CGOA Practice Exam 3 — 20 Questions

Question 1

When using Argo CD, what does the 'Sync Status' 'OutOfSync' indicate?

Accepted Answer

The live state differs from the desired state in Git.. In Argo CD, 'OutOfSync' means the live Kubernetes cluster state does not match the desired state declared in the Git repository. Argo CD continuously compares the manifests in Git against the resources running in the cluster, and any difference (missing resource, changed field, extra resource) sets the Sync Status to OutOfSync. This is distinct from Health Status, which reflects whether resources are functioning correctly.

Answer

The cluster is disconnected from the network.

Answer

A new version of the application is available in the registry.

Answer

The Git repository has been deleted.

Question 2

Why is 'pull-based' reconciliation considered more secure than 'push-based' CI/CD?

Accepted Answer

Because the cluster initiates the connection.. In a pull-based model, an in-cluster agent (Argo CD, Flux) initiates outbound connections to Git and the registry, so no external system needs inbound access or cluster-admin credentials. This inverts the trust boundary: the cluster reaches out rather than an external CI server reaching in. That architectural inversion is what makes pull-based reconciliation more secure.

Answer

Because it eliminates the need for Git.

Answer

Because Git requires passwords for every pull.

Answer

Because it removes the need for container images.

Question 3

When using an 'Image Updater' with a GitOps operator, what is the automated workflow?

Accepted Answer

It detects new images and updates the manifest in Git. An Image Updater (such as Argo CD Image Updater) monitors a container registry for new image tags and, when it detects a newer version matching the configured policy, writes the updated image tag back into the Git manifest. This keeps Git as the source of truth while automating image version bumps. The GitOps operator then syncs the updated manifest to the cluster.

Answer

It manually restarts the cluster

Answer

It creates a backup of the cluster

Answer

It bypasses the git repository entirely

Question 4

In a GitOps environment, what is the role of a 'CI Pipeline'?

Accepted Answer

To validate changes and commit them to the GitOps repo. In GitOps, the CI pipeline's job is to build, test, and validate changes, then commit the resulting manifests (or updated image tags) into the GitOps repository. The GitOps operator (e.g., Argo CD or Flux) then detects the commit and reconciles the cluster to match. CI produces the desired state; the GitOps controller applies it.

Answer

To replace the GitOps operator

Answer

To execute the reconciliation loop

Answer

To handle user authentication for the cluster

Question 5

Which tool provides the most native integration for managing Kubernetes manifests using Kustomize within a GitOps workflow?

Accepted Answer

Argo CD. Argo CD is purpose-built for GitOps and natively supports Kustomize as a first-class manifest source. Its repository server recognizes kustomization.yaml files and can render Kustomize overlays directly without external tooling. Terraform, Ansible, and Jenkins are general-purpose automation tools that require custom glue code to invoke Kustomize and do not provide continuous reconciliation of Kustomize-rendered manifests.

Answer

Terraform

Answer

Ansible

Answer

Jenkins

Question 6

What is the primary advantage of storing Kubernetes manifests in a version-controlled repository?

Accepted Answer

It provides a backup in case the cluster is deleted.. Storing Kubernetes manifests in a version-controlled repository (e.g., Git) creates a durable, auditable record of the desired cluster state. If the cluster is deleted or corrupted, the manifests can be re-applied to rebuild the environment, effectively acting as a backup of the declarative configuration. This is a core GitOps principle: Git is the single source of truth for both application and infrastructure definitions.

Answer

It makes the container images run faster.

Answer

It automatically patches security vulnerabilities.

Answer

It allows developers to bypass the CI/CD system.

Question 7

You have a GitOps pipeline where you want to promote a change from Staging to Production. Using Argo CD, what is the recommended way to perform this promotion?

Accepted Answer

Update the version in the Git manifest for the Production Application and commit.. In a GitOps model, Git is the single source of truth, so promotion between environments must be performed by changing the desired state in Git, not by imperative commands. Updating the version in the Production Application's manifest and committing it lets Argo CD detect the drift and reconcile the cluster to match. This preserves auditability, rollback via Git revert, and declarative consistency.

Answer

Update the ApplicationSet generator to point to a different branch.

Answer

Run 'argocd app sync' pointing to the staging image.

Answer

Use the 'kubectl patch' command on the production deployment.

Question 8

Which of these is a primary reason for using Helm charts in a GitOps workflow?

Accepted Answer

Templating and packaging complex applications. Helm charts are used in GitOps workflows primarily for templating and packaging complex applications (D). Helm allows you to define Kubernetes resources as parameterized templates, making it easy to manage and version application configurations in Git. This aligns with GitOps principles where the desired state is stored declaratively in Git and applied automatically.

Answer

Encrypting all traffic

Answer

Replacing the need for Kubernetes

Answer

Creating Git commits automatically

Question 9

In an Argo CD deployment, a developer notices that manual changes made via kubectl are being reverted automatically. What feature is responsible for this behavior?

Accepted Answer

Auto-Sync with Self-Heal enabled. Argo CD's Auto-Sync with Self-Heal enabled continuously compares the live cluster state against the desired state in Git and automatically reverts any drift. When a developer makes a manual kubectl change, the Application Controller detects the difference during its reconciliation loop and re-applies the Git-defined manifest, effectively undoing the manual change. Self-Heal is the specific sub-feature of automated sync that enforces this drift correction.

Answer

Git commit hook triggers

Answer

Kubernetes admission controllers

Answer

Manual refresh button

Question 10

A company transitions from a push-based CI/CD pipeline (using Jenkins) to a pull-based GitOps model (using Flux). What is the primary security architectural change regarding cluster access?

Accepted Answer

The CI server no longer requires cluster credentials. In a pull-based GitOps model, the in-cluster operator (Flux) pulls desired state from Git and applies it from inside the cluster. The CI server's only job is to build and push artifacts and commit manifest changes to Git — it never needs kubeconfig or cluster API credentials. This removes the long-lived cluster credentials that a push-based Jenkins pipeline required to run kubectl/helm against the cluster.

Answer

Git is no longer the source of truth

Answer

The cluster no longer requires an API server

Answer

The operator is now a push-based agent

Question 11

When a manual change is made directly to a Kubernetes Service via 'kubectl edit', what behavior is expected from a properly configured GitOps operator set to 'Automatic Sync'?

Accepted Answer

The operator identifies the drift and automatically overwrites the live state with the Git version.. With Automatic Sync enabled, a GitOps operator such as Argo CD continuously compares live cluster state against the desired state in Git. When it detects drift — for example, a manual kubectl edit to a Service — it automatically re-applies the Git version, overwriting the manual change. This self-healing behaviour is the core guarantee of GitOps: Git remains the single source of truth.

Answer

The operator ignores the change to prevent production downtime.

Answer

The operator updates the Git repository to match the new manual change.

Answer

The operator prompts the administrator for manual approval before reverting.

Question 12

What is the purpose of the 'destination' field in an Argo CD Application manifest?

Accepted Answer

It defines the target Kubernetes cluster and namespace.. The destination field in an Argo CD Application manifest specifies the target Kubernetes cluster (by server URL or name) and the namespace where the application's resources will be deployed. It tells Argo CD where to apply the manifests from the source repository. This is essential for multi-cluster deployments.

Answer

It defines the sync frequency.

Answer

It defines the user who triggered the sync.

Answer

It defines the Git repository URL.

Question 13

You are debugging a GitOps deployment. The controller shows 'OutOfSync' but the cluster seems to be running correctly. What is the most likely cause?

Accepted Answer

Manual changes were made to the live resource that weren't captured in Git.. An 'OutOfSync' status means the live cluster state diverges from the desired state declared in Git. If the cluster is running correctly, the most common cause is that someone made manual changes (kubectl edit, kubectl apply, or a hotfix) directly to the live resource, so the controller detects drift between Git and the cluster. The controller is functioning as designed by flagging the discrepancy.

Answer

The network latency to the Git server is too high.

Answer

The Git repository is empty.

Answer

The controller is broken.

Question 14

Which of the following is considered 'best practice' for GitOps repository structure?

Accepted Answer

Using a separate repository for environment configurations. Best practice for GitOps repository structure is to separate application source code from deployment configuration, and often to use separate repositories (or at least separate directories) for environment-specific configurations (dev, staging, prod). This separation enables independent promotion, access control, and rollback per environment, and prevents a change to one environment from inadvertently affecting another. Using a separate repository for environment configurations is a recognized best practice.

Answer

Storing source code and manifest files in the same directory

Answer

Keeping all configuration in a single root file

Answer

Committing binary files to the repo

Question 15

Which THREE are standard ways to implement GitOps with Helm?

Accepted Answer

Using a GitOps operator to trigger 'helm install'.. Option C is correct because GitOps operators such as Argo CD or Flux watch a Git repository and automatically trigger Helm operations like 'helm install' or 'helm upgrade' when the desired state changes, which is the core GitOps reconciliation loop. Option D is correct because storing the final rendered YAML manifests in Git is a valid GitOps pattern (often called 'rendered manifests' or 'last-mile' GitOps), where the cluster state is applied directly from committed YAML without Helm running in the cluster. Option E is correct because storing Helm values files in Git is a standard GitOps approach where the chart is referenced from a chart repository and the environment-specific values are version-controlled, allowing the operator to render and apply the release. Option A is not a GitOps implementation because running 'helm upgrade' manually is an imperative, human-driven action that bypasses Git as the single source of truth. Option B is not a complete GitOps implementation because storing only the chart source code without values, rendered manifests, or an automated operator does not provide the declarative, continuously reconciled deployment that GitOps requires.

Answer

Running 'helm upgrade' manually.

Answer

Only storing the chart source code.

Question 16

When managing multiple environments (dev/stage/prod) in one repository, which folder structure is generally considered best practice?

Accepted Answer

Using environment-specific folders.. Environment-specific folders (e.g., /dev, /stage, /prod) keep manifests for each environment isolated while sharing a single repository, enabling consistent promotion workflows and clear ownership. This structure lets GitOps tools like Argo CD or Flux target a specific path per environment without duplicating the entire repo. It also makes diffs between environments obvious and supports per-environment overlays (Kustomize) or values files (Helm).

Answer

Storing configurations in the application code folder.

Answer

Putting everything in a single root folder.

Answer

Using different Git repos for every single manifest.

Question 17

Which Argo CD feature allows you to manage multiple applications with shared configuration?

Accepted Answer

ApplicationSets.. ApplicationSets is the Argo CD controller that generates multiple Application resources from a single template combined with generators (List, Cluster, Git, Matrix, Merge, Pull Request). It is purpose-built for managing many applications that share configuration, such as one app per cluster or per tenant.

Answer

Sync Waves.

Answer

Application Projects.

Answer

Resource Hooks.

Question 18

Which of the following is NOT a benefit of the GitOps model?

Accepted Answer

Increased system performance.. GitOps is a deployment and operational model that uses Git as the single source of truth for declarative infrastructure and applications. Its primary benefits are improved auditability (every change is a Git commit), faster disaster recovery (the desired state can be reapplied from Git), and standardized deployment processes (consistent workflows across environments). Increased system performance is not a benefit of GitOps; performance depends on application design, resource allocation, and infrastructure, not on how deployments are managed.

Answer

Improved auditability.

Answer

Faster recovery from disasters.

Answer

Standardized deployment processes.

Question 19

In a GitOps environment using Argo CD, what is the primary purpose of the reconciliation loop?

Accepted Answer

To automatically apply changes from the Git repository to the target Kubernetes cluster.. Argo CD's reconciliation loop continuously compares the desired state in Git with the live state in the cluster and, when auto-sync is enabled, applies the differences to bring the cluster into the desired state. This is the core mechanism that makes Git the source of truth for deployments.

Answer

To perform unit testing on manifest files before they are merged.

Answer

To push new container images to the registry whenever a build completes.

Answer

To scale deployment replicas based on real-time traffic metrics.

Question 20

In a GitOps pattern, how do you manage a rollback when an application deployment fails?

Accepted Answer

Revert the commit in Git and let the GitOps operator reconcile.. In GitOps, Git is the single source of truth for the desired state of the system. To roll back a failed deployment, you revert the offending commit in Git, which changes the desired state back to the last known good version. The GitOps operator (e.g., Argo CD or Flux) continuously reconciles the cluster to match Git, so it will automatically apply the rollback. This approach ensures that the rollback is version-controlled, auditable, and consistent with the declarative model.

Answer

Delete the pods and let the operator recreate them.

Answer

Stop the GitOps operator to prevent it from correcting the state.

Answer

Run 'kubectl rollout undo' on the deployment.