CGOA Practice Test 21 — 15 Questions

Question 1

Which THREE of the following are primary benefits of adopting GitOps for CI/CD integration?

Accepted Answer

Increased consistency between environments through standardized Git workflows.. Option B is correct because GitOps uses Git as the single source of truth, so declarative manifests and standardized pull-request workflows ensure every environment is reconciled to the same committed state, eliminating configuration drift. Option D is correct because the entire desired cluster state lives in Git, so disaster recovery becomes a matter of pointing a GitOps operator (e.g., Argo CD or Flux) at the repository and letting it re-apply the manifests to a new cluster. Option E is correct because every change flows through Git commits and pull requests, giving a tamper-evident, attributable history that supports audit and compliance requirements. Option A is not a GitOps benefit since GitOps concerns deployment and reconciliation, not compiler performance, and Option C is wrong because GitOps does not remove the need for automated security scanning; it typically complements it with policy-as-code and supply-chain checks.

Answer

Faster code compilation times compared to traditional CI systems.

Answer

Reduced need for automated security scanning.

Question 2

When considering the GitOps principle of 'Declarative Desired State', which TWO of the following statements accurately reflect why manifests should be stored in Git?

Accepted Answer

To serve as the single source of truth for the entire cluster configuration. Option B is correct because storing manifests in Git makes the repository the single source of truth for the entire cluster configuration, so the declarative desired state is versioned, auditable, and can be reconciled by a GitOps operator such as Argo CD or Flux. Option D is correct because Git-based manifests enable peer review and collaboration through Pull Requests, allowing changes to the desired state to be reviewed, approved, and merged before being applied. Option A is incorrect because image pull latency is determined by container registry and node networking, not by where manifests are stored. Option C is incorrect because Git does not automatically encrypt database data; encryption is handled by database or storage-level mechanisms. Option E is incorrect because reconciliation is performed by a GitOps controller running in the cluster, not by the Git server itself.

Answer

To reduce the latency of image pull times

Answer

To automatically encrypt all data in the database

Answer

To allow the Git server to perform the cluster reconciliation

Question 3

In an Argo CD 'Application' manifest, what does the 'destination' field specify?

Accepted Answer

The Kubernetes cluster and namespace for deployment. In an Argo CD Application manifest, the destination field defines where the application's manifests will be deployed — specifically the target Kubernetes cluster (by server URL or name) and the target namespace. It is paired with the source field, which points to the Git repository and path containing the desired manifests. Together, source + destination describe the 'what' and the 'where' of the GitOps deployment.

Answer

The source Git repository URL

Answer

The build server address

Answer

The email address for alerts

Question 4

When using a GitOps operator that performs 'image polling', what is the risk of using a 'latest' tag?

Accepted Answer

It makes rollbacks impossible because the 'latest' image may be different than what was deployed.. Using a 'latest' tag with a GitOps operator that performs image polling is risky because the tag is mutable — the image it points to can change without any change to the Git manifest. If a rollback is needed, the operator cannot guarantee that the 'latest' image it pulls is the same one that was previously deployed, making rollbacks unreliable and non-deterministic. This breaks the GitOps principle of immutable, versioned desired state.

Answer

It causes high latency in the cluster.

Answer

The GitOps operator cannot detect changes.

Answer

It consumes too much disk space.

Question 5

In a multi-cluster GitOps architecture using Argo CD, how do you manage credentials for a remote cluster that is not the cluster where Argo CD resides?

Accepted Answer

Use the argocd cluster add command to store credentials as a secret in the Argo CD namespace. The 'argocd cluster add' command is the standard way to register an external cluster with Argo CD. It creates a ServiceAccount in the target cluster, generates a kubeconfig, and stores the credentials as a Secret in the Argo CD namespace, allowing Argo CD to manage the remote cluster.

Answer

Modify the global ConfigMap in the Argo CD namespace

Answer

Add the cluster URL to the Git repository manifest

Answer

Manually create a Kubernetes secret in the remote cluster

Question 6

You are auditing your GitOps deployment strategy. Which TWO of the following statements correctly describe the 'Source of Truth' in a GitOps architecture?

Accepted Answer

The declared state in the Git repo must match the observed cluster state. Option B is correct because GitOps relies on continuous reconciliation: the declared state stored in Git must be kept in sync with the observed state of the live cluster, and any drift is detected and corrected by a controller such as Argo CD or Flux. Option C is correct because in GitOps the Git repository is the single source of truth for both infrastructure and application manifests, serving as the authoritative declarative specification from which all deployments are derived. Option A is incorrect because the live cluster state is the observed state, not the source of truth; it is compared against Git and reconciled to match it. Option D is incorrect because database backups are for data recovery and are unrelated to the declarative configuration source of truth in GitOps. Option E is incorrect because CI artifacts (build outputs, images) are produced by pipelines and are not the authoritative declarative source; Git holds the desired state that references such artifacts.

Answer

The live cluster state is the ultimate source of truth for all configurations

Answer

Database backups constitute the primary source of truth

Answer

Continuous Integration artifacts are the source of truth

Question 7

What is the main advantage of using a 'Declarative' approach to system management?

Accepted Answer

It makes system state predictable and reproducible.. A declarative approach describes the desired end state of the system, and the tooling continuously reconciles the actual state to match it. This makes the system state predictable and reproducible, because the same declaration applied to any environment yields the same result, and drift can be detected and corrected automatically.

Answer

It requires less storage in Git.

Answer

It allows you to skip CI/CD testing.

Answer

You can use imperative commands like 'kubectl run'.

Question 8

Which TWO of the following are valid ways to trigger a sync in ArgoCD?

Accepted Answer

Clicking 'Sync' in the ArgoCD UI. Option B is correct because the ArgoCD web UI provides a 'Sync' button on each Application that triggers an immediate synchronization of the desired manifests from Git to the target cluster. Option C is correct because ArgoCD supports Git webhooks (e.g., GitHub, GitLab, Bitbucket) that notify the argocd-server when a repository changes, allowing automated sync to be triggered without manual intervention. Option A is incorrect because sending a kill signal to the controller would terminate the process rather than initiate a sync, and ArgoCD does not interpret OS signals as sync triggers. Option D is incorrect because deleting the Git repository removes the source of truth and would cause sync failures, not trigger a sync. Option E is incorrect because restarting the API server only restarts the ArgoCD API component; it does not itself initiate an application sync.

Answer

Sending a kill signal to the controller

Answer

Deleting the Git repository

Answer

Restarting the API server

Question 9

Which THREE of the following are common methods for managing secrets in a GitOps workflow?

Accepted Answer

External Secrets Operator. The External Secrets Operator (A) is correct because it syncs secrets from external secret managers (e.g., AWS Secrets Manager, HashiCorp Vault) into Kubernetes Secrets, keeping the source of truth outside Git while still enabling GitOps reconciliation. Sealed Secrets (B) is correct because it uses asymmetric encryption so that encrypted SealedSecret resources can be safely committed to Git and decrypted only by the controller in the cluster. Mozilla SOPS (C) is correct because it encrypts values within YAML/JSON files using KMS, age, or PGP keys, allowing encrypted secret manifests to be stored in Git and decrypted during the GitOps pipeline. Committing raw Kubernetes Secret YAMLs (D) is not acceptable because base64 encoding is not encryption, so credentials would be exposed in the repository. Hardcoding credentials in Dockerfiles (E) is not acceptable because it bakes plaintext secrets into image layers, exposing them to anyone with image access and violating secret-management best practices.

Answer

Committing raw Kubernetes Secret YAMLs

Answer

Hardcoding credentials in Dockerfiles

Question 10

Which THREE components are typically involved in a GitOps reconciliation loop?

Accepted Answer

A controller running inside the cluster.. In a GitOps reconciliation loop, the Git repository containing manifests (E) is the single source of truth, holding the desired state that the system continuously compares against. A controller running inside the cluster (A) — such as Argo CD's application controller or Flux's kustomize-controller — watches that repo and performs the actual reconciliation by detecting drift and re-syncing. The Kubernetes API server (B) is the target of that reconciliation: the controller reads live object state from it and issues create/update/patch calls to converge the cluster on the desired state. Option C is wrong because GitOps is designed for automated, continuous reconciliation, not per-change human approval gates (approval may exist as a policy, but it is not a core loop component). Option D is wrong because GitOps explicitly rejects an external CI server manually applying changes (push-based deploys); the in-cluster controller pulls and applies, rather than CI pushing kubectl/helm commands.

Answer

A manual human approval gate for every change.

Answer

An external CI server that manually applies changes.

Question 11

You are debugging a drift in a GitOps environment. The cluster state differs from the Git repository. What is the most likely cause if you are using Flux?

Accepted Answer

A user performed a manual 'kubectl' command to modify a deployment.. Flux continuously reconciles the cluster state with the desired state defined in Git. If a user manually modifies a resource with kubectl, that change is not in Git, so Flux will detect the drift and may revert it. This is the most likely cause of drift in a GitOps environment because Git is the single source of truth. Other options would typically cause deployment failures or prevent updates, but not drift between Git and the cluster.

Answer

The container registry is unreachable during a new image rollout.

Answer

The Git repository contains syntax errors in the YAML files.

Answer

The CI pipeline failed to run tests.

Question 12

When syncing a Git repository to a cluster, what is the 'Sync Policy' in Argo CD?

Accepted Answer

It defines whether the application should be synced automatically or manually.. The Sync Policy in Argo CD controls whether the application is synchronized automatically when Git changes are detected, or only when a user manually triggers a sync. It is configured via the `syncPolicy.automated` field in the Application manifest, and can include options like self-heal and prune. It does not manage credentials, health check frequency, or branch selection.

Answer

It sets the password for the Git repository.

Answer

It configures the frequency of the container health checks.

Answer

It determines which Git branch is used for the deployment.

Question 13

Which THREE components are essential for a complete GitOps CI/CD pipeline?

Accepted Answer

An automated controller that reconciles the cluster to the Git state.. Option A is correct because GitOps fundamentally relies on an automated controller (e.g., Argo CD or Flux) running in the cluster that continuously reconciles the live state to match the desired state declared in Git. Option B is correct because a CI system (e.g., Jenkins, GitHub Actions, GitLab CI) is needed to build artifacts and commit updated manifests to the manifest repository, closing the loop between code changes and deployment. Option D is correct because Git serves as the single source of truth, storing the declarative desired state that the controller reconciles against, which is the defining characteristic of GitOps. Option C is not essential because GitOps emphasizes automated, declarative deployments rather than manual dashboard-driven operations, and Option E is not essential because log storage is an observability concern, not a core component of the GitOps CI/CD pipeline itself.

Answer

A human-operated dashboard for manual deployment.

Answer

A dedicated server for storing logs.

Question 14

Which GitOps tool is primarily associated with the 'pull' deployment model?

Accepted Answer

Flux. Flux is a CNCF-graduated GitOps operator that implements the pull model: an in-cluster agent watches Git repositories and pulls changes into the cluster, rather than an external system pushing deployments in. This pull architecture is the defining characteristic of modern GitOps tooling and is why Flux (alongside Argo CD) is the canonical example.

Answer

Jenkins

Answer

Ansible

Answer

Terraform

Question 15

Which TWO are common pitfalls in a GitOps implementation?

Accepted Answer

Allowing manual 'kubectl edit' changes.. Option C is correct because allowing manual 'kubectl edit' changes breaks the GitOps principle that Git is the single source of truth; the live cluster state drifts from the declared state, and the next reconciliation by tools like Argo CD or Flux will either overwrite the manual change or leave the cluster inconsistent. Option E is correct because committing plaintext secrets to Git exposes credentials to anyone with repository read access and permanently stores them in Git history, which is a well-known GitOps pitfall; secrets should instead be managed with Sealed Secrets, External Secrets Operator, SOPS, or a vault. Option A is not a pitfall—using Git for version control is the foundational requirement of GitOps. Option B is not inherently a pitfall; branching strategy is a workflow choice, and many successful GitOps setups use trunk-based development or a modest number of branches. Option D is not a pitfall—automation is the goal of GitOps, and automating more processes generally increases consistency rather than causing problems.

Answer

Using Git for version control.

Answer

Having too many branches.

Answer

Automating too many processes.