Flux, you want to replicate the 'Sync Waves' behavior. Which Flux feature provides equivalent control over the order of resource reconciliation?

Accepted Answer

dependsOn. Flux's dependsOn field in a Kustomization or HelmRelease resource declares dependencies, ensuring that one resource is reconciled only after its dependencies are ready. This replicates ArgoCD's Sync Waves behavior, where resources are applied in ordered waves. dependsOn provides the same ordering guarantee by gating reconciliation on dependency health.

Answer

Post-sync hooks

Answer

Sync waves

Answer

Reconciliation intervals