CGOA Practice Test 19 — 15 Questions

Question 1

What is the difference between a 'Sync' and a 'Refresh' in Argo CD?

Accepted Answer

Refresh updates the application status; Sync applies changes to the cluster. In Argo CD, 'Refresh' is a read-only operation that re-queries the Git repository and the live cluster to update the application's status, diff, and sync state without modifying anything. 'Sync' is the write operation that applies the desired manifests from Git to the target Kubernetes cluster, bringing live state into alignment with the declared state. The two are distinct phases: Refresh detects drift, Sync remediates it.

Answer

Sync is for reading; Refresh is for writing

Answer

Refresh is for Git; Sync is for the cloud provider API

Answer

They are the same thing

Question 2

Which TWO of the following are core components of a mature GitOps-based DevSecOps practice?

Accepted Answer

Integrating automated security policies (like OPA) into the deployment workflow.. Option D is correct because a mature GitOps-based DevSecOps practice embeds policy-as-code engines such as Open Policy Agent (OPA) with Gatekeeper into the CI/CD and reconciliation pipeline, so admission and deployment decisions are automatically enforced against security and compliance rules rather than relying on manual review. Option E is correct because GitOps requires the desired state of infrastructure and applications to be declared as code in a Git repository, which makes deployments repeatable, version-controlled, auditable, and continuously reconciled by tools like Argo CD or Flux. Option A is incorrect because manual SSH access bypasses the declarative Git workflow, breaks auditability and reproducibility, and undermines the principle that changes flow through Git. Option B is incorrect because granting all developers cluster-admin privileges violates least privilege and expands the blast radius of mistakes or compromised credentials. Option C is incorrect because GitOps depends on declarative manifests, CLI tooling, and automated pipelines rather than GUI-driven cluster management, which is not a core component of the practice.

Answer

Using manual SSH access for emergency production troubleshooting.

Answer

Ensuring all developers have cluster-admin privileges for rapid debugging.

Answer

Relying primarily on graphical user interfaces for cluster management.

Question 3

When mapping traditional CI/CD to GitOps, which component from the traditional world is often 'decommissioned' or replaced?

Accepted Answer

The imperative CD deployment scripts (e.g., shell scripts that run 'kubectl apply').. In GitOps, the CD mechanism shifts from imperative push-based scripts (e.g., 'kubectl apply' in a Jenkins job) to a declarative pull-based controller (Flux/Argo CD) that continuously reconciles cluster state with Git. The imperative CD deployment scripts are therefore decommissioned because the GitOps operator replaces their role entirely. The build tool, container registry, and Git itself remain essential parts of the pipeline.

Answer

The container registry.

Answer

The build tool (e.g., Maven/npm).

Answer

The Git version control system.

Question 4

When a GitOps tool reports a 'Sync Error', what is the most likely cause?

Accepted Answer

The manifest contains invalid Kubernetes syntax. A 'Sync Error' in a GitOps tool such as Argo CD or Flux means the operator successfully retrieved the desired state from Git but failed to apply it to the cluster. The most common root cause is that the manifest itself is invalid — malformed YAML, an unknown API version, a missing required field, or a schema violation that the Kubernetes API server rejects. Because the error surfaces during the apply/reconcile step rather than the fetch step, it points squarely at the manifest content rather than connectivity or infrastructure capacity.

Answer

The Git repository is deleted

Answer

The cluster has too many nodes

Answer

The network latency is high

Question 5

Why is 'Git' used as the source of truth rather than a standard database?

Accepted Answer

Git provides native versioning, history, and collaboration. Git is used as the source of truth because it natively provides versioning, full history, branching, and collaboration workflows (pull requests, reviews, merges) that a standard database does not offer out of the box. These properties make configuration changes auditable, reviewable, and reversible — the foundation of GitOps.

Answer

Git is the only format Kubernetes supports

Answer

Git is easier to host on-premise

Answer

Git is faster at read operations

Question 6

What happens if the Git repository is temporarily unavailable during a sync cycle?

Accepted Answer

The operator waits and retries the fetch. GitOps operators such as Argo CD or Flux are designed to be resilient to transient failures. When the Git repository is temporarily unreachable, the operator does not alter the cluster; it simply waits and retries the fetch on its next reconciliation loop, preserving the last known desired state. This ensures the cluster remains stable and avoids destructive actions caused by a temporary network or repository outage.

Answer

The operator wipes the current state

Answer

The cluster reverts to a hardcoded default

Answer

The cluster automatically deletes all applications

Question 7

Which THREE of the following represent key concepts in 'GitOps'?

Accepted Answer

Infrastructure as Code (IaC). Option A (Infrastructure as Code) is correct because GitOps requires all infrastructure and application configuration to be expressed declaratively in code, so it can be versioned and stored in Git rather than configured manually. Option D (Automated Reconciliation) is correct because a GitOps agent (e.g., Argo CD or Flux) continuously compares the live cluster state against the desired state in Git and automatically converges the system to that desired state. Option E (Git as the Source of Truth) is correct because in GitOps the Git repository is the single authoritative source for the desired state of the system, and all changes flow through Git commits and pull requests. Option B (Manual intervention for every change) is not a GitOps concept, since GitOps emphasizes automated, declarative deployments triggered by Git changes rather than manual steps. Option C (Direct terminal access to production) is also not a GitOps concept, as GitOps discourages direct imperative access to production in favor of changes made through Git and applied by the reconciliation controller.

Answer

Manual intervention for every change

Answer

Direct terminal access to production

Question 8

Which TWO characteristics help ensure a GitOps repository is auditable?

Accepted Answer

Cryptographically signed commits to verify authorship.. Option C is correct because cryptographically signed commits (e.g., using GPG or SSH signatures verified via git commit -S and git verify-commit) provide non-repudiable proof of who authored a change, which is essential for auditability in a GitOps repository. Option D is correct because detailed commit logs capturing author identity and timestamp (as recorded in the commit object's author/committer fields and shown by git log) create a traceable history of every change, satisfying audit requirements. Option A is incorrect because restricting pushes to a single admin user does not by itself provide an audit trail and actually reduces traceability of who made changes. Option B is incorrect because using private email addresses obscures author identity rather than making the repository more auditable. Option E is incorrect because storing files as binary blobs prevents meaningful diffs and review of changes, undermining auditability.

Answer

Only allowing the admin user to push code.

Answer

Use of private email addresses in commit logs.

Answer

Storing all files as binary blobs.

Question 9

Which of the following is a potential downside of using a 'Pull' model?

Accepted Answer

It requires maintaining an operator within the cluster. In a Pull model, the GitOps agent (operator) runs inside the cluster and continuously pulls desired state from Git. This means an operator must be deployed, maintained, upgraded, and monitored within each cluster, adding operational overhead. The agent also needs RBAC permissions to apply changes, and its lifecycle must be managed alongside the workloads it controls.

Answer

It requires public IP addresses

Answer

It is slower than pushing

Answer

It creates a security hole

Question 10

Which TWO of the following are primary benefits of storing the entire desired state of a system in a versioned Git repository?

Accepted Answer

Comprehensive audit trail of all configuration changes. Option A is correct because committing the full desired state to Git records every change with author, timestamp, and diff, producing a comprehensive, immutable audit trail of all configuration changes. Option C is correct because Git's commit history lets you check out or revert to any earlier commit, so you can restore a previous known-good desired state quickly and reliably. Options B, D, and E are not benefits of versioning desired state: Git does not perform automatic hardware repair, does not by itself provide high availability of the Git server, and does not automatically scale cluster nodes—those require separate tooling and infrastructure.

Answer

Automatic hardware repair

Answer

High-availability of the Git server

Answer

Automatic scaling of cluster nodes

Question 11

Which TWO of the following are considered advantages of the GitOps approach?

Accepted Answer

Improved auditability through version-controlled commits.. Option C is correct because GitOps stores the desired state of infrastructure and applications as declarative manifests in a Git repository, so every change is captured as a version-controlled commit with author, timestamp, and diff history, giving a complete and auditable trail. Option D is correct because since the Git history is the single source of truth, reverting to a previous commit (for example with git revert or git reset) lets the GitOps operator automatically reconcile the cluster back to the prior known-good configuration, making rollbacks simple and reliable. The unmarked options do not belong: A is wrong because GitOps reduces manual CLI interventions by automating reconciliation from Git, B is wrong because GitOps manages infrastructure and deployment state rather than generating business requirements, and E is wrong because GitOps enforces security and policy controls through review and CI checks rather than bypassing them.

Answer

Increased reliance on manual CLI interventions.

Answer

Automatic creation of new business requirements.

Answer

Ability to bypass security protocols.

Question 12

Which THREE of the following represent common symptoms of 'drift' in a GitOps-managed cluster?

Accepted Answer

Unexpected changes to resource labels or annotations. Drift in a GitOps-managed cluster means the live state diverges from the desired state declared in Git, so option A is correct because unexpected changes to resource labels or annotations indicate someone or something modified objects outside the Git workflow, breaking the declared manifest. Option B is correct because manually editing a ConfigMap via kubectl changes the live cluster state directly, bypassing Git as the single source of truth and creating drift that a reconciler like Argo CD or Flux would detect and revert. Option D is correct because unauthorized scaling of a deployment alters the replica count away from the value in Git, a classic drift symptom that reconciliation would flag or correct. Option C does not belong because a successful CI pipeline execution is a normal build/test outcome and says nothing about live cluster state diverging from Git. Option E does not belong because a long Git commit history is simply normal repository activity and is unrelated to whether the cluster's actual state matches the desired state.

Answer

Successful CI pipeline execution

Answer

Git commit history being too long

Question 13

In the context of GitOps, what is the primary role of the 'Source of Truth'?

Accepted Answer

To serve as the definitive, version-controlled repository for the system's desired configuration.. In GitOps, the Source of Truth is the Git repository that holds the declarative, version-controlled desired state of the entire system. All deployments and reconciliations are driven from this repository, making it the authoritative reference for what the infrastructure and applications should look like. Any divergence between the cluster and Git is treated as drift to be corrected.

Answer

To store the database backups for the application.

Answer

To host the container images used by the applications.

Answer

To act as the runtime environment where pods are scheduled.

Question 14

What is the primary function of the 'reconciliation loop' in GitOps?

Accepted Answer

To continuously compare actual state with Git and correct discrepancies.. The reconciliation loop is the core control mechanism of GitOps: an agent continuously observes the actual state of the cluster and compares it to the desired state stored in Git, then takes corrective action to eliminate any difference. This closed-loop feedback ensures the cluster converges on the declared configuration and stays there despite manual changes, failures, or drift. It is what makes Git the authoritative source of truth in practice.

Answer

To manage user access control for the cluster.

Answer

To compile source code into container images.

Answer

To update the documentation in the Git repository.

Question 15

Which THREE of the following are potential risks of ignoring drift in a GitOps environment?

Accepted Answer

The Git repo becomes outdated relative to the cluster. Option B is correct because when drift occurs, manual changes are made directly to the cluster and never reflected back into Git, so the Git repository no longer represents the actual desired state and becomes outdated relative to the running cluster. Option C is correct because unmanaged manual changes can introduce unexpected configuration that conflicts with the declared manifests, leading to application instability, inconsistent behavior, or failed reconciliations. Option D is correct because manual changes bypass the reviewed, version-controlled Git workflow, so security-relevant settings (e.g., exposed ports, weakened RBAC, disabled TLS) can be introduced without audit or approval, creating unmanaged vulnerabilities. Option A is incorrect because ignoring drift does not reduce storage usage; drift typically adds untracked resources rather than freeing space. Option E is incorrect because ignoring drift does not increase deployment speed; it undermines the automated, reliable GitOps pipeline and often causes slower, error-prone remediation.

Answer

Reduced storage usage

Answer

Increased deployment speed